Privacy Policy

This is a courtesy translation. The French version prevails.

Last updated: October 30, 2026

Data controller

The data controller is Marwane TASSA, sole proprietor (entrepreneur individuel), trade name “lafabops”, 60 rue François Ier, 75008 Paris. Contact: tassa.marwane@lafabops.fr, +33 4 42 38 47 72.

Data processed

• Account data: login credentials and contact details that you provide.
• 3D model files that you upload.
• History of your jobs and your credit purchases.
• Your correspondence with us (name, email address, content of your requests).
• Connection data for your account: date, identity provider used, IP address and browser identifier.
• Access logs of our servers.
• Visit statistics for our pages, without cookies (see “Audience measurement”).

lafabops does not store bank card numbers. The showcase site places no cookie and writes no information on your device, unless you click “Do not track me”: your browser then remembers that choice. It has no consent banner. Your account and the Orbit services use two cookies: a login cookie (“orbit_session”, 8 hours) and a cookie that remembers your language (“orbit_lang”, one year). They are needed for the service to work and are not used for audience measurement.

Purposes and legal bases

• Creating and managing your account, and providing the service (processing your files, report, deliverables): performance of the contract.
• Managing credit purchases and invoicing: performance of the contract and legal obligation.
• Ensuring the security of the service and answering your requests: legitimate interest of lafabops in operating and protecting its service.
• Tracing the origin of a connection after a security incident (connection data): legitimate interest of lafabops in protecting its service and its customers.
• Knowing how often our pages are visited and improving the site (audience measurement): legitimate interest of lafabops in knowing how its site is used.

Audience measurement

To know how often our pages are visited (showcase site, accounts and Orbit services), we use the Umami measurement tool. We host it ourselves, on our servers located in France. It is limited to measuring the audience of our pages, for our own account only. It uses no cookie and writes nothing on your device, except the opt-out choice described below.

For each page viewed, the tool records:

• the page address, without its parameters, and its title; identifiers in the address (a job number, for example) are replaced by “:id” before sending;
• the site you came from; for another site, its domain name only;
• your browser, your system, your device type, your screen size and your language;
• your country, region and city, inferred from your IP address;
• a visit identifier, which groups the pages of one visit.

Your IP address is used for two operations, both done in memory: inferring your country, region and city with a location database installed on our servers (no outside service is queried), and computing the visit identifier. The tool writes it to no database. The visit identifier is computed from the site address, your IP address, your browser and a secret value changed every month. It is kept, but it does not let anyone recognize you from one month to the next.

This data is used only for visit statistics of our pages. We do not pass it to any third party. The tool does not follow you from one site to another. It is deleted after 25 months.

You can object to this measurement at any time. Click Do not track me. Your browser remembers this choice and the tool sends nothing more; clearing your browser data cancels it. If your browser asks not to be tracked (“Do Not Track”), nothing is sent either. You can also write to us.

Recipients

Your data is processed by lafabops, which is also its own host. The servers that host the Orbit services, your files and your data are located in France. PayPal, the only payment provider, receives the data needed for payment, in accordance with its own privacy policy. If you sign in with Google, Microsoft or LinkedIn, you identify yourself with that provider, which then processes your data under its own privacy policy. Your files are never reused or shared with third parties. Visit statistics stay on our servers and are not passed to any third party.

Transfers outside the European Union

lafabops hosts the Orbit services and audience measurement on its servers in France and does not transfer your data outside the European Union. Two processing operations remain with third parties: payment (PayPal, a data controller) and sign-in with Google, Microsoft or LinkedIn, which you start yourself with that provider. They may transfer data outside the European Union under their own privacy policies, which we invite you to read.

Retention period

• Files uploaded before payment: their retention is not guaranteed, and lafabops may delete them at any time.
• Purchased deliverables: available for 30 days from the date of payment, then deleted.
• You can permanently delete your files and deliverables at any time from your account area.
• Account data: for as long as your account exists.
• Connection data: 12 months, then the IP address and the browser identifier are erased; the record of the connection (account, provider, date) remains.
• Visit statistics: 25 months.
• Server access logs (which may contain your IP address): 60 days, for the security of the service.
• Backups (encrypted copies of the accounts database, the measurement database and the configuration, which contain customer data): 60 days, with the oldest ones erased automatically. A deleted account disappears from backups after 60 days at the latest.
• Invoicing data: for the periods required by legal obligations.

Required data and automated decision-making

Account information and the files to be processed are necessary for the service to be performed. Without them, we can neither open an account nor provide the report or the deliverable.

The displayed price is calculated automatically from the number of elements in your file. This is not a decision producing legal effects within the meaning of Article 22 of the GDPR, and no profiling is carried out. No data protection officer has been appointed, as such an appointment is not mandatory.

Your rights

You have the rights of access, rectification, erasure, objection, portability and restriction of processing of your data.

To exercise them, write to tassa.marwane@lafabops.fr. You will receive a response within one month. You may object at any time to processing based on the legitimate interest of lafabops, including audience measurement. You may also lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (www.cnil.fr).

To object to audience measurement, click “Do not track me” (“Audience measurement” section above), turn on the “Do Not Track” option of your browser, or write to us. Because we do not keep your IP address, we cannot find your visits in the statistics, so the rights of access, rectification and erasure do not apply to them in practice.

Security

lafabops implements appropriate technical and organizational measures to protect your data and your files against unauthorized access, loss and alteration. Access to your account is protected by your login credentials, which you must keep confidential.