Cookie Policy

Last updated: 15 October 2026

1. What is a cookie?

A cookie is a small text file placed on your device by a website you visit. Cookies are widely used to make websites work, or work more efficiently, as well as to provide information to the site owner. “Similar technologies” include local storage, session storage, IndexedDB, pixels, and browser fingerprinting, and are treated the same way under this policy.

2. Our current practice

As of the date above, this website sets no tracking, analytics, or advertising cookies, and uses no similar tracking technologies. Specifically we do not:

• set any analytics cookies (no Google Analytics, no Matomo, no Plausible);
• set any advertising or remarketing cookies;
• embed third-party scripts that set cookies (no social embeds, no chat widgets, no tag managers);
• use browser fingerprinting.

The only data processed when you browse the site is the minimum required by our hosting infrastructure (AWS) to serve the page and protect it from abuse — see our Privacy Policy for details.

3. Strictly-necessary cookies and storage

This site can store three strictly-necessary items on your device, and stores none of them on an ordinary visit: each is written only after an action of yours, described below. All are exempt from prior consent under Art. 5(3) of the EU ePrivacy Directive (2002/58/EC) and Art. 82 of the French Loi Informatique et Libertés: the CNIL’s list of exempt trackers (deliberation 2020-091 of 17 September 2020, point 49) covers trackers used to authenticate you to a service and trackers that personalise the user interface where that personalisation is an intrinsic and expected part of the service — here, the theme you choose with the toggle and the language you pick with the EN/FR switch, each stored only when you click it. None is used for analytics, profiling, or any cross-site purpose, and none is shared with third parties.

• pvs_theme — local storage. Remembers the light/dark theme you picked with the header toggle, so the page does not show the wrong theme on your next visit. Written only when you click the toggle; read when a page loads. It holds one word (light or dark) and lasts until you clear your browser storage.
• pvs_lang — cookie (HttpOnly, Secure, SameSite=Lax). Remembers the language you picked with the header’s EN/FR switch, so that a page whose address names no language — such as pvspline.fr/ — opens in that language rather than the one your browser asks for. Set only when you click the switch. It holds one word (en or fr) and lasts a year, or until you clear your cookies. Without it, each page’s language follows your browser’s language setting (or, failing that, the country your connection comes from, where our hosting provider supplies it), and nothing is stored.
• pvs_access — cookie (HttpOnly, Secure, SameSite=Strict). Set only while access to this site is restricted to invited users, and only after you sign in, so you are not asked for the password on every page. A short-lived (about 12 hours) signed authentication token holding no personal data. Signing out — or its expiry — removes it. When the site is public, it is never set.

4. The pvSpline web application

The pvSpline web application, reachable from this site, sets no cookies at all and runs no analytics or advertising script. The only third-party code it ships is Amazon’s GameLift Streams web player, served from pvSpline’s own domain; when you start a 3-D stream, the player loads its streaming runtime from AWS (diiaww9uo62rs.cloudfront.net). The application uses your browser’s local storage, session storage and IndexedDB to hold your work, because that is the only way a browser application can keep a project open across a page reload. All of it is strictly necessary to deliver the service you explicitly requested, and none of it is used for measurement, profiling or advertising:

• Session storage (erased as soon as you close the tab) — the project you have open, the simulation, batch and optimisation runs in progress, and the progress of weather or consumption data downloads, so a reload does not lose your work.
• Local storage (kept until you clear your browser storage, unless stated otherwise) — your cloud sign-in session (session token, its expiry and your account’s display details), written only if you log in to a pvSpline cloud account and erased when you log out; the EULA version you accepted and any acceptance not yet sent to your account; your own application preferences such as units, language and chart selection; your company details, so permit dossiers do not ask for them again; your tutorial progress and badges; and the 3-D viewer’s display preferences.
• Crash-recovery copies (local storage) — while a project has unsaved changes, a copy of it is kept so your work survives a closed tab or a crash and can be offered back on your next visit. Each copy is the whole project, including its client details and any embedded consumption data. At most 8 copies are kept. A copy is deleted when the project is saved, and all copies are deleted when you sign out; they are kept if your session merely expires. Unclaimed copies are abandoned after 30 days.
• IndexedDB — the 3-D video clips you record (at most 12 clips or 200 MB, oldest removed first) and the horizon panoramas and sun views you capture for a site (at most 24).

Map imagery. When you open the Map view, your browser requests map tiles directly from IGN — Géoplateforme (data.geopf.fr), the default basemap, and — if you select the global basemap — from OpenStreetMap (tile.openstreetmap.org). The same IGN imagery is fetched when you run the 3D view’s alignment step. If you switch on the Map view’s heritage-protection layer, your browser also requests, from the same IGN service and for the area on screen, images of the protected perimeters published on the Géoportail de l’Urbanisme, the French national planning portal: historic monuments and their protected surroundings (monuments historiques and their abords), classified and registered sites (sites classés and sites inscrits) and remarkable heritage sites (sites patrimoniaux remarquables). Neither provider sets a cookie through us and neither stores anything on your device, so no consent requirement arises under Art. 5(3) ePrivacy. They do see your IP address and browser User-Agent as the technical means of delivering the tiles, which is a processing of personal data — disclosed here and in our Privacy Policy. No tile is requested merely by opening the application.

Permit-dossier site lookups. When you prepare a permit dossier (déclaration préalable), your browser sends the project’s location — points within the array you have drawn on the map or, while nothing is drawn yet, the latitude and longitude of the site set on the Project tab — directly to two French public services, so that the dossier can identify the parcels and warn you about heritage protection:

• IGN — API Carto (apicarto.ign.fr): the heritage-protection servitudes covering the project, checked automatically when the permit dossier opens; and the cadastral parcels under it, looked up only when you press “Locate the parcel”.
• Référentiel National des Bâtiments (rnb-api.beta.gouv.fr): the national building identifier (ID-RNB) of the buildings under the drawn array — one point per drawn surface, searched within 2 metres of it — only when you press “Locate the parcel”.

These requests are sent without cookies and store nothing on your device, so again no Art. 5(3) consent requirement arises. Each service receives those points together with your IP address and browser User-Agent; no name, postal address, meter number or other project data is sent. API Carto is a service of the IGN (Institut national de l’information géographique et forestière); the Référentiel National des Bâtiments is a public service built at the IGN’s incubator. See our Privacy Policy.

Apart from these map and site-lookup requests, the web application sends requests only to pvSpline’s own services and the Amazon Web Services infrastructure they run on (AWS is our processor), and — if you connect one — to a pvSpline engine running on your own computer. Links you choose to follow take you to other sites under their own policies.

Payment pages. Subscriptions are paid on pages hosted by Stripe on its own domains (checkout.stripe.com, billing.stripe.com): the web application redirects your browser there and back. No pvSpline page loads a Stripe script or sets a cookie for Stripe; the cookies Stripe sets on its own pages are governed by Stripe’s cookie policy.

Enedis-mandate form. The form at auth.pvspline.fr sets no cookie, stores nothing on your device and makes no third-party request: its stylesheet is served from the form itself.

5. If this changes

If in future we introduce cookies or similar technologies beyond the strictly-necessary ones described above, we will:

• update this policy and the “last updated” date above;
• display a consent banner before any non-essential cookie is set, as required by the EU ePrivacy Directive (2002/58/EC as amended) and the CNIL’s guidelines and recommendation (deliberations 2020-091 and 2020-092 of 17 September 2020), offering an equally prominent “Reject all” option alongside “Accept all”;
• classify cookies into: strictly necessary, functional, measurement / analytics, and marketing;
• record your consent choice and honour it for at least 6 months (CNIL recommendation);
• provide a persistent “Cookie settings” link in the footer to withdraw consent.

6. Managing cookies in your browser

Your browser lets you block or delete cookies and local storage, for all sites or only some. You can do so for pvSpline: the web application then keeps your work in memory only while the page stays open, so a reload or a crash loses unsaved changes. See the help pages of Firefox, Chrome, Safari, or Edge.

7. Your rights

Under the GDPR and the French Loi Informatique et Libertés, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing. See our Privacy Policy for how to exercise these rights. You may also lodge a complaint with the CNIL (www.cnil.fr).

8. Contact

PvSpline — contact@pvspline.fr