The essentials (non-binding summary)
- We collect only the data necessary for the service to work and we do not sell it.
- No advertising cookies. Audience measurement (Google Analytics) is only enabled with your consent, which you can withdraw at any time (see cookies).
- Your drawings are only visible to signed-in members; your email and phone number are not displayed on your profile.
- You can at any time access, correct or delete your data.
1. Data controller
The controller of the personal data collected on Meaflow (https://meaflow.com) is the Publisher of the site, an individual acting in a non-professional and non-profit capacity (“we”), who can be contacted at admin@meaflow.fr. Their identity is not published on the site; it may be disclosed to the competent authorities under the conditions provided for by law.
For any question about your personal data or to exercise your rights, you can write to us at admin@meaflow.fr or use the contact form.
For data that Users exchange with each other (for example the name of a contact appearing on a drawing), each User is responsible for their own processing.
2. Data we collect
We collect the data you provide to us directly, data generated by your use of the service and technical connection data. We do not collect any sensitive data within the meaning of Article 9 of the GDPR.
- Account and authentication: first name and surname, email address, password (never stored in plain text; managed by Firebase Authentication) or Google identifier if you sign in with Google, telephone number (optional), account type.
- Business profile: company name, SIRET number or company or VAT number, job title, town or city, postcode, region, description, website, expertise, machines and materials, certifications, headcount, logo or photo and photos of your work. This information is public on your profile; your email address and telephone number are not.
- Content: Requests (description, budget, deadline, location), attached drawings and documents (visible only to signed-in members), public questions, Quotes, private messages (visible only to participants) and reviews.
- Use of the service: saved items, notifications, preferences, Request view counter, date of last activity.
- Technical data: IP address, technical identifiers, browser type, connection and error logs generated by the hosting infrastructure.
- Contact and reports: name, email address, company, subject and content of your message; reason for and details of a report.
Information marked as mandatory is necessary for the provision of the service; without it, we cannot create your account.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creation and management of your account, authentication, provision of the service (Requests, Quotes, messaging, saved items, reviews, notifications) | Performance of a contract (Art. 6(1)(b)) — terms and conditions of use |
| Display of profiles and connecting Users | Performance of a contract (Art. 6(1)(b)) |
| Verification of the existence of the business (SIRET or company or VAT number) and award of the “Verified business” badge | Legitimate interest (Art. 6(1)(f)): reliability of the platform and fraud prevention |
| Security, prevention of abuse and fraud, moderation and handling of reports | Legitimate interest (Art. 6(1)(f)) and legal obligations (Art. 6(1)(c): LCEN, Digital Services Act) |
| Service notifications (new quote, message received, customer’s decision…), according to your preferences | Performance of a contract (Art. 6(1)(b)) |
| Replying to your contact and support requests | Legitimate interest (Art. 6(1)(f)) and pre-contractual measures |
| Service improvement and aggregated statistics from our own data (volumes, view counters) | Legitimate interest (Art. 6(1)(f)) |
| Audience measurement of the site with Google Analytics 4 (pages viewed, journeys, devices), only after your consent | Consent (Art. 6(1)(a)), collected via the cookie banner and withdrawable at any time |
| Compliance with our legal obligations (retention of identification data, official requests, exercise of rights) | Legal obligation (Art. 6(1)(c)) |
We make no decision producing legal effects concerning you based solely on automated processing, carry out no advertising profiling and do not sell your data.
4. Recipients of data
- Our team: authorised persons, within the limits of what is necessary for their duties (support, moderation, administration).
- Other Users: your public profile, your Requests, your public questions and your reviews are visible; your Quotes are visible to the Customer concerned; your messages are read only by their participants; drawings and documents are accessible only to signed-in members.
- Our processors: Google Ireland Limited (Firebase Authentication, Cloud Firestore, Cloud Storage and Firebase Hosting) for authentication, hosting and data storage, under a processing agreement compliant with Article 28 of the GDPR; Google (Google Analytics 4), which processes audience measurement data only if you have accepted it; where applicable, other technical providers (for example for sending service emails) subject to the same requirements.
- Authorities: upon official request or where required by law.
We do not sell or rent your data to third parties for commercial purposes.
5. Transfers outside the European Union
Google, our hosting processor, may process data outside the European Economic Area, in particular in the United States. These transfers are governed by the safeguards provided for in Chapter V of the GDPR: the European Commission’s adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework for certified entities, and/or the European Commission’s standard contractual clauses supplemented by additional measures. These safeguards also apply to audience measurement data processed by Google Analytics when you have accepted it (see Cookies and audience measurement). You can obtain a copy by writing to us at admin@meaflow.fr.
In addition, displaying the platform loads Firebase technical libraries from Google’s servers (gstatic.com): your browser then communicates your IP address to Google. The font is hosted directly on the platform. No cookie is set on this occasion.
6. Retention periods
| Data | Retention period |
|---|---|
| Account and profile | For the lifetime of the account, then deletion within a maximum of 30 days after it is closed. An account inactive for 36 months is deleted after prior notice by email. |
| Requests, Quotes, questions, messages, reviews | For the lifetime of the account, then erasure or anonymisation. Items necessary for establishing, exercising or defending legal claims may be archived for up to 5 years (limitation period). |
| Drawings and Documents | Deleted with the Request or the account, or at your request. |
| Connection logs | 12 months (legal retention obligation for hosting providers). |
Audience measurement cookies (_ga, _ga_<ID>) and consent choice | Cookies: 13 months maximum. Consent choice: 6 months, after which the banner is shown to you again. |
| Contact form messages | 3 years maximum after the last exchange. |
| Reports and moderation decisions | Duration of processing, then 5 years maximum in archive. |
7. Your rights
In accordance with the GDPR and the French “Informatique et Libertés” Act, you have the following rights:
- the right of access to your data and to obtain a copy of it;
- the right to rectification of inaccurate or incomplete data (you can also edit your profile in the account settings);
- the right to erasure of your data, in the cases provided for by law;
- the right to restriction of processing;
- the right to object, on grounds relating to your particular situation, to processing based on our legitimate interest;
- the right to portability of the data you have provided to us;
- the right to give instructions on what happens to your data after your death.
To exercise these rights, write to us at admin@meaflow.fr (subject: “Personal data”). We may ask you for proof of identity in case of reasonable doubt. We reply within one month, extendable by two months in the case of a complex request or a large number of requests.
If you believe that your rights are not being respected, you may lodge a complaint with the CNIL: Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr/fr/plaintes.
8. Cookies and audience measurement
We use no advertising cookies and no profiling trackers. Two types of mechanism are used: storage strictly necessary for the service to function, exempt from consent, and, only with your consent, audience measurement.
Strictly necessary storage (no consent required)
| Mechanism | Purpose | Duration |
|---|---|---|
| Firebase authentication session (browser storage) | Keep you signed in to your account | Until sign-out |
| Interface preferences and session state (browser storage) | Remember technical choices (for example counting only one Request view per session) | Session duration |
| Storing your cookie choice (browser local storage) | Avoid asking for your choice again on every visit | 6 months |
Google Analytics 4 audience measurement (with your consent)
With your consent, we measure the site’s audience (pages viewed, journeys, device type) using Google Analytics 4, in order to improve our content and the service. This measurement is only enabled after your consent, collected via the cookie banner: until you have accepted, no audience measurement cookie is set.
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Distinguish visitors (random identifier) | 13 months maximum |
_ga_<ID> | Maintain the state of the browsing session | 13 months maximum |
- Legal basis: your consent (Art. 6(1)(a) of the GDPR).
- Your choice is remembered for 6 months in your browser’s local storage; after this period, the banner is shown to you again.
- Recipient: data is processed by Google and may be transferred to the United States, under the EU–US Data Privacy Framework (see “Transfers outside the European Union”).
Withdraw or change your choice
You can accept, refuse or withdraw your consent at any time, using the button below or the “Cookie management” link at the bottom of each page. Withdrawal does not affect processing carried out before it. You can also clear your browser data from its settings; you will then be signed out.
9. Interactive map
The base map is provided by the Géoplateforme of the IGN (Institut national de l’information géographique et forestière, a public service) for France, and by OpenStreetMap outside France (tiles served by the OpenStreetMap Foundation). It is loaded only when you open a map (“Map” page or “Map” view of requests and suppliers): your browser then communicates your IP address to the IGN, or outside France to the OpenStreetMap Foundation, in order to display the map images. To find out more about this processing, see the IGN’s privacy policy or that of the OpenStreetMap Foundation; Meaflow sets no cookie on this occasion.
Requests and supplier profiles are placed there at the centre of the municipality of their postcode, never at their address: the position displayed is approximate.
10. Security
We implement appropriate technical and organisational measures: encryption of exchanges (HTTPS), passwords protected by Firebase Authentication, strict database access rules (each User can access only the data they are entitled to), access to drawings restricted to authenticated sessions, limitation of internal access and the principle of least privilege.
In the event of a data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours and, where the risk is high, we inform you directly. As no system is infallible, choose a strong password and do not share it.
11. Service reserved for businesses
The platform is intended exclusively for professionals who are adults. We do not knowingly collect data relating to minors; if you believe a minor has provided us with data, contact us so that we can delete it.
12. Changes to this policy
We may update this policy, in particular to take account of changes to the service or to regulations. The date of the last update appears at the top of the page; in the event of a substantial change, we will inform you by email or by a notice on the platform.
13. Contact
For any question: admin@meaflow.fr or via the contact form.