Privacy — DOF-AMDEC
Last updated on 7 November 2026
This policy describes the personal data processed by the DOF-AMDEC online software, available at dof-amdec.md-tools.xyz, and how it is protected, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act. The French version prevails.
The md-tools.xyz website has its own privacy policy.
Who is responsible for your data
DOF-AMDEC is published by MD-Tools, SASU, 4 rue de Malbouhans, 70200 La Neuvelle-Lès-Lure, France — contact@md-tools.xyz.
Two situations apply, as set out in the terms of sale (article 14):
- Customer workspace data — user accounts, projects, analyses, comments — is processed by MD-Tools on behalf of the customer organisation, which is the controller. MD-Tools then acts as a processor, under the annex to the terms of sale. If your account was opened by your employer, contact them first to exercise your rights; MD-Tools will assist them.
- Business relationship data — sign-up, trial, subscription, billing, support — is processed by MD-Tools as controller.
Data processed
| Category | Data | Source |
|---|---|---|
| User account | First name, last name, email address, organisation, role, password (stored only as a hash), email confirmation date | Entered at sign-up or invitation |
| Acceptance of terms | Date, version of the terms accepted, user who accepted them | Sign-up |
| Traceability | Author and date of creation and last change of each item, comments | Use of the application |
| Business content | Any personal data you choose to enter in your analyses (for instance a name in a comment) | You |
| Subscription and billing | Plan, subscription status, Stripe customer identifier, billing email address | Subscription |
| Security | Sign-in, email confirmation, password reset and invitation tokens; online presence; server logs (IP address, date, requested address) | Operation of the application |
Card numbers and direct debit details are entered directly with Stripe: MD-Tools never has access to them.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide the application: accounts, projects, collaboration, exports | Performance of the contract (Art. 6.1.b GDPR); for workspace data, the customer’s instructions (Art. 28) |
| Manage the trial, subscription, billing and support | Performance of the contract (Art. 6.1.b); accounting obligations (Art. 6.1.c) |
| Prove acceptance of the terms of sale | Legitimate interest in establishing the contract (Art. 6.1.f) |
| Send service emails: address confirmation, invitation, password reset, trial reminders, end of subscription | Performance of the contract (Art. 6.1.b) |
| Secure the application: authentication, rejection of compromised passwords, abuse limits, server logs | Legitimate interest in securing the service (Art. 6.1.f) |
DOF-AMDEC sends no marketing, sells no data and uses no analytics or advertising tools.
Cookies and browser storage
DOF-AMDEC sets a single strictly necessary cookie: refresh_token, which keeps you signed in (7 days, not readable by scripts, restricted to the site). The browser also stores your current session token (valid for 15 minutes) and your light or dark theme choice. None of these is used to track you; no consent is therefore required.
Recipients and processors
Data is only accessible to the users of your organisation, according to their rights, and to MD-Tools for maintenance and support. Customer workspaces are isolated: no organisation can see another’s data.
MD-Tools uses the following providers, kept up to date on the Subprocessors page:
| Provider | Role | Data location |
|---|---|---|
| Hostinger International Ltd | Server hosting and email delivery | Germany and European Union |
| Stripe Payments Europe, Ltd | Subscription payment and billing | Ireland; any transfers to the United States are covered by the EU–US Data Privacy Framework and standard contractual clauses |
When you choose a password, the application checks that it is not among leaked passwords, using the Have I Been Pwned service. Only the first five characters of a hash of the password are sent: neither the password, nor your address, nor anything that identifies you.
Backups are encrypted on the server, before any copy, with a key held by MD-Tools only; they are kept in France, away from the main server.
Retention periods
| Data | Period |
|---|---|
| Workspace data, during the subscription | Its whole duration |
| After a subscription ends | 30 days read-only to export, then the workspace is closed; permanent deletion 60 days after the end of the subscription |
| After a trial that was not converted | 30 days read-only, then closed; permanent deletion 90 days after the end of the trial |
| Backups | 30 days: deleted data leaves the backups within 30 days |
| Session token / session cookie | 15 minutes / 7 days |
| Email confirmation and invitation links | 2 days / 7 days |
| Server logs | 12 months at most |
| Invoices | 10 years at Stripe (accounting obligation) |
An account deleted by the organisation’s administrator disappears; the items it created remain in the analyses, without any link to it.
Security
Encrypted connections (HTTPS), hashed passwords, leaked passwords rejected, short sessions, isolated customer workspaces, server-side permission checks, encrypted daily backups. In the event of a data breach, the customer organisation is notified within 48 hours of its discovery and, where the law requires it, the CNIL within 72 hours.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. Your profile can be edited in the application; project data can be exported from each module. For any other request, contact your organisation’s administrator or write to contact@md-tools.xyz. You will receive an answer within one month.
If you believe your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
Changes
This policy may change with the application. The date of the last update is shown at the top of the page; significant changes are announced to customer organisation administrators by email.