Legal
This Privacy Policy explains how Shapes Corp collects, uses, discloses, and protects personal information when you use WorldAgents, including our websites, applications, APIs, AI and spatial services, connected wearable experiences, and support.
Last updated October 1, 2026
This policy applies to WorldAgents, which is operated by Shapes Corp. It covers our collection, use, and disclosure of personal information, including disclosure to service providers. Third-party websites, app stores, devices, customer systems, and providers may also process information under their own privacy notices where they act independently of us.
If you use WorldAgents through an organization, that organization controls its workspace and may direct how we process workspace content on its behalf. In data protection terms, the organization is the controller of its workspace content and we process that content as the organization's processor or service provider, while Shapes Corp acts as the controller of information used for accounts, security, billing, support, and administration of the service. Contact your organization about its own privacy practices.
We collect information you provide directly, information generated through use of the service, and information from service providers or integrations.
Some published agents can be tried without an account through a guest identity with a random identifier. Guest sessions are covered by this policy. If you later create or sign in to an account, we may link the guest identity and its sessions to that account.
Account and organization information, such as name, email address, authentication information (including when you sign in with Google), organization membership, role, settings, invitations, subscription or pilot details, and support communications.
Customer and session content, such as agent instructions, prompts, model responses, files, documents, images, live audio and video, camera frames, transcripts, maps, spatial and positional data (such as device position and orientation, scene geometry, and depth estimates), annotations, simulations, and generated assets.
Device and usage information, such as IP address, browser, operating system, device type and identifiers, app version, permissions, network information, session identifiers and events, feature usage, and diagnostic and security logs. General location may be inferred from an IP address, and location or spatial context may be processed when supplied through a feature you use.
Information from services you connect or use to sign in, such as identity providers, app stores, device platforms, and customer-selected integrations.
We use personal information to operate, secure, support, improve, and communicate about WorldAgents.
Create and administer accounts, organizations, pilots, subscriptions, and support.
Provide realtime sessions, AI and spatial features, recognition, localization, simulations, applications, and APIs.
Authenticate users, maintain reliability, troubleshoot problems, prevent abuse, protect the service, and enforce our terms.
Understand and improve product performance and communicate service, security, legal, and product information.
Comply with law and protect our rights, users, and business.
Where European Economic Area or United Kingdom law applies, we process personal information under the legal bases below. For workspace and session content processed on behalf of an organization, that organization determines the applicable legal basis.
Shapes Corp does not use personal information to make solely automated decisions that produce legal or similarly significant effects about individuals.
Contract: account creation, authentication, requested sessions and device features, organization administration, and support.
Legitimate interests: service security, abuse prevention, reliability, troubleshooting, and limited product analytics, where those interests are not overridden by individual rights.
Consent: optional marketing and other processing for which we specifically request consent. Consent may be withdrawn at any time; withdrawal does not affect processing already completed.
Legal obligations: tax, accounting, regulatory requests, dispute handling, and protection of legal rights.
WorldAgents processes microphone audio, camera input, prompts, files, and related spatial or device context to provide the features you request, including when that input comes from a paired wearable device you choose to use. This content may be sent to AI, recognition, cloud, and device-service providers that help us operate those features. Requests to AI model providers are routed through our servers.
We do not record or store your audio or video. Microphone audio and camera input are processed live: they are sent to the AI, recognition, and cloud providers that perform the feature you are using, and we do not keep them once they have been processed.
We keep a text transcript and a technical session timeline so authorized users can review the session and we can operate and troubleshoot the service. These can include descriptions of what the camera showed and the objects that were recognized, but not the audio or video itself.
A still image is stored only when you upload one, or when you use an agent feature that has to keep a picture to work, such as remembering a view or creating an image from what your camera shows. It is kept as a file of that session.
Access to session transcripts, timelines, and files is limited to authorized organization users and to personnel and service providers who need it to operate, secure, support, or troubleshoot WorldAgents.
If your image, voice, or location information is captured through a WorldAgents deployment operated by one of our customers, that customer ordinarily determines why the information is collected and is responsible for providing any required notice and obtaining any required consent. Contact the organization operating the deployment first; you may also contact us if you cannot identify it.
Model providers may separately retain content for features such as session resumption, safety and abuse monitoring, or legal obligations, subject to the applicable provider terms and configuration. Retention by these providers may differ from our own retention periods.
We process audio, images, and session content to provide and secure the requested features, and we use the session content we keep to evaluate, troubleshoot, and improve them, including review by authorized personnel where needed for those purposes. Our AI service providers process content under their applicable terms and configuration. Use of non-public customer content to train models for general use requires authorization through a separate agreement, an enabled product setting, or written permission, with any additional notice or consent required by law.
Features such as visual object recognition, scene geometry reconstruction, and spatial agent reasoning are powered by an AI backend operated by Shapes Corp on Amazon Web Services (AWS) infrastructure in the United States. The system recognizes the objects configured for a deployment, for example artworks in a museum experience, and the backend is reached only by our own servers, never directly by your device.
Camera images are processed to recognize objects and reconstruct scenes, and we do not store them except as described in Section 5. Recognition results, geometric coordinates, and position estimates may be retained in session transcripts and technical timelines under the retention practices described below.
We do not perform facial recognition, and we do not create biometric identifiers or biometric profiles from camera input. Images may incidentally include people and are subject to the processing and retention practices described in this policy.
When you use these AI-assisted features, the following categories of data are transmitted to and processed by the AI backend:
Camera images and video frames captured by your device, used to recognize objects relevant to your deployment and reconstruct scene geometry.
Spatial and positional data, such as estimated viewer position and orientation, scene maps, and recognized-object geometry.
Agent queries and responses, when you interact with AI agent features, for example questions answered by a spatial reasoning agent.
Session and device metadata, such as a session identifier, user identifier, device identifier, platform, and application version, used to operate and secure the session.
We use service providers to operate WorldAgents. We require them to protect personal information and process it for the services they provide to us, subject to applicable contractual and legal obligations.
These providers fall into the categories below. We provide a current, named list of subprocessors to organizations on request and as part of our customer agreements:
Cloud infrastructure and hosting, primarily in the United States: compute (including GPU compute for the AI backend), storage, networking, key and secrets management, backups, log storage, and transactional email delivery.
AI model providers that power realtime voice, video, and text agent sessions, voice transcription, image understanding, visual recognition, and generation of preview images and 3D scene assets.
Realtime media relay, used only to relay encrypted audio and video when a direct connection between your device and our servers is not possible.
Identity providers you choose to sign in with.
We retain session data, such as transcripts, timelines, and session files, for as long as reasonably needed to provide the service, troubleshoot problems, and evaluate quality, subject to applicable settings and agreements. Retention periods depend on the type of data, session activity, and service or organization settings. Contact us or the organization operating the agent for the period applicable to your session.
Operational logs are subject to separate retention schedules for troubleshooting and security.
Other personal information is kept only for as long as needed to provide WorldAgents, meet legal obligations, resolve disputes, maintain security, and support business operations. After an account or data deletion request is completed, residual copies in security logs and encrypted backups expire under their normal rotation schedules unless law requires longer retention.
We may retain de-identified, aggregated, or anonymized information that cannot reasonably be linked to a person where permitted by law.
We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit, redaction of authentication credentials in request logs, monitoring, audit trails, and encrypted backups. Our security program is covered by a SOC 2 Type 2 report. No online service can be guaranteed to be completely secure.
WorldAgents is operated from the United States, with primary processing on AWS infrastructure in the US East (N. Virginia) region, and uses service providers in the United States and other countries. Where required by law, we use recognized transfer mechanisms and safeguards for international processing, such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision. You may request information about the applicable transfer safeguard, or a copy of the relevant terms, by contacting us.
Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of personal information. Contact support@worldagents.com to make a request. You can delete your WorldAgents account and associated personal information in Profile settings, and you can find step-by-step deletion instructions at Account deletion. We may verify your identity and may direct requests about organization-controlled information to that organization.
Deleting your account does not automatically remove all information about you in other users' sessions or shared organization content; contact us or the organization to request review of that information.
If you live in California or another United States state with a comprehensive privacy law, you may have rights to know, access, correct, delete, and port personal information, and to opt out of sale, sharing for cross-context behavioral advertising, and certain profiling. As described above, we do not sell personal information or share it for cross-context behavioral advertising. You or an authorized agent can submit a request using the contact information in this policy, we will respond within the time required by applicable law, and if we decline a request you may appeal by replying to our response.
You can opt out of non-essential marketing emails by using the unsubscribe link in the message. We may still send service, security, legal, and account notices.
Where applicable, you may withdraw consent, object to certain processing, and complain to your local data protection authority. We will not discriminate against you for exercising a privacy right.
WorldAgents is for adults aged 18 and older, including people using guest sessions or published agents. It is not directed to people under 18. If you believe a person under 18 is using WorldAgents or has provided personal information, contact us so we can investigate and take appropriate action, including restricting access and handling the information as required by law.
We may update this Privacy Policy from time to time. If a change is material, we will provide notice as required by law, such as by posting the updated policy or notifying account administrators.
Shapes Corp, a Delaware corporation with its registered address at 3500 S. DuPont Hwy, PMB 300, Dover, DE 19901-6041, United States, operates WorldAgents and acts as the data controller described in this policy. Questions about this Privacy Policy and privacy requests can be sent to support@worldagents.com.