PRIVACY · UPDATED 26 JULY 2026

Privacy information

stemFlask is a registered-user engineering workspace. This notice explains the limited personal data used to provide it. It does not use advertising cookies, analytics, profiling, or automated decisions about people.

Controller and contact

Gheorghita Popovici EI (TBC) operates stemFlask and is the controller for this processing. Contact: lab.stem@free.com; Peccavillers, 88120 Le Syndicat, France. Use this address for privacy questions or to exercise a right.

Data, purposes, and legal bases

• Account data: display name, email address, password hash, account role, and account dates. We use these to create and secure your account and provide the requested workspace. Legal basis: performance of a contract or steps at your request before a contract (GDPR Article 6(1)(b)).
• Workspace content: engineering-model inputs, results, compact chart data, model reports, MRO tasks, and DFSS projects. Charts are rendered in memory when requested; PNG plot files are not stored. This is used only to provide the features you choose to use. Legal basis: Article 6(1)(b).
• Password-reset data: a short-lived hashed token and its expiry date. This enables account recovery. Legal basis: Article 6(1)(b) and our legitimate interest in protecting accounts (Article 6(1)(f)).
• Security data: the hosting service may process IP address, request time, requested URL, and browser details in technical logs to operate and defend the service. Legal basis: legitimate interest in service security (Article 6(1)(f)).

Do not enter special-category data or personal information about other people in workspace fields unless you have a separate lawful basis and authorisation to do so.

Recipients and transfers

Your workspace data is available to you and to the application operator when necessary to administer or secure the service. Hosting, backup, and email providers may process data only to provide those services, under appropriate contractual safeguards. stemFlask does not sell data or share it for advertising. The operator must assess and document any transfer outside the European Economic Area before using a provider that makes such a transfer.

Retention

Account and workspace data are retained while your account is active. You can erase your account in the Account area. Password-reset tokens expire after one hour and are removed when used or replaced. Database backups are retained for up to 30 days, so erased data may remain in an access-restricted backup until that cycle ends. Technical-log retention is determined by the hosting configuration and must be kept no longer than necessary for security.

Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction, objection, or portability. You can correct your display name, download a JSON copy of your application data, and delete your account directly in the Account area. For other requests, email lab.stem@free.com. We may need to verify your identity and normally respond within one month. You may also complain to the French supervisory authority, the CNIL.

Security and changes

Passwords are stored only as hashes. The service uses authenticated access, CSRF protections, restricted session cookies, and access-restricted backups. No security measure is absolute; suspected personal-data breaches are handled under the operator’s incident-response process. We will update this notice before making a material change to the described processing.