Privacy Policy
Last updated: 21 October 2026
1. Data Controller
PvSpline (“we”, “us”, “our”)
Registered office: 11 Rue des Creuses, 42000 Saint-Étienne, France
SIREN: 130 717 770 — RCS Saint-Étienne
Email: contact@pvspline.fr
This policy applies to the pvSpline product website and the pvSpline application, including the web application, in compliance with the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the French Loi Informatique et Libertés.
2. Data We Collect
| Data | Purpose | Legal Basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| IP address, request metadata | Security monitoring, rate limiting, abuse prevention | Legitimate interest (Art. 6(1)(f)) | 90 days (CloudWatch logs) |
| Account data (email, name, company and its SIRET) | User account & licence management in pvSpline app | Contract performance (Art. 6(1)(b)) | Duration of account + 1 year |
| Phone number, if you give one (see § 5.4) | Contact about your account and your order. Optional at sign-up and for a purchase without an account; stored, not verified, and no longer one of the identity checks since 19 October 2026 | Contract performance (Art. 6(1)(b)) | As account data: kept with the account and erased with it (and at once if your request to join a company’s account is declined); included when you ask for access to your data or a copy of it (§ 6) |
| Email address of a colleague whom a manager of your company invites | Sending the invitation and, once it is accepted, opening the colleague’s account in your company | Legitimate interest (Art. 6(1)(f)) — letting a customer bring its staff into its account | Deleted 30 days after the invitation ends — accepted, expired (an invitation is valid seven days) or revoked — or with the company’s account if that comes first |
| Energy consumption data (via Enedis) | PV production/consumption analysis within pvSpline | Consent (Art. 6(1)(a)) — user-initiated Enedis authorisation | Deleted from the project at the end of the Enedis authorisation's validity (12 months by default) or on its revocation, and user-deletable before; the signed authorisation and its evidence are then kept five years from that date for the defence of legal claims under the Enedis contract (Art. 17(3)(e), 6(1)(f)) |
| Contact form and emails you send us (name, email address, subject, message) | Answering your request | Legitimate interest (Art. 6(1)(f)); pre-contractual steps at your request (Art. 6(1)(b)) | 3 years from our last exchange |
3. Data We Do NOT Collect
- This website uses no tracking cookies, no analytics trackers, and no third-party scripts. The only cookies we may set are strictly necessary: one remembering the language you pick with the site’s EN/FR switch, and a sign-in cookie where access is password-restricted (see the Cookie Policy).
- Browsing this website involves no account and no tracking; the only personal data processed is the technical request log (IP address, request metadata) described in § 2.
4. Data Processing & Transfers
Primary processing takes place on AWS infrastructure in the EU
(eu-west-3, Paris). The streamed 3-D view runs on AWS servers
in Frankfurt (eu-central-1), Stockholm
(eu-north-1) or Ireland (eu-west-1), wherever
a streaming server is free — also in the EU
(see § 5.5). All data in transit is encrypted with
TLS 1.2+. Data at rest in RDS/S3 is encrypted with AES-256.
Where a sub-processor located outside the European Economic Area is engaged (Stripe Inc. and Google LLC, see § 5), the transfer is governed by the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and the relevant sub-processor’s own data-processing agreement. PvSpline maintains a transfer impact assessment for each such flow.
An AI assistant you connect to your account is not our sub-processor: what it reads goes to its provider, which may process it outside the European Economic Area under its own terms and safeguards (see § 5.6).
Nor is the monitoring service of an inverter whose measured production you import: it answers the request you start under its own terms, possibly outside the European Economic Area (see § 5.7).
5. Sub-processors and other recipients
| Processor | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, Lambda, RDS, S3, Secrets Manager, WAF, SES (email sending, including the relay of contact-form messages to our mailbox); Amazon GameLift Streams, which runs the streamed 3-D view (see § 5.5) | EU (Paris, eu-west-3); the streamed 3-D view in Frankfurt (eu-central-1), Stockholm (eu-north-1) or Ireland (eu-west-1) |
| Enedis | Electricity consumption data API (user-initiated) | France |
| Google LLC (Maps Platform) | Satellite map tiles, elevation and time-zone lookups in pvSpline’s internal administration tools | United States, under Standard Contractual Clauses (Decision 2021/914) |
| Google Sheets | If you choose to paste your results into a new Google Sheet, the web application only opens sheets.new in a new tab; what you paste goes to Google under your own Google account and terms, not through pvSpline | Not applicable (no transfer by pvSpline) |
| Stripe Payments Europe, Ltd. | Subscription billing, payment processing, tax invoicing (only if billing is enabled). For a purchase without an account, the order details Stripe receives also carry the phone number, if one is given (§ 2), and the result of the company check (§ 5.4) | Ireland (EU); onward processing by Stripe, Inc. in the United States under Standard Contractual Clauses (Decision 2021/914) |
| Billit NV | Invoicing: issuance and electronic transmission of our invoices (French Plateforme Agréée / Peppol) from the billing identity and the amounts of each subscription | Belgium (EU) |
| Proton AG | Mailbox of the pvspline.fr domain | Switzerland (EU adequacy decision) |
The open-data services below are not processors. Each runs its own service, open to all, on its own terms and for its own purposes, and receives from your browser or from our servers only the requests described in §§ 5.2 and 5.3. They act as independent controllers of what they receive (recipients, Art. 4(9) GDPR), not on our instructions.
| Recipient | Purpose | Location |
|---|---|---|
| PVGIS (European Commission JRC) | Solar irradiance data | EU |
| IGN — Institut national de l’information géographique et forestière (Géoplateforme, API Carto) | Map imagery; address geocoding (Base Adresse Nationale); building footprints, terrain, imagery and LiDAR point clouds for the project area, fetched by our servers for the 3D view; permit-dossier lookups of the cadastral parcel and of heritage-protection servitudes from the project’s site coordinates (see §§ 5.2 and 5.3) | France |
| OpenStreetMap Foundation (Nominatim) | Address geocoding when IGN finds no match, for example an address outside France (see § 5.3) | United Kingdom (EU adequacy decision) |
| Référentiel National des Bâtiments (French public service) | Building identifier (ID-RNB) lookup from the project’s site coordinates, user-initiated (web application, see § 5.2) | France |
5.1 Export-control records
Until September 2026 this website offered a demo of the software for download. For each download we recorded your IP address, the country code resolved by the CDN, your self-declared country of installation, and your acceptance of the export-control statement. These records are kept for 5 years from the download, as required by Regulation (EU) 2021/821 of the European Parliament and of the Council, Article 27 (mass-market cryptographic software), and then deleted. Lawful basis: legitimate interest in complying with EU export-control law (Art. 6(1)(f) and 6(1)(c) GDPR).
5.2 Map imagery and site lookups (web application)
Some features of the web application send requests from your browser directly to public mapping services, without passing through our servers:
- Map imagery — the Map view requests tiles from
IGN — Géoplateforme (
data.geopf.fr), or from OpenStreetMap (tile.openstreetmap.org) where the global basemap is selected (an option offered to administrator accounts only); the 3D view’s alignment step requests the same IGN imagery; and the optional heritage-protection layer requests images of the protected perimeters for the area on screen. The provider receives the requested map area, your IP address and your browser User-Agent. - Permit-dossier lookups — the permit dossier
sends the project’s location (points within the array drawn on the
map, or the site coordinates while nothing is drawn) to IGN’s API
Carto (
apicarto.ign.fr) to check heritage-protection servitudes (automatically when the dossier opens) and to find the cadastral parcels (when you press “Locate the parcel”), and to the Référentiel National des Bâtiments (rnb-api.beta.gouv.fr) to find the building identifiers (with the same button). These services receive those points, your IP address and your browser User-Agent — no name, postal address, meter number or other project data.
These requests are necessary to provide the features you use (Art. 6(1)(b) GDPR). Where you prepare a project for one of your own clients, you remain the controller of that client’s data and PvSpline processes it on your behalf under our data processing agreement. IGN and the Référentiel National des Bâtiments are French public services established in France. No cookie is involved; see the Cookie Policy.
5.3 Address geocoding and 3D-scene data (our servers)
Two further features send data to public services from our servers, not from your browser:
- Address geocoding — when you type a site
address, our cloud engine sends it to IGN’s geocoder
(
data.geopf.fr/geocodage, Base Adresse Nationale) to find its coordinates and, when IGN finds no match (for example an address outside France), to the OpenStreetMap Foundation’s Nominatim service (nominatim.openstreetmap.org). The service receives the address as typed — for a residential project, usually your client’s home address — with the IP address of our server. - Map and 3D-scene data — our cloud engine fetches from IGN the building footprints drawn on the map (BD TOPO) for the area shown, and IGN’s aerial imagery around the site to draw the project map in the reports and previews it renders; and when you build a project’s 3D scene, our servers (Amazon Web Services, EU — Paris) download IGN’s open data for the project area — terrain, buildings, imagery and LiDAR point clouds — and host the resulting tiles. IGN receives the coordinates of the area and the IP address of our servers, not your identity.
These requests are necessary to provide the features you use (Art. 6(1)(b) GDPR), with the same roles as in § 5.2 when the project is for one of your clients. IGN is a French public service established in France; the OpenStreetMap Foundation is established in the United Kingdom, which the European Commission recognises as ensuring an adequate level of protection.
5.4 Identity checks and the Sirene register (our servers)
Since October 2026, an account opened online — by signing up in the web application or by a purchase without an account — is checked before its free plan starts and before it subscribes: its email address is confirmed through the link we send, and its company’s SIREN — the first nine digits of the SIRET given at sign-up — is looked up in the Sirene register of INSEE (Institut national de la statistique et des études économiques) to confirm that the company exists and is active. Until both checks are done, the account holds no plan. A phone number is not one of the checks: giving one is optional (§ 2). An account opened before then keeps its former rules: its confirmed email address alone is what its free plan depends on, and it is not asked for a register check.
Our servers ask the register when you sign up; when you confirm your email address while the register has not yet confirmed your company; on their own, regularly, in the days after sign-up, while a new account whose email address is confirmed still waits on the register; when you ask for it from your account; and before payment for a purchase without an account. A company the register lists as ceased, or does not know, cannot sign up: the sign-up form says so, and if you think the register is wrong you can write to us — a person will review your request. Only the SIREN is sent to INSEE’s API — an identifier INSEE itself assigns to the company — with the IP address of our servers: never your name, email address or phone number. When the register answers that the company is active, we store the date of that answer with the company’s account; if the company’s SIRET is later corrected to one with a different SIREN, that record is cleared and the check is made again.
This check is necessary to provide the free plan and a subscription (Art. 6(1)(b) GDPR). INSEE, which keeps the Sirene register, is a French public body established in France.
5.5 The streamed 3-D view (our servers)
When you open a project’s 3-D view in the web application, the
scene is drawn on one of our streaming servers — Amazon GameLift
Streams, run for us by Amazon Web Services — and sent to your
browser as a video stream; your mouse and keyboard input on the picture
goes back to the server. The server is in Frankfurt (Germany,
eu-central-1), Stockholm (Sweden, eu-north-1)
or Ireland (eu-west-1), wherever one is free: all three in
the EU.
For the length of the session the server receives the project as prepared for streaming — the site’s location and geometry, without your client’s name, street address, contact details, meter point (PRM) or consumption data — your internal user identifier, and the IP address of your browser’s connection. We keep nothing on the streaming server once the session ends; the server’s technical log of the session is stored in Frankfurt.
This processing is necessary to provide the 3-D view you open (Art. 6(1)(b) GDPR), with the same roles as in § 5.2 when the project is for one of your clients.
5.6 AI assistants you connect (MCP)
pvSpline’s cloud API includes a server for AI assistants that use the Model Context Protocol (MCP). If you connect one to your account — Claude Code by Anthropic, Cursor or another MCP client, which you choose and use under your own terms with its provider — it creates and changes projects, runs simulations and reads their results, on your instruction. You can disconnect it at any time under Account → Service tokens, where a Manager account of your company can also turn assistants off for all its members.
What the assistant reads is sent to its provider, which processes it under its own terms and privacy policy, possibly outside the European Union: the names of your projects, their approximate location (to about a kilometre), their PV arrays and modules, the consumption, prices and costs entered for them, and their simulation results. We do not send it your clients’ names, your projects’ street addresses (except an address the assistant itself gives to create a project, which it gets back), your reports, or any data from an Enedis electricity meter: a project that uses one is not available to an assistant at all. We do not choose, instruct or pay that provider. Depending on your plan with it, the provider may use what it receives to train its models: prefer a business or API plan, under which it processes data on your behalf and does not train on it, or turn training off in your plan’s settings.
On our side, the connection is a service token listed under Account → Service tokens, with the assistant’s name and when it was last used, kept with your account data (§ 2); each request the assistant makes is recorded in our request log, with its IP address and the assistant’s name, and kept as that log is (§ 2). This processing is necessary to provide the connection you set up (Art. 6(1)(b) GDPR) and to secure the service (legitimate interest, Art. 6(1)(f)).
Where your projects concern your own clients, your company is the controller of their data and PvSpline processes it on your behalf under our data processing agreement: whether to connect an assistant to those projects is your company’s decision.
5.7 Measured production from an inverter’s monitoring service (our servers)
On a project’s Production page you can import an installation’s measured production from the monitoring service of its inverters — Enphase, SolarEdge, APsystems or SolaX — to compare it with the simulation. You choose the service and enter the installation’s identifier there (its site or system ID, or the serial number of its Wi-Fi module), the API credentials of the account it belongs to, and the dates.
Our cloud engine sends that identifier, those credentials and those dates to the vendor’s API from our servers, and receives the installation’s production for that period; the vendor sees the IP address of our servers, not yours. The credentials serve that import only: we do not store them or write them to our logs. The production comes back to your browser, which compares it with the simulation; it is not saved with your project, and our engine keeps its latest results in memory only, until newer requests replace them.
The vendor processes the request under its own terms, those of the account the credentials belong to, and may do so outside the European Union: Enphase is based in the United States, SolarEdge in Israel, which the European Commission recognises as ensuring an adequate level of protection, and APsystems and SolaX in China. We do not choose, instruct or pay that vendor.
This processing is necessary to provide the import you start (Art. 6(1)(b) GDPR). Where the installation is your client’s, your company is the controller of that data and PvSpline processes it on your behalf under our data processing agreement, which lists this import among the disclosures your company directs.
6. Your Rights (GDPR Articles 15–22)
You have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data (“right to be forgotten”, Art. 17)
- Restrict processing (Art. 18)
- Data portability — receive your data in a structured, machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time for consent-based processing (Art. 7(3))
To exercise these rights, contact us at contact@pvspline.fr. We will respond without undue delay and in any event within one month of receiving your request. Where necessary, given the complexity and number of requests, this may be extended by two further months; we will tell you within the first month, with the reasons.
7. Data Breach Notification
In the event of a personal data breach, we will notify the CNIL (Commission Nationale de l’Informatique et des Libertés) within 72 hours as required by GDPR Article 33, and affected users without undue delay per Article 34.
8. Supervisory Authority
You have the right to lodge a complaint with the CNIL:
Commission Nationale de l’Informatique et des Libertés
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
www.cnil.fr
9. Security Measures
We implement industry-standard security measures including:
- Ed25519 cryptographic signatures on all software releases
- SHA-256 integrity checksums for all distributed binaries
- TLS 1.2+ encryption for all data in transit
- AES-256 encryption for data at rest
- AWS WAF and rate limiting on the application’s API to prevent abuse
- VPC network isolation for database infrastructure
- AWS Secrets Manager for all credentials (zero hardcoded secrets)
- Regular security audits (OWASP Top 10, RCE, SSRF prevention)
10. Changes to This Policy
We may update this policy to reflect changes in our practices or applicable law. The “last updated” date at the top will be revised accordingly. Material changes will be announced on this page and, for account holders, by email before they take effect.