Last updated: 5 August 2026
This policy explains what data Spaleforce collects, why, how long it is kept and how to exercise your rights.
The controller responsible for your personal data is:
Every processing operation rests on a specific legal basis. No data is collected "just in case".
| Purpose | Legal basis | Retention period |
|---|---|---|
| Creating and managing your account (email, name, avatar, language) | Performance of the contract | Lifetime of the account, then 12 months after last sign-in |
| Generating and hosting your projects (prompts, code, 3D models) | Performance of the contract | Until you delete them, or 12 months after account closure |
| Subscriptions, payments and invoicing | Performance of the contract and legal obligation | 10 years (accounting obligation, art. L123-22 French commercial code) |
| Proof of consent to immediate performance of the service | Legal obligation and legitimate interest (evidence) | 5 years from the end of the contract |
| Customer support and ticket history | Performance of the contract | 3 years after the last exchange |
| Security: abuse detection, technical logs, IP addresses | Legitimate interest (protecting the service) | 12 months maximum |
| Site audience measurement (page views, traffic source) | Legitimate interest, strictly necessary audience measurement | 13 months maximum |
| Service-related emails | Performance of the contract | Until you unsubscribe |
We do not sell your data. It is accessible to a small number of providers, each bound by a processing agreement compliant with article 28 GDPR.
| Provider | Role | Data location |
|---|---|---|
| OVHcloud | Hosting of the site and databases | European Union (France) |
| Stripe Payments Europe | Payment and invoicing | European Union (Ireland) |
| Cloudflare R2 | Storage of project files | European Union |
| AI model providers | Generating code and 3D models from your instructions | European Union and United States (standard contractual clauses) |
| SMTP provider | Sending transactional emails | European Union |
We only collect what the service needs to work:
The instructions you write and the files you upload are sent to AI model providers in order to produce the requested result. They are sent for that purpose only.
Your content is not used to train our own models. Some providers are located outside the European Union: those transfers are governed by the European Commission's standard contractual clauses.
Never put sensitive data, passwords or API keys in your instructions.
Data is hosted on European infrastructure, traffic is encrypted in transit (TLS) and database access is restricted to authorised people.
In the event of a data breach likely to create a risk to your rights, the French data protection authority is notified within 72 hours and you are informed without undue delay.
Under articles 15 to 22 GDPR, you have the following rights:
Write to contact@spaleforce.com from your account email address. We answer within one month, extendable by two months for complex requests.
If our answer does not satisfy you, you may lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr — or with the supervisory authority of your country of residence.
The service is reserved for people aged 15 or over. Below that age, registration requires the authorisation of a parent or guardian.
Paid subscriptions are reserved for adults, or for minors with the agreement of their legal representative.
This policy may change. Any substantial change is announced by email or through a notice in your account before it takes effect.
For any question about your personal data:
contact@spaleforce.com