Privacy & cookies
Last updated 23 August 2026. Short version: we keep the minimum needed to sell you a pack and let you download it again, we use no advertising or analytics trackers, and Stripe handles payment data.
Controller
Atypical Consulting (Philippe Matray), VAT BE 0744.517.956, Belgium — philippe@atypical.consulting.
What we store, and why
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Email address and a hashed password | Your account: log in, see and re-download purchases | Contract (art. 6(1)(b) GDPR) | Until you ask us to delete the account |
| Orders: pack bought, amount, currency, date, Stripe session and payment identifiers | Deliver the pack, keep proof of the licence you hold, accounting | Contract; legal obligation (accounting, 7 years in Belgium) | 7 years after the purchase |
| Transactional emails (purchase confirmation, password reset, address confirmation) sent to your address via our mail provider Infomaniak | Deliver what you bought and let you recover your account | Contract | Not stored beyond the mail server's logs |
| Server logs (IP address, URL, time, user agent) | Security and debugging | Legitimate interest | 30 days |
We do not store card numbers. Stripe collects them on its own pages and acts as an independent controller for payment processing; see Stripe's privacy policy. Stripe also receives your email address so it can send you a receipt.
Cookies
Only strictly necessary cookies, which need no consent banner:
meshkit.auth— keeps you logged in (expires when you log out, or after 14 days if you chose “stay logged in”)..AspNetCore.Antiforgery.*— protects forms against cross-site request forgery; session only.meshkit.status— carries a one-time status message between two pages; lives 5 seconds.
No analytics, no advertising, no third-party embeds on our pages. The 3D viewer runs entirely in your browser from files we serve.
Recipients and transfers
Stripe Payments Europe Ltd (payments), Infomaniak (outgoing email, Switzerland — adequacy decision), the hosting provider of our Belgian-administered server, and GitHub (where generated packs are stored as release assets before publication — no personal data). Data stays in the EU except where Stripe's own transfer mechanisms apply.
Your rights
Access, rectification, erasure, restriction, portability and objection — email us and we answer within one month. Account deletion removes your email and password immediately; order records are kept as required by accounting law, pseudonymised. You may complain to the Belgian Data Protection Authority (autoriteprotectiondonnees.be).
Security
Passwords are hashed (ASP.NET Core Identity, PBKDF2), traffic is encrypted (TLS), downloads are served only to the account that bought them, and the server is administered by the controller alone.