Privacy Policy

Last updated: July 2026

This Privacy Policy describes how MONSIEUR NICOLAS GUTIERREZ ("Operator", "we", "us") collects, uses, stores, and protects your personal data when you use the Scaffolder.net platform, website, and code generation services (the "Service").

The Operator is the data controller as defined by the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).

1.1 Account Data

• Email address (used for authentication, communication, and account recovery);
• Password (stored as an irreversible cryptographic hash, never in plaintext);
• Display name or username.

1.2 Usage Data

• Solutions, Bounded Contexts, Entities, and Entity Properties you define (collectively, "Model Data");
• Generated Code file tree previews and download history;
• Subscription status, billing date, and payment method references (we do not store full credit card numbers);
• Log data including IP address, browser type, timestamps, and actions performed (for security, debugging, and analytics).

1.3 Technical Data

• IP address and approximate geographic location (derived from IP);
• Browser type, version, and operating system;
• Device identifiers and session information;
• Server logs containing request timestamps, response codes, and error messages.

1.4 Cookies

We use cookies and similar technologies as described in our Cookie Policy. See the Cookie Policy for details.

• Contract performance (Art. 6(1)(b)): Processing your account data, Model Data, and subscription information to provide the Service you requested.
• Legal obligation (Art. 6(1)(c)): Retaining billing records and logs as required by applicable French tax and commercial law.
• Legitimate interest (Art. 6(1)(f)): Collecting log data and IP addresses for security, fraud prevention, and Service improvement.
• Consent (Art. 6(1)(a)): Placing non-essential cookies and processing optional marketing communications. You may withdraw consent at any time.

• Service provision: Authenticating your account, storing your Model Data, generating code, and delivering downloads;
• Subscription management: Processing payments, managing Free Trials, and handling cancellations;
• Communication: Sending service notifications, security alerts, and responses to your support requests;
• Security and fraud prevention: Monitoring for unauthorized access, detecting abuse, and protecting the Service and other Users;
• Improvement: Analyzing usage patterns, identifying bugs, and improving Service features and performance;
• Legal compliance: Retaining records as required by French law and responding to lawful requests from competent authorities.

We do not use your personal data or Model Data to train any machine learning model, AI model, or third-party recommendation system. The Service is fully deterministic and does not use Artificial Intelligence.

We do not sell, rent, or trade your personal data or Model Data to any third party.

• Cloud hosting provider: OVH — for server infrastructure and data storage located in FRANCE. This provider may transfer data outside the EU/EEA under appropriate safeguards (Standard Contractual Clauses or adequacy decision).
• Payment processor: Stripe — for subscription billing and payment processing. The Operator does not store full credit card numbers.
• Email service: Resend — for transactional email delivery (account confirmation, password reset, service notifications).
• Analytics: Google Analytics — for aggregate, anonymized usage statistics.

All sub-processors are bound by written agreements that require them to protect your data in accordance with GDPR requirements.

We may also disclose your data if required by law, court order, or competent authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the Operator, Users, or others.

• Standard Contractual Clauses (SCCs) approved by the European Commission; or
• An adequacy decision from the European Commission recognizing the destination country's data protection level; or
• Other appropriate safeguards as required by GDPR Chapter V.

• Account data: Retained for as long as your account is active. Deleted within thirty (30) days of account termination or closure request, unless legal obligations require longer retention.
• Model Data: Retained for as long as your account is active. Deleted within thirty (30) days of account termination.
• Generated Code downloads: Not stored server-side. The ZIP file is generated on-demand and streamed to your browser. The Operator does not retain copies of your Generated Code.
• Billing records: Retained for the duration required by French tax law (currently ten (10) years) as required by Article L. 123-22 of the French Commercial Code.
• Log data: Retained for a maximum of twelve (12) months for security and debugging purposes.
• Cookies: Retained according to their respective lifespans as described in the Cookie Policy.

Once the retention period expires, data is permanently deleted or anonymized.

• Right of access (Art. 15): You may request a copy of your personal data held by the Operator.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): You may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction (Art. 18): You may request that we limit the processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may receive your personal data in a structured, machine-readable format and transmit it to another service.
• Right to object (Art. 21): You may object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77): You may lodge a complaint with the French Data Protection Authority (CNIL) if you believe your rights have been violated.

To exercise any of these rights, please contact us using the Contact page. We will respond to your request within one (1) month, as required by GDPR Article 12(3). If the request is complex or numerous, this period may be extended by two (2) additional months, in which case we will inform you of the extension within the first month.

CNIL contact information: Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy — TSA 80715 — 75334 PARIS CEDEX 07, France. Website: www.cnil.fr.

• Password hashing using industry-standard cryptographic algorithms;
• HTTPS/TLS encryption for all data in transit between your browser and our servers;
• Access control to limit data access to authorized personnel only;
• Regular security monitoring and logging;
• Regular data backups.

However, no system or method of transmission over the Internet is 100% secure. The Operator cannot guarantee absolute security of your data. You acknowledge that you provide your data at your own risk.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, the Operator will notify the relevant supervisory authority (CNIL) within seventy-two (72) hours of becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to your rights and freedoms, you will be notified directly as required by GDPR Article 34.

The Service is not directed to children under 18 years of age. The Operator does not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us using the Contact page, and the data will be promptly deleted.

The Operator may update this Privacy Policy at any time. Updated versions will be posted on this page with a revised "Last updated" date. If material changes are made that significantly affect your rights, the Operator will notify you by email or through the Service.

Continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy.

If you have any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact us using the Contact page.