This Privacy Policy describes how M-XR Limited (“M-XR,” “we,” “us,” or “our”) collects, uses, and shares personal information of visitors to our website at m-xr.com (the “Website”) and users of the Marso Studio platform and M-XR account, accessible at marso.app and app.m-xr.com (together, the “Platform”). The Website and the Platform are together referred to as the “Services”. We are committed to protecting your privacy and ensuring compliance with the UK General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018.
This Policy does not cover Marso Measure, which is licensed and made available under separate terms provided to you at the point of download.
M-XR Limited is the data controller responsible for the processing of your personal data collected through the Services. Our registered address is 159 High Street, Barnet, England, EN5 5SU.
Where M-XR processes personal data on your behalf as a data processor (for example, where personal data is contained within content you submit to the Platform for processing), such processing is governed by our Data Processing Addendum, available on request.
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:
M-XR Limited, Mare Street Studios, London E8 3JY
Email: support@m-xr.com
This Policy applies to two related services:
Different categories of data are processed depending on which of the Services you use, as set out in section 4.
Information You Provide Directly:
Information Collected Automatically:
When you create an account and use the Platform, we process the following:
We will only process your personal data when we have a lawful basis for doing so. These bases may include:
Consent: Where you have given us explicit consent to process your personal data for a specific purpose (e.g., for marketing communications). You have the right to withdraw your consent at any time.
Contractual Necessity: Where processing is necessary for the performance of a contract with you — including creating and administering your account and providing the Platform — or to take steps at your request prior to entering into a contract.
Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. Our legitimate interests may include:
Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject.
We may use your personal information for various purposes, including:
We may share your personal information with the following categories of recipients:
Service Providers and Sub-processors: We engage third-party service providers and sub-processors to help us operate the Services (e.g., website hosting, analytics, email marketing, and — for the Platform — cloud infrastructure and AI model hosting and inference). These providers have access to personal data only to the extent necessary to perform their services and are contractually obligated to protect it. The key sub-processors used for the Platform are listed in section 8.
Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will provide notice if your personal information becomes subject to a different privacy policy as a result of such a transaction.
Legal Requirements: We may disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g., law enforcement agencies, regulatory bodies).
Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honour this Privacy Policy.
With Your Consent: We may share your personal information with third parties when we have your explicit consent to do so.
We use the following key sub-processors in connection with the Marso Studio Platform. These sub-processors provide cloud infrastructure and AI model hosting and inference used to operate the Platform. Each processes data only as necessary to provide its service to us, and is bound by contractual data-protection obligations. Some sub-processors process data outside the UK and EEA; see section 9 (International Data Transfers).
| Sub-processor | Data processed |
|---|---|
| Modal | Inputs and Outputs (primarily 3D geometry and material data) and related processing metadata |
| Fal | Inputs submitted to the relevant Platform features (which may include prompts and reference images) and the resulting Outputs |
| Inputs submitted to the relevant Platform features (which may include prompts and reference images) and the resulting Outputs |
In addition to the Platform sub-processors above, we also use general service providers for the Website and our business operations (such as website hosting, analytics, and email/marketing tools).
A current and complete list of our sub-processors is available on request by contacting support@m-xr.com. Where we add or replace a sub-processor, we will update this list.
Your personal information may be transferred to, and processed in, countries outside the United Kingdom and the European Economic Area (EEA), including the United States, where some of our sub-processors are located.
Where we transfer personal data outside the UK or EEA, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws. These safeguards may include the UK International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or reliance on an adequacy decision, as applicable.
The Platform uses artificial intelligence models — both M-XR’s own models and third-party models provided by our sub-processors — to generate Outputs from your Inputs. This generation is an automated process. It does not involve any decision that produces legal effects concerning you, or that similarly significantly affects you, within the meaning of Article 22 of the UK GDPR. Where you have concerns about automated processing, you may contact us using the details in section 2.
We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by law.
You may request deletion of your data at any time by contacting support@m-xr.com.
Under the UK GDPR and the Data Protection Act 2018, you have certain rights regarding your personal data, including:
The Right to Access: to request access to the personal data we hold about you and to receive a copy of that data.
The Right to Rectification: to request that we correct any inaccurate or incomplete personal data we hold about you.
The Right to Erasure (“Right to be Forgotten”): in certain circumstances, to request that we erase your personal data.
The Right to Restriction of Processing: in certain circumstances, to request that we restrict the processing of your personal data.
The Right to Data Portability: to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
The Right to Object: to object to the processing of your personal data in certain circumstances, including for direct marketing purposes.
Rights in relation to automated decision making and profiling: the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
The Right to Withdraw Consent: if we are processing your personal data based on your consent, to withdraw that consent at any time.
To exercise any of these rights, please contact us at support@m-xr.com. We will respond in accordance with applicable data protection laws. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
Our Services may contain links to other websites or make available third-party models and services that are not operated by us. We have no control over the content and practices of these third parties and cannot accept responsibility or liability for their respective privacy policies. We encourage you to review the privacy policies of any third party you interact with.
The Services are not intended for children. To create an M-XR account or use the Marso Studio Platform, you must be an adult in your jurisdiction (and in any event at least 18 years of age). Our Website is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that a child has provided us with personal information, please contact us immediately at support@m-xr.com, and we will take steps to remove such information from our records.
This Privacy Policy applies to the personal information collected in connection with your use of our online Services (m-xr.com, marso.app, and app.m-xr.com). It does not apply to any information collected offline or via channels other than these Services, nor to Marso Measure, which is governed by its own separate terms.
By using our Services, you consent to this Privacy Policy and agree to its terms.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post any changes on this page and, where appropriate, notify you by other means (e.g., email or in-app notification). We encourage you to review this Privacy Policy periodically. The “Last Updated” date at the top of this policy indicates when it was last revised.
Last Updated: 09-07-2026