Legal information
Privacy Policy
What data we process when you buy and use our extensions, why, for how long, and how to exercise your rights.
1. Data controller
The data controller is Mokadev, SASU with a share capital of €3,000, Toulouse RCS 752 384 651, whose registered office is at 116 route d'Espagne, 31100 Toulouse, France. For any question about your data: [email protected].
Our customers are businesses; the data processed concerns the people acting on their behalf (managers, developers, accountants).
2. Data processed, purposes and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Customer account | Name, email, password (hashed), company, addresses, VAT number | Performance of the contract | Duration of the relationship, then 3 years after the last purchase or sign-in |
| Orders, invoices and licences | Products purchased, amounts, billing address, licences and update periods | Performance of the contract, legal obligation | 10 years for accounting records (article L123-22 of the French Commercial Code) |
| VAT number check | VAT number, VIES check result | Legal obligation | With the related invoice |
| Composer repository access | Access keys (hashed secret), download log: customer, key, version, IP address, date | Legitimate interest: security and licence compliance | Keys: until revoked; log: 12 months |
| Support and contact form | Name, email, phone (optional), message, conversations | Legitimate interest: answering your requests | 3 years after the last exchange |
| Newsletter | Consent | Until you unsubscribe | |
| Analytics | Cookie identifiers, pages viewed, browsing and purchase events | Consent | Cookies: 13 months; data: 14 months |
| Proof of your cookie choices | Consent ID, choice, policy version, truncated IP address, browser | Legal obligation | 24 months |
Required form fields are marked; without them we cannot create your account, process your order or answer your request.
3. Payment
Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). Your card details are entered directly in Stripe's secure form: we never receive or store them. We only keep the payment reference, its status and the payment method used. Stripe also processes technical data (device, IP address) to prevent fraud, as a controller for that purpose; see Stripe's privacy policy.
4. Composer repository and downloads
To install our extensions, you create access keys in your customer account. The secret of each key is shown only once and is only stored in hashed form. Each package download is logged (customer, key used, version, IP address, date) to detect abnormal use or key sharing, and to help you with installation issues.
5. Analytics
When analytics is enabled, we use Google Analytics 4 to understand how the website is used and which pages lead to a purchase. Analytics cookies are only set with your consent, collected by our cookie banner with Google Consent Mode v2. You can change your choice at any time; see the cookie policy.
6. Recipients
Your data is processed by Mokadev and its processors, only for the purposes above:
- the website host: OVH SAS (OVHcloud), servers located in France;
- Stripe, for payments;
- Google, for analytics, if you accept it;
- where applicable, our email delivery provider: Mailjet (Sinch group), for transactional emails;
- our chartered accountant and the authorities, for accounting and tax records.
We never sell or rent your data.
7. Transfers outside the European Union
Stripe and Google may process some data in the United States. These transfers are covered by the EU–US Data Privacy Framework, which these companies have joined, and by the standard contractual clauses of the European Commission.
8. Security
The website is served over HTTPS only. Passwords and Composer key secrets are hashed, extension archives are never publicly accessible and access to the administration is restricted. In the event of a data breach likely to affect you, we will inform you as provided for by the GDPR.
9. Your rights
You have the right to access, rectify and erase your data, to restrict and object to its processing, to data portability, to withdraw your consent at any time and to give instructions about your data after your death.
- From your account: the My personal data page lets you download your data (JSON file) and delete your account. Invoices are kept for the legal period, detached from your account.
- By email: [email protected], from the address of your account.
We answer within one month. If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or the authority of your country.
10. Changes
We may update this policy to reflect changes to the website or to the regulations. The update date is shown at the top of the page; in the event of a significant change, we will inform you by email.