Privacy Policy
Last updated: 22 September 2026
1. Data Controller
Sterfive SAS
30 rue de la Saussaye, 45750 Saint Pryvé Saint Mesmin, France
Email: privacy@sterfive.com
2. What Data We Collect
| Data | Purpose | Legal Basis |
|---|---|---|
| Email address | Account creation, login, notifications | Contract performance |
| Display name | Shown in the app UI and gallery | Contract performance |
| OPC UA models (YAML) | Core service functionality | Contract performance |
| Authentication tokens | Session management | Contract performance |
| IP address, browser info | Security, rate limiting, abuse prevention | Legitimate interest |
3. How We Use Your Data
- Provide and maintain the OPC UA Modeler service
- Authenticate your identity and manage sessions
- Store and serve your OPC UA models
- Display public models in the gallery (only if you choose to make them public)
- Send transactional emails (password reset, account changes)
- Detect and prevent abuse
4. Data Storage & Security
- Data is stored on servers located in France (OVHcloud, Gravelines datacenter)
- All data is encrypted in transit (TLS 1.3)
- Passwords are hashed with bcrypt (cost factor 12)
- Database backups are encrypted and stored off-site
- Access to production systems is restricted to authorised personnel
5. Data Retention
- Account data: retained while your account is active, deleted within 30 days of account deletion
- Models: retained while your account is active; public models may be retained as forks by other users
- Server logs: retained for 90 days for security purposes
6. Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Google OAuth | Optional sign-in | Email, name (from Google) |
| GitHub OAuth | Optional sign-in | Email, name (from GitHub) |
| Stripe | Payment processing (Pro/Team plans) | Email, payment details (handled by Stripe) |
| Google Analytics | Audience measurement, only if you accept analytics cookies | Pages visited, referring site, approximate location, device and browser type. Never the content of your models. |
7. Cookies
Essential cookies are always set: without them you could not sign in. They need no consent.
| Cookie | Purpose | Duration |
|---|---|---|
authjs.session-token | Authentication session | 30 days |
authjs.csrf-token | CSRF protection | Session |
cookie-consent-v2 (local storage) | Remember your cookie choice | Until you change it |
Analytics cookiesare set only if you choose “Accept analytics” in the cookie banner. We use Google Analytics to learn which pages bring visitors to the OPC UA Modeler and where they leave. The same measurement is used on www.sterfive.com and opcua-modeler.doc.sterfive.com, so a visit across our sites counts as one.
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Google Analytics: distinguishes visitors | 2 years |
_ga_7JL3RVNSBC | Google Analytics: keeps the state of the session | 2 years |
We do not use advertising cookies or tracking pixels. You can withdraw or change your choice at any time; withdrawing deletes the analytics cookies.
8. Your Rights (GDPR)
Under the General Data Protection Regulation, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Delete your account and all associated data
- Export your data in a portable format (YAML files)
- Object to processing based on legitimate interest
- Lodge a complaint with the French data protection authority (CNIL)
To exercise any of these rights, contact us at privacy@sterfive.com. We will respond within 30 days.
9. Changes to This Policy
We may update this privacy policy from time to time. We will notify registered users by email of any material changes. The "last updated" date at the top of this page indicates the most recent revision.
10. Contact
For any questions about this privacy policy or your personal data:
- Email: privacy@sterfive.com
- Address: Sterfive SAS, 30 rue de la Saussaye, 45750 Saint Pryvé Saint Mesmin, France