Incomplete page — do not publish as is. Everything that relates to the technical operation has been checked in the code and on the servers on August 27, 2026, and is written below in plain language. What is still missing can only come from the publisher: the identity of the data controller, the legal bases, how long an account is kept after closure, the address at which to exercise rights and the response time. These fields are marked [to be completed]. The whole must still be reviewed by a lawyer: this text faithfully describes the technical reality, it does not constitute legal advice.
Data controller
[to be completed: name, address, contact email address — the same as in the legal notice.]
What never leaves your machine
1D cutting optimisation, 2D nesting, the reading of your STEP files and every export (PDF, CSV, DXF) are computed by your browser. Your design office file is opened and displayed on your machine: it is not uploaded to be read.
Projects you do not sync are saved in the local storage of your browser, on your machine, and nowhere else. Deleting them is done from the application, or by clearing the site’s data in your browser.
What is sent to our servers, and what happens to it
- Sheet metal unfolding and profile recognition : the relevant geometry is sent to our compute server, processed, and the result comes back down. The received file is deleted from the server as soon as processing ends — including when the computation fails, since the deletion is placed in the
finallyblock of the function that wrote it. No copy is kept, archived or used for anything else. - User account : email address, password (kept as a hash, never in plain text), subscribed plan and remaining credits.
- Synced projects : only if you enable sync. Projects and the offcut inventory are then saved on our servers so they can be found from another machine. Without that activation, nothing is sent.
- Usage counters : to enforce the caps of your plan, each successful computation records three pieces of information — your account identifier, the type of operation, and the number 1. Neither your file name, nor its content, nor any dimension appears there.
Where the servers are
This site and the application are hosted by Infomaniak [to be completed: exact hosting country, to be read from Infomaniak’s documentation — it governs the notice to give on transfers outside the European Union].
Computation and accounts, on the other hand, are not with a host: they run on our own machines, in France [to be completed: département or city]. Few services state this, and it cuts both ways: your files pass through no third-party provider, but the availability of these two functions depends on our infrastructure. The cutting optimisation itself keeps working without them, since it runs in your browser.
Technical logs
Like any server exposed to the Internet, ours keep access logs containing your IP address, the date and the page requested. They are used for outage diagnosis and security, never for profiling. Retention periods measured on the machines:
- accounts service log: 5 days ;
- log of the server that publishes our services: 14 days ;
- site host logs: about 30 days.
Past those periods, the files are overwritten automatically. No anonymous per-IP quota is in operation: using the application without an account causes no address to be remembered on that basis.
Cookies and audience measurement
No cookie is placed in your browser if you do not create an account — checked on the service’s four addresses on August 27, 2026, audience measurement included. That is why you do not see a consent banner: there is nothing to consent to. When you log in, your session is kept in the local storage of your browser, not in a cookie: it is therefore never sent automatically to another site.
Traffic is measured with Umami, since August 27, 2026. It is a tool that we host ourselves, on our machines in France: traffic data goes to no provider. It places no cookie, assigns no persistent identifier and builds no profile — that is why there is no consent banner to click.
What is recorded on each page view: the page consulted, the site you came from where applicable, the browser language, the screen size, the device type, and the country, region and city inferred from your connection. Your IP address is used to infer that location and is then not kept in these statistics — the table that stores them has no address column, which has been checked; it only appears in the technical logs, with the retention periods indicated above. Two visits from the same browser one day apart are not linked to each other.
There is no advertising tracker, no social network button, no typeface loaded from a third-party server. This last point deserves clarification because it is rarely respected: the site’s and application’s fonts are served from our servers, and not from Google Fonts, which would otherwise receive your IP address on every visit. A single request leaves the site’s domain, towards stats.cut-fab.com : it is our own measurement server, described above, not a third party. Checked in the browser on August 27, 2026 — there is no other.
Sub-processors
- Infomaniak — hosting of the site and the application.
- None other. No third-party analytics service, no third-party emailing service, no content delivery network. Address confirmation emails go out through the domain’s mail service, at Infomaniak.
[to be completed the day an online payment is set up: the payment provider will need to be added here.]
How long your data is kept
- Files sent for computation : deleted at the end of processing, i.e. a few seconds.
- Technical logs : 5, 14 or 30 days depending on the server (see above).
- Account, synced projects and usage counters : kept as long as the account exists. [to be completed: erasure period after account closure, and the fate of usage counters, which may need to be kept longer for accounting purposes.]
Legal bases
[to be completed: to be tied processing by processing — performance of the contract for the account and projects, legitimate interest for technical logs and cap counters, etc.]
Your rights
You have a right of access, rectification, erasure, portability and objection concerning your data. To exercise them, write to [to be completed: address] ; response within [to be completed: time].
Worth noting, because it is true and rare: you do not need us to get your projects back. Every project exports as .json directly from the application, at any time, with no prior request.
You may also lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.