Mesh++ by Polyprod
Privacy Policy
What polyprod-software.com collects, why, how long it is kept and how to exercise your rights. Mesh++ itself runs on your computer: your 3D models are never uploaded.
Who is responsible
The data controller is polyprod-software, publisher of polyprod-software.com (see the Legal notice). For any question about your data, write to contact@polyprod-software.com.
In short
- We collect what is needed to run your account, sell and activate licences, answer your messages and keep the site secure.
- Card details are entered on Stripe’s pages and never reach our server.
- Our own visitor statistics use no cookie and store no IP address. Google Analytics cookies are set only if you accept them.
- We do not sell your data and do not use it for advertising.
What we collect and why
Your account
When you create an account: username, first and last name, email address and password. The password is stored only as a bcrypt hash; we cannot read it. We also record whether your email address is confirmed, the date the account was created and the date of your last sign-in. These data are needed to provide your account (performance of the contract).
Sign in with Google
If you choose “Sign in with Google”, Google sends us your Google account identifier, your email address (only once Google has verified it), and your first and last name. We request only the basic openid, email and profile scopes. We use this information only to sign you in, and to create your account or link it to an existing account with the same email address. We do not receive your Google password, we do not access any other data in your Google account, and we never share, sell or use Google user data for advertising.
Purchases
When you buy a Mesh++ licence, you pay on a Stripe Checkout page. We keep: the licence purchased, the amount and currency, the Stripe session and payment references, the payment status, your licence key and the dates of the order and payment, linked to your account and email address. Stripe receives your email address and the payment details you enter on its page; it processes them as described in the Stripe Privacy Policy.
For a Polyprod Pro subscription, the name on the card, phone number and billing address you enter are sent directly to Stripe to create your Stripe customer record; our server keeps only the Stripe customer and subscription references, the licence key, its dates and the renewal setting.
These data are needed to deliver and manage your licence (performance of the contract) and to keep accounting records (legal obligation).
Licence activation
When Mesh++ checks your licence, it sends us your licence key, an identifier of your computer, your computer’s name and the Mesh++ version. We store the computer identifier only as a one-way hash (SHA-256). We keep the computer’s name so you can see which computer is using your licence, the dates of the first and last check, the number of checks and the date of the last change of computer. This lets us apply the rule of one computer at a time and allow up to 6 days of offline use after a successful check.
Polyprod 0.2 checks its licence with your email address, a hash of your password and the network (MAC) address of your computer. The MAC address is saved with the licence, as on the previous version of this site, to keep the licence on one computer; launches are counted per computer using a one-way hash of that address.
Downloads and account events
We record each download of Mesh++ (date, version, type of access) and key events linked to your account: sign-up, sign-in, payment started, purchase, download and licence activation. Actions taken by our team on your account (for example a licence granted or a computer released) are also logged. This helps us follow orders, provide support and prevent abuse (legitimate interest).
Emails and the contact form
We send you emails needed for your account: address confirmation (link valid 48 hours), password reset (valid 1 hour, single use), confirmation of a new address, and messages about a licence added to your account. The secret part of these links is stored only as a hash.
When you use the contact form, your email address and message are sent by email to contact@polyprod-software.com; they are not stored in the site’s database. We keep them as long as needed to answer you and follow up on your request.
Security
To limit abuse (password guessing, mass sign-ups, spam), we count recent attempts per IP address or email address. These are stored only as one-way hashes and deleted after about a day. A hidden field and a timer on the sign-up form stop robots. Like any web host, OVH also records technical access logs (IP address, page requested, date, browser) under its own retention rules.
Visitor statistics
We measure the audience of the site ourselves, without cookies and without storing your IP address. For each page viewed we record the date and time, the page, where the visit came from (referring site or campaign name in the link), and whether the device is a mobile. A visitor is counted with a code computed from the date, IP address and browser; the IP address itself is not stored, and the code changes every day, so it cannot be used to follow you from one day to the next. On the pricing section we also note when prices are viewed and when “Buy” is clicked. Robots are not counted. These statistics are deleted after 13 months (legitimate interest: understanding how the site is used).
Google Analytics
Only if you click “Accept” in the cookie banner, our public pages (not the account, checkout and administration pages) load Google Analytics, a service of Google Ireland Limited, which sets the _ga and _ga_W9MBPK0RTG cookies to measure visits. Without your consent, Google Analytics is not loaded and these cookies are deleted. Google may process these data outside the European Union, including in the United States. See Google’s Privacy Policy.
Your choice is kept for 6 months, then asked again. You can change it at any time with “Cookie settings” at the bottom of every page.
Content loaded from other services
Pages load the Inter typeface from Google Fonts, so your browser sends your IP address to Google when it downloads it. Polyprod guide and blog pages embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com): YouTube stores nothing on your device until you play a video. The 3D viewer of the home page loads the three.js library from cdnjs (Cloudflare). The Polyprod Pro payment page loads Stripe.js, which may set Stripe cookies to prevent fraud.
Cookies
| Cookie | Purpose | Duration |
|---|---|---|
__Host-polyprod | Session: keeps you signed in and protects forms against forgery. Strictly necessary. | Until you close your browser; signed out after 2 hours of inactivity |
__Host-polyprod_remember | Keeps you signed in, only if you tick “Remember me”. Removed when you log out. | 30 days, renewed at each use |
__Host-polyprod_owner | Set only on browsers where a site administrator has signed in, to leave them out of statistics. Never set for visitors and customers. | 400 days |
polyprod_consent | Remembers whether you accepted or rejected Google Analytics cookies. | 6 months |
_ga, _ga_W9MBPK0RTG | Google Analytics, only if you click “Accept”. See above. | 13 months |
| Stripe cookies | Set by Stripe on payment pages to secure payments and prevent fraud. | Set by Stripe |
Our own cookies are limited to what the site needs to work and carry no advertising or tracking. Only the Google Analytics cookies need your consent.
Who receives your data
- OVH (France): hosting of the website and database, sending of emails.
- Stripe: payments, as an independent controller for payment data.
- Google: sign-in, only if you choose it; Google Analytics, only with your consent; Google Fonts.
We share data with authorities only when the law requires it. We never sell your data.
Transfers outside the European Union
Stripe and Google may process data in the United States. These transfers rely on the EU–US Data Privacy Framework, to which both companies have certified, and on the European Commission’s standard contractual clauses.
How long we keep your data
- Account: as long as your account exists. Accounts whose email address was never confirmed may be deleted after 30 days.
- Purchases and licences: as long as the licence exists; accounting records are kept 10 years, as required by French law, even if you delete your account.
- Visitor statistics and account events: 13 months.
- Security counters: about one day.
Your rights
You can access, correct or delete your data, ask for a copy in a portable format, object to processing based on our legitimate interest, ask us to restrict it, and withdraw any consent at any time. Name, email address and password can be changed directly in your account settings. For anything else, including deleting your account, write to contact@polyprod-software.com; we answer within one month.
If you think your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country.
How we protect your data
The whole site uses HTTPS. Passwords are hashed with bcrypt, email links and “Remember me” tokens are stored as hashes, sessions are closed when you change your password, and every form is protected against forgery. Access to the administration is limited to our team and requires the password again after 30 minutes of inactivity.
Changes
We update this policy when the site changes. The date below shows the latest version.
Last updated: 24 October 2026.