Legal
notice

Gaz Systèmes SASU
Simplified joint-stock company (sole shareholder)
189 rue de Gourette · 64121 Serres-Castet · France
SIREN 878 880 244 · Pau Trade Register · APE code 4646Z
EU VAT number: FR 33 878 880 244
Share capital: €1,302,000
Phone: +33 (0)9 87 76 95 75
Email: contact@gazsystemes.fr

The legal representative of Gaz Systèmes SASU.

Website hosted by Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, USA (Cloudflare Pages / Workers). cloudflare.com

All site content (text, images, trademarks, logos, documents, schematics) is the exclusive property of Gaz Systèmes SASU or its partners. Any reproduction, representation, modification, or exploitation requires prior written authorization.

Gaz Systèmes SASU is the data controller for the data collected on this site within the meaning of the General Data Protection Regulation (GDPR) and the French Data Protection Act. For any access, rectification, objection, deletion, or portability request: .dpo@gazsystemes.fr.

Processing purposes, retention periods, and legal bases are detailed below.

Collected data: first name, last name, email, company, role, country, project type, required gases, timeline, estimated budget.

Purpose: respond to the commercial inquiry and qualify the prospect.

Legal basis: consent (explicit checkbox) and legitimate interest (commercial follow-up).

Retention period: 3 years after the last commercial contact, then archived for an additional 2 years to comply with accounting obligations.

Online tools (specification generation, bill-of-materials analysis, 3D editor) collect minimal data to operate: user inputs (text / uploaded documents), technical session (anonymous UUID if unauthenticated, user_id if authenticated), usage logs (tokens consumed, latency, success/error).

Uploaded documents (notably specification PDFs) are stored encrypted on Cloudflare R2 for a maximum of 30 days, then deleted automatically (nightly cron at 03:00 UTC). Plan-3D sessions expire after 90 days without modification.

Subprocessors :

• Cloudflare Inc. (Workers hosting + R2 storage + D1 + Vectorize) — US, Standard Contractual Clauses
• Anthropic PBC (Claude Sonnet 4.6 model) — US, zero-retention training enabled
• Mistral AI (OCR for PDF documents) — FR, GDPR-compliant
• Resend Inc. (transactional email delivery) — US, Standard Contractual Clauses

Creating a private account: business email + name + company (optional). →

Authentication methods :

• Passkey (WebAuthn/FIDO2) — a public cryptographic key is stored on our servers. The private key remains exclusively on your device (Touch ID, Face ID, Windows Hello, YubiKey). No password is exchanged.
• Magic link by email — a single-use link valid for 15 minutes is sent to your address. The plaintext token is never stored on our servers (only its SHA-256 hash).

Session cookie: an httpOnly cookie named gs_session is set after authentication. It is signed with HMAC-SHA256 and valid for 30 rolling days. It is used solely for strictly necessary purposes (authentication) and does not require specific GDPR consent (art. 82 of the French Data Protection Act).

Login audit: connection attempts (IP, email, method, result) are logged to detect fraudulent attempts (rate-limit: 10 failures / 15 min / IP). Data retained for a maximum of 30 days, then deleted automatically.

This site uses no advertising or audience-measurement cookies. The only cookies set are:

• gs_session — private account authentication (httpOnly, SameSite=Lax, Secure in production, gazsystemes.fr domain, 30-day lifetime). Strictly necessary.

Audience measurement (Cloudflare Web Analytics) is anonymous, cookie-free, and does not track individuals. No prior consent is required under French CNIL guidelines. CNIL guide.

You have the following rights over your personal data: access, rectification, erasure, restriction of processing, portability, objection to processing, withdrawal of consent.

Data Protection Officer (DPO) : dpo@gazsystemes.fr

In case of disagreement on the processing of your data, you may also lodge a complaint with the French .CNIL.

All communications between your browser and our servers are encrypted via TLS 1.3 (HTTPS mandatory, HSTS preload, 2 years). Passwords are never stored (we only use passkeys or ephemeral magic links). Server secrets (API keys, session signing key) are stored in the Cloudflare Workers Secrets infrastructure, encrypted at rest.

Last update of this policy: April 2026.