Who is responsible?
Atelier is published by MAXKEN, a French limited liability company (SARL), which is the controller of the personal data described here.
- Registered office
- Bureau 3, 34 place du Général de Gaulle, 59800 Lille, France
- Company registration
- 821 612 611 RCS Lille Métropole
- Privacy contact
Data we use and why
You can use the local editor without an account. Creating an account requires a name, email address and sign-in credentials; without them, online saving and sharing are unavailable. Project content and participation in collaboration are your choice.
Account and sign-in
Name, email address, verification status, account identifiers and dates, password hash for email sign-in, session token, IP address and browser information. These let us authenticate you and protect access to your account.
Legal basis : Performance of the service contract; legitimate interest in preventing unauthorized access.
Online projects
Project names, models, sketches, parameters, imported content, revisions, ownership and saving dates. These let us store, restore and synchronize the projects you save online. Modeling calculations run in your browser; online saving sends the project document to our server.
Legal basis : Performance of the service contract.
Collaboration
Memberships, roles, invitation links and their validity, comments and authors, resolution status and recent presence on a project. Project members can see the shared content, names, comments and presence according to their permissions. Anyone holding a valid invitation link can use the access it grants.
Legal basis : Performance of the service contract.
Messages and assistance
Your email address and the content of messages you send us, to answer questions and handle requests. Brevo is planned for service emails, including account and security messages when those features are available.
Legal basis : Performance of the service contract for account messages; legitimate interest in answering requests, or a legal obligation for privacy-rights requests.
Operation and security
IP addresses, request dates, browser and device information, requested resources and technical errors. Account permissions and the operator audit trail (operator and affected account identifiers, action, reason and date) support administration and security. These data help deliver the service, diagnose incidents, limit abuse and keep a record of sensitive interventions.
Legal basis : Legitimate interest in maintaining a working, secure service.
What stays in your browser
Atelier uses browser storage (IndexedDB and localStorage) for local projects, recovery copies, previews, computed display caches and interface preferences. These data remain on your device unless you save or share a project online, export it, or deliberately connect another tool.
The atelier-locale cookie remembers your language for one year. Authentication cookies keep you signed in; sessions are valid for seven days and can be renewed while you use the service. Theme and editor preferences remain until you change or clear them. A service worker and browser caches keep application files available for offline use.
You can remove a local project in Atelier or clear this site’s data in your browser. Clearing site data can permanently remove projects that have no other copy. Signing out or deleting an online project does not erase every local copy; export anything you want to keep first.
Hosting and service providers
Authorized MAXKEN staff and technical providers access data only as needed for their tasks. The following list distinguishes the providers currently in use from the integrations planned for Atelier.
- OVHcloud
- Current hosting in France: the application, its database and server-side project files until object storage is enabled. The hosting infrastructure handles the data necessary to operate Atelier.
- Cloudflare
- Since October 22, 2026, Cloudflare has hosted the DNS for ateliercad.com, and all web traffic to Atelier passes through its proxy before reaching our server. To deliver and protect these requests, Cloudflare processes IP addresses, request metadata and the content it delivers; its network operates internationally. It caches only the 3D engine files, which are the same for every visitor, not pages or API responses. In the current configuration, it sets no cookie of its own, and its bot detection, visitor analytics and tag management features are turned off. Email sent to ateliercad.com addresses does not pass through Cloudflare and stays with OVHcloud.
- Scaleway Object Storage
- Planned S3-compatible storage for online project documents and revisions. S3 describes the storage interface; it does not mean these files are hosted by Amazon. Their location depends on the Scaleway region selected for the bucket.
- Brevo
- Planned for sending service emails: recipient address, message content and delivery status. Brevo documents database hosting within the European Union, including France, Germany and Belgium.
- Planned optional sign-in provider. If you choose it when available, Google supplies the identity information authorized on its sign-in screen, such as an account identifier, email, name and profile picture. Atelier does not receive your Google password. Google also processes the sign-in under its own privacy policy.
- OpenPanel
- Audience and usage measurement when enabled. The deployment documented for Atelier uses a self-hosted instance. Events pass through Atelier’s server; the details are explained below.
Audience and usage statistics
When enabled, OpenPanel records page views, referring pages, campaign parameters (including ad click identifiers present in the URL), outgoing links, marked interactions and product events: sign-up and sign-in, project creation, opening an example or tool, types and counts of added operations, import and export formats, sharing and invitation use, and 3D engine startup. The relay sends the visitor’s IP address and browser headers to the configured analytics instance to group visits, estimate location and identify bots. Cookie-free measurement still involves processing personal data.
When you sign in, the tracker uses your internal account identifier as a profile identifier to associate subsequent events with that account. It does not send your account name, email or model documents as event properties. Page-view URLs exclude project identifiers, invitation tokens and fragments. This account association is personal data, even though the identifier is opaque. The configured browser tracker does not record session replays.
The purpose is to understand visits and improve Atelier, based on our legitimate interest in operating and improving the service. You can object by contacting MAXKEN. Measurement is disabled when no analytics identifier is configured. The absence of cookies alone does not establish an exemption from consent; any measurement requiring consent must be subject to prior consent.
Where data are processed
The main application is hosted by OVHcloud in France. This does not mean every provider processes data only in France: Scaleway storage depends on the chosen region, Brevo documents hosting in the European Union, and Cloudflare and Google operate international services.
Processing by Cloudflare or Google may involve transfers outside the European Economic Area. Such transfers require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses and any necessary supplementary measures. The provider documents linked above describe their arrangements; contact MAXKEN for information about the safeguards applicable to your data or a copy of them.
How long data are kept
- Account data are kept for the use of your account, then deleted on a justified deletion request, except information needed to meet a legal obligation or establish, exercise or defend legal claims.
- Online projects, revisions, memberships and comments are kept to provide the saved project and its collaboration features, until deleted or until a deletion request is handled. Older revisions can be removed when the storage quota is reached. A stored document still referenced by another revision remains necessary for that revision.
- A session’s validity is seven days, renewed during use; this is an access expiry, not a promise that all corresponding database records are erased on that date. Invitation expiry likewise ends access without automatically deleting the record. Presence is displayed only for activity in the last thirty seconds.
- Technical logs, operator audit records and analytics are retained only as needed to investigate incidents, trace sensitive interventions, prevent abuse and compare service usage over time. Deleting an account does not automatically erase the separate operator audit trail. These purposes determine the retention period; any information preserved for a dispute or legal obligation is restricted to that purpose.
- Copies in backups follow the applicable backup rotation. A deletion from the active service does not immediately erase all backups or files already exported by you or another authorized project member. Contact us for details of the retention periods and backup cycle applicable to your request.
- Local projects and browser caches remain under your control until you delete them, clear site data or the browser removes them. We cannot remotely erase an exported file or a copy on another device.
Your rights and how to exercise them
Under the GDPR, you can request access to, correction or deletion of your personal data, restriction of processing and, where applicable, portability. You can object to processing based on legitimate interests for reasons relating to your situation, including audience measurement. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing.
Send your request to the contact address below, identifying the account or data concerned. We may ask for proportionate evidence of your identity if there is reasonable doubt. We normally respond within one month; the GDPR allows an extension of up to two additional months for complex or numerous requests, with notice within the first month.
You can export your projects and delete projects or comments according to your permissions. For account deletion or an export of personal data beyond project files, contact MAXKEN. If the response does not resolve your concern, you can lodge a complaint with the CNIL or your competent data protection authority.
Security and changes to this policy
Atelier uses authenticated sessions and project permissions to limit access to online content. Email sign-in passwords are stored as hashes, not in plain text. Share invitation links only with the intended recipients and revoke access when it is no longer needed.
We update this page when data uses or providers change, particularly when the integrations still planned become available. The date above identifies this version. A significant change affecting your data will be brought to your attention through an appropriate channel.