Privacy and cookie policy

This page describes the personal data we process, why we process it, how long we keep it, and the rights you have. It covers the mecaflux.com website and the Heliciel on Demand service, reached from an AI assistant at mcp.heliciel.com.

1. Who is responsible for this processing

JF IGLESIAS — MECAFLUX / HELICIEL, publisher of the Mecaflux and Heliciel software
69 chemin Seviaz, 74370 NAVES, France.
For any question about your data: contact@mecaflux.com.

2. The data we process

2.1 Your customer account

When you register we record your email address, surname, first name, postal address, postcode, town and country, together with the password you choose. This data is used to keep your account, issue your invoices and deliver your licences and accesses. It is necessary for the performance of the sales contract.

2.2 Your orders and payments

We keep the details of your orders and invoices, as accounting law requires. We never see or store your card details: payment takes place on the servers of our banking provider or of PayPal, where you are redirected, and no card number passes through our pages.

2.3 Your Heliciel on Demand access

For each access purchased we record the number of days paid for, the payment status, the order number, the purchase date, the start date and the end date, along with the access address given to you. That address contains your key: it acts as your identifier, which is why we ask you not to share it.

2.4 Your use of the service

The mcp.heliciel.com service records:

• your email address, which identifies the holder of the access;
• a fingerprint of your key, never the key itself;
• the creation and end dates of the access, the minutes granted and the minutes used;
• a call log: timestamp, name of the function called, duration, outcome, and the call parameters truncated to 300 characters. That truncation rules out bulky content;
• if you connect through OAuth authorisation, the fingerprints of the tokens issued, never the tokens themselves.

This log serves to run the service, diagnose faults, and count the computing minutes charged to your access.

3. What we do not keep

Your design projects are not archived. Each session works in a folder of its own, erased when the instance is recycled. Download links for produced files are valid for 60 minutes, and project upload links for 30 minutes; after that they stop working. If you want to keep a result, download it during your session.

4. How long we keep it

5. Who else has access

We neither sell nor rent your data. It is passed only to what is needed to serve you:

• the website host, Strato GmbH (Berlin, Germany), and the host of the Heliciel on Demand service, OVH SAS (Roubaix, France), which store the data described above. Both are located within the European Union;
• Brevo, which delivers your invoices and service messages;
• our banking provider and PayPal, for collecting payment.

6. Cookies and audience measurement

Necessary cookies. One cookie keeps your session while you are logged into your customer area, and another remembers your answer to the question below. They are indispensable to the working of the site, are not used for any tracking, and therefore do not require your consent.

Audience measurement. We use Google Analytics 4 to know which pages are read and by which routes. It runs only if you have accepted it: on your first visit a banner asks the question, and no measurement cookie is placed until you have answered. Declining is as easy as accepting, and takes nothing away from the site.

Your answer is kept for six months, after which the question is asked again. You may change it at any time: review my choice.

The site's former audience measurement, which relied on a Google property that is no longer active, has been removed entirely.

7. Security

Exchanges with the website and with the service use HTTPS. Your access key is not stored as such by the service: only a fingerprint is kept, which allows it to be checked without being reconstructed. The same applies to authorisation tokens.

Your password is not kept in clear text. We only store a fingerprint of it, computed by a hashing function meant for that purpose. We therefore cannot read it, and neither can anyone else from our files.

This is why we will never send you your password, by email or by phone: we do not have it. If you forget it, the forgotten password page sends you a link that lets you choose a new one. That link works only once and for one hour.

A message asking you for your password in our name would therefore be an attempted fraud: do not reply, and report it to contact@mecaflux.com.

8. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. Write to contact@mecaflux.com: we answer within one month. If our answer does not satisfy you, you may refer the matter to the French data protection authority, the CNIL (www.cnil.fr).

Deleting your account also ends any access in progress; your invoices are kept, as the law requires.

9. Changes

This page may be updated as the service evolves. The date below shows its last revision.

Last updated: [14/08/2026].

Terms and conditions  |  Home