Privacy policy

This privacy policy describes how DIMAP SAS (hereinafter "DIMAP", "we", "our") collects, uses, stores and protects the personal data of users (hereinafter "you", the "User") of the Dimap mobile app and of the website www.dimap.app (hereinafter the "Platform").

DIMAP is committed to protecting its Users' privacy in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and French Act No. 78-17 of 6 January 1978 on data processing, data files and individual liberties.

The data controller is:

DIMAP SAS
Share capital: 1,000 euros
Montpellier Trade and Companies Register: 994 558 427
Registered office: 12 rue Doria, 34000 Montpellier, France
Email: contact@dimap.app
Publication director: Raphaël Anahory

When you use the Platform, we collect the following categories of data:

2.1. Identification data

• Last name, first name, username
• Email address
• Profile picture (optional)
• Account type (Explorer, 3D modeler, Printer)

2.2. Contact and delivery data

• Postal delivery address
• Billing address
• Phone number

2.3. Transaction data

• Order history
• Payment information (securely processed by our provider Stripe; we do not store your card numbers)
• Bank details of Printers and 3D modelers for paying out their earnings (processed by Stripe)

2.4. Content data

• Published 3D models (GLB/glTF files)
• Published images and photos
• Messages exchanged through the built-in messaging
• Descriptions and information attached to posts

2.5. Usage data

• Browsing data and interactions with the app
• Analytics data (via Firebase Analytics)
• Push notification token (via Firebase Cloud Messaging)
• App preferences (theme, language)

2.6. Authentication data

• Sign-in credentials (email and encrypted password, or Google/Apple identifier)

Your personal data may be shared with the following recipients, strictly within what is necessary to deliver the services:

• Firebase (Google LLC): data hosting, authentication, file storage, push notifications, analytics
• Stripe: payment processing and management of sellers' payment accounts
• Sendcloud: delivery cost calculation, shipment management and parcel tracking
• PostHog (PostHog Inc., EU hosting): audience measurement and journey analysis, only with your consent (see section 10)
• Google Analytics (Google Ireland Ltd): audience measurement for the site and the app (traffic, traffic sources, order steps), only with your consent (see section 10)
• Other Platform Users: your public profile information (username, picture, posts) is visible to other Users
• 3D Printers: your delivery address and order information are passed to the Printer handling your order

We never sell your personal data to third parties.

Some data may be transferred to countries outside the European Union, in particular to the United States, as part of using the Firebase (Google) and Stripe services. These transfers are covered by appropriate safeguards in accordance with the GDPR, in particular the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

• Account data: kept for as long as you are registered, then deleted within a maximum of one (1) month after your account is deleted
• Order data: kept for 5 years from the end of the order, in accordance with accounting and tax obligations
• Messages: kept for as long as you are registered
• Analytics data: kept for a maximum of 14 months
• Published content: kept for as long as you are registered, then deleted along with your account

Under the GDPR, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it
• Right to rectification: have inaccurate or incomplete data corrected
• Right to erasure: request the deletion of your data in the cases provided for by law
• Right to restriction of processing: obtain the restriction of processing in certain cases
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to the processing of your data on legitimate grounds
• Right to withdraw your consent: at any time, where processing is based on your consent

To exercise your rights, you can:

• Email us at contact@dimap.app
• Manage your data from your account settings in the app
• Request the deletion of your account through our dedicated page

We undertake to respond to your request within a maximum of one (1) month.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure, in particular:

• Encryption of data in transit (HTTPS/TLS)
• Secure authentication through Firebase Authentication
• Firestore security rules restricting access to authorised data
• PCI-DSS compliant payment processing through Stripe
• Encrypted passwords (never stored in clear text)

The Platform is not intended for people under 16. If we learn that personal data of a minor under 16 has been collected without parental consent, we will take the necessary steps to delete that data.

The website www.dimap.app uses technical cookies necessary for the site to work properly (authentication, preferences), which are exempt from consent. This includes the dimap_lang cookie, which remembers the display language you chose (French or English) and is used for no other purpose.

With your consent, we also use two audience measurement tools: PostHog (PostHog Inc., data hosted in the European Union) and Google Analytics (Google Ireland Ltd), in order to understand how the Platform is used and improve our services: pages visited, order journey, traffic source (source, campaign). IP addresses are anonymised. No data is used for advertising purposes or sold to third parties: Google's advertising storage stays permanently disabled. No audience measurement cookie is set before you agree, and you can withdraw your consent at any time:

Manage my cookie preferences

The Dimap mobile app uses the same audience measurement (PostHog and Google Analytics for Firebase), subject to your consent on first launch and changeable at any time in the app settings.

We reserve the right to change this privacy policy at any time. In the event of a substantial change, we will inform you by an in-app notification or by email. The date of the last update is shown at the top of this page.

For any question about this privacy policy or the processing of your personal data, you can contact us:

• By email: contact@dimap.app
• By post: DIMAP SAS, 12 rue Doria, 34000 Montpellier, France