1. Data controller
Guillaume Sion, sole proprietor (entrepreneur individuel, EI), publisher of Solidus — SIRET 918 361 551 00032 — 12 rue Paul Bert, 46100 Figeac, France.
Contact for any question about your data: [email protected]. We reply within one month (article 12.3 GDPR), which may be extended by two months for a complex request; you are then informed.
2. What stays on your device
The documents you create (parts, assemblies, drawings, CAM programs, quotes) are saved in your browser or in your files, on your computer. They are not sent to us, unless you choose to publish a project in the community library or attach a file to a bug report.
The Free plan can be used without an account: we then receive only the technical requests necessary for the service to work (see "Technical logs" below).
3. Data processed
| Processing | Data | Purpose | Legal basis (art. 6 GDPR) |
|---|---|---|---|
| Account | E-mail address, password (stored hashed), display name, account type (individual or business), company name and VAT number for a business | Create and secure your account, unlock the Pro and Team plans | Performance of the contract (b) |
| Licenses and seats | Random device identifier, device name, opening and expiry dates of the seat token, organization and role for a business | Control the number of active seats, allow offline use (up to 7 days) | Performance of the contract (b) |
| Subscription and billing | Plan, number of seats, dates, amounts, invoices, Stripe customer identifier. Card data is entered at Stripe and never reaches us | Collect subscriptions, issue invoices | Performance of the contract (b); legal obligation for invoices (c) |
| Parts library | Searches, components and configurations downloaded, linked to your account | Serve components, reserve ratings for people who have used a component | Performance of the contract (b) |
| Public contributions | Published projects, machines and fixtures, ratings and comments, with your display name | Make them visible to other users, moderate | Performance of the contract (b); legitimate interest for moderation (f) |
| Bug reports and suggestions | Title, description, version, system, browser, language, technical diagnostics and attachments you choose to add | Fix problems and reply to you | Legitimate interest (f) |
| Service e-mails | E-mail address | Registration confirmation, password reset, invoices, notice before deletion of an inactive account, information about the service | Performance of the contract (b) |
| Technical logs | IP address, date, request, response code; reports of internal server errors (without headers, content or request parameters) | Security, abuse prevention, fault diagnosis | Legitimate interest (f) |
| Telemetry | See the next section | Improve stability and usability | Consent (a) |
We do not sell or rent your data and make no automated decision producing legal effects concerning you.
4. Optional telemetry
On first launch, the application asks whether you agree to send anonymous usage statistics. Nothing is sent without your agreement, and you can change your mind at any time in Settings › Telemetry.
If you agree, the application sends batches roughly every five minutes:
- stability: errors (normalized message), calculation failures by feature type;
- performance: loading and recalculation times, library latency;
- usage: commands used, features validated or cancelled, document types;
- friction: commands cancelled or immediately restarted, searches without results;
- context: version, web or desktop, system, language, screen size, number of cores, memory, graphics card.
Never sent: the content of your documents, names of parts, features or files, parameter values, text entered (other than searches without results), your account. Batches are attached to a random installation identifier, unrelated to your account; the IP address is used only to limit abusive sending and is not stored with the batches. You can request erasure of your installation's batches from the application.
Error reports: with the same agreement, when a technical error occurs, the application also sends a detailed report to Sentry, our error tracking service: normalized error message, call stack (the place in the code where the error occurred), version, browser and system, and the last actions that preceded it (commands and feature types, without names or values). The same exclusions apply, and the IP address is not stored. If you refuse telemetry, no error report is sent.
5. AI assistant
The AI tab is optional and works with your own key at the provider of your choice (Anthropic, OpenAI, Mistral, a local server…). Your key stays in your browser and exchanges go directly from your device to this provider: they do not pass through our servers and we have no access to them.
What you send to the assistant (messages, model description, 3D view capture where applicable) is processed by the chosen provider, under its own terms and privacy policy, possibly outside the European Union. Do not send confidential data if these terms do not suit you; a model run locally (Ollama, for example) avoids any sending.
6. Recipients and subprocessors
Your data is accessible to the publisher and, as far as they are concerned, to the following subprocessors, bound by a contract compliant with article 28 GDPR:
| Provider | Role | Location |
|---|---|---|
| OVH SAS (OVHcloud) | Hosting of servers, database and files; backups | France (Gravelines, Paris); backups in Canada |
| Sinch Mailjet SAS | Sending service e-mails | European Union |
| Stripe Payments Europe Ltd | Subscription payments | Ireland; possible transfers to the United States |
| Functional Software, Inc. (Sentry) | Tracking of technical errors of the application (if you accepted telemetry) and of the servers | European Union (Germany); possible access from the United States |
Other recipients are: other users, for the content you publish (display name, projects, ratings and comments); the administrator of your organization, for a business account (members and seats used); the authorities, upon legal request.
7. Storage location and transfers
Data is hosted in France. Backups, encrypted before sending, are kept at OVHcloud in Beauharnois (Canada), a country covered by a European Commission adequacy decision. Stripe may transfer payment data to the United States: these transfers are governed by the EU–US Data Privacy Framework and the Commission's standard contractual clauses (article 46.2.c GDPR). Error reports are hosted by Sentry in the European Union; as Sentry is an American company, any access from the United States (support, maintenance) is subject to the same safeguards.
8. Retention periods
| Data | Period |
|---|---|
| Account and contributions | As long as the account exists. You can delete it at any time from the application (Account › Delete my account). An account unused for 3 years is deleted, after a notice e-mail sent 30 days beforehand |
| Seat tokens | Until they expire, then deleted with the account |
| Subscription | Duration of the subscription, then 5 years (civil and commercial limitation period) |
| Invoices | 10 years (article L123-22 of the French Commercial Code) |
| Bug reports | 3 years after the last exchange, or deletion with the account |
| Telemetry | 13 months, then automatic purge |
| Technical logs | 90 days at most |
| Error reports (Sentry) | 90 days at most, then automatic deletion |
| Backups | 12-month rotation: erased data disappears from backups no later than 12 months afterwards. They are used only to restore the service in the event of an incident |
When your account is deleted: your ratings, comments, bug reports (and their attachments), seat tokens and account data are erased; the projects, machines and fixtures you have published remain in the catalog, attached to an anonymous publisher "Deleted contributor"; orders and invoices are kept without any link to the account, for the legal period.
9. Security
- Encrypted exchanges (HTTPS/TLS); passwords stored hashed and salted;
- database not exposed to the Internet; access isolated per account (row-level access rules);
- private files served through short-lived signed links;
- request limits per IP address; administration access by SSH key only;
- encrypted production secrets; encrypted backups.
In the event of a data breach presenting a risk to your rights, we notify the CNIL within 72 hours and inform you if the risk is high (articles 33 and 34 GDPR).
10. Cookies and local storage
Neither the website nor the application sets an audience measurement cookie. The application uses the local storage of your browser (or of the desktop application) to work: preferences (theme, language, shortcuts), automatic saving of your documents, login token, license, device identifier, settings and AI assistant key. The website also stores your language choice there. These items are strictly necessary for the service or are items you chose to save, and do not require consent (article 82 of the French Data Protection Act). You can erase them from your browser settings.
11. Your rights
You have the rights of access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), portability (art. 20) and objection (art. 21); you may withdraw your consent to telemetry at any time, without affecting data already sent. You may also set directives on what happens to your data after your death.
Erasure is done directly in the application (Account › Delete my account). For other rights, write to [email protected] from your account address. If we have reasonable doubt about your identity, we may ask you for additional information.
If you believe, after contacting us, that your rights are not being respected, you may file a complaint with the CNIL: cnil.fr/fr/plaintes.
12. Changes
We may change this policy to follow changes in the service or regulations. In the event of a significant change, account holders are notified by e-mail before it takes effect. Previous versions are available on request.