Data protection

MECAFLOW is a workshop management platform for vocational schools and company workshops (precision mechanics). On the school side, we process data of minors (apprentices): their protection is central to our design. We do not sell any data and use no advertising trackers.

1. Data controller

Nexus Studios, publisher of MECAFLOW — Biel/Bienne (BE), Switzerland.
Data protection contact: [email protected].
For schools, the institution is responsible for its students' data; Nexus Studios acts as technical processor.

2. What data, and why

Identity (first name, last name, role, class) — to manage the workshop and track training.
Access code (PIN) — stored hashed (never in clear text), used only for login.
Training data (CFC/VET competencies, grades, attendance/absences, logbook, work orders) — pedagogical tracking.
Photo (optional) and birthday (day + month only, no year) — deliberate minimisation.
Institution and contact details — account administration.
Suppliers: company, contacts, products — connecting with schools.

3. Legal basis

Performance of the contract with the school, legitimate interest (proper functioning of the workshop), and consent for optional elements (photos). Processing of minor apprentices' data is carried out on behalf of, and under the responsibility of, the school.

4. Hosting and location

MECAFLOW is published in Switzerland (Nexus Studios, Biel/Bienne). The technical infrastructure is provided by Cloudflare (hosting, database, network) and data is stored in Europe. It is transmitted encrypted. No data is transferred for commercial purposes.

5. Security

Measures in place: encryption in transit (HTTPS/TLS), hashed PINs (SHA-256), time-limited sessions with server-side logout, strict isolation per institution (one school never sees another's data), security headers (CSP, HSTS, anti-clickjacking), and brute-force limiting on logins.

6. Retention period

Data is kept for the duration of the relationship with the institution. When an apprentice leaves the system (end of training or account deactivation), their entire activity history is deleted; their training logbook (PDF) should be exported beforehand. A school may request deletion of its account and all its data at any time.

7. Your rights

Under the Swiss FADP, you have the right of access, rectification, erasure, objection and portability. To exercise these rights: contact your school's administrator, or write to [email protected].

8. Cookies and trackers

No tracking cookies, no advertising trackers, no resale. MECAFLOW only uses your browser's localStorage to keep your session and preferences (language, theme) — this is technically necessary for the service to function and is used for no profiling whatsoever.

9. Processors

Cloudflare (hosting) and, for the integrated AI assistant, Cloudflare's AI infrastructure (data stays within the Cloudflare ecosystem). No other sharing.

10. Changes

This policy may evolve; the update date above is authoritative. For any question: [email protected].