Version 1.0, dated 5 November 2026.
The Spanish version prevails.
Summary
Your projects and your work are yours: Mecanius uses them only to calculate, and only while you are working on them.
- Your projects stay on your computer, in your .mecx files. The server uses them only while you are working on them and deletes them afterwards.
- We do not sell them, we do not share them with third parties and we do not use them to train anything outside your account.
- Vysia AI, the assistant, is our own and runs on Mecanius servers. What you write to it is not sent to external artificial intelligence services.
- Providers: we only work with those essential to provide the service, under contract: Google (cloud and email), Flow (payments) and Cloudflare (website).
- Your rights: you can ask to see, correct, download or delete your data whenever you want. You can download your data and close your account yourself, on the user card, “Your data” section.
1. Who is the controller
The controller of your data is MECANOVA LAB SpA, Chilean tax ID (RUT) 78.541.649-K, domiciled at office No. 302 of the Centro de Negocios Uribe building, located at Uribe Street No. 636, commune of Antofagasta, Chile. In this policy it is referred to as “Mecanius”.
- Support contact: soporte@mecanova.cl.
- Accounts of an institution or company: if your account was created by the administrator of your institution or your company (Prime Plan), it provided your name and your email address to create it and is responsible for having done so. Mecanius processes that data to provide the service to you, as this policy describes. If your email address already had a Mecanius account, that account does not change and we do not tell the institution: we only notify you by email.
2. What data we process
We process only the data the service needs to work. We do not process sensitive data.
| Type | What it includes | Where it comes from |
|---|---|---|
| Account | First and last name, company (if a company subscribes), email, plan and license number, with the holder and the company shown on the license, and the photo you upload to “My account”, which is stored without metadata (such as where or when the photo was taken). The password is stored only as a hash (scrypt): no one can read it. | From you, your company or your institution |
| Second factor | If you turn it on: the secret key with which your authenticator app generates the codes, which the server stores encrypted because it needs it to check them, and your backup codes, which are stored only as a hash. | From you, when you turn it on |
| Account of an institution or company | If your account is part of the Prime Plan of an institution or company: which one it is, the license type (commercial or academic), the end date set by its administrator, your last sign-in and how many calculations you made, and the log of the changes made to your account by its administrators, Mecanius or the system (who, what and when). | From your institution or company and from your use of the service |
| Preferences | What you choose in Preferences: the language, the unit system for new projects, how the screen looks (background, labels and color palette), how captures are made, what Vysia AI does and, for reports, the author, the views per figure and the paper size. | From you |
| Work content | 3D models (STEP), load cases, materials (including the custom materials you keep in your account, in your material libraries, with the laboratory curve you load for them, and those that come with the projects you open, which are added to “My materials”), meshes, results and thumbnails, the unit system of each project, the report of each project (what you write in it, the logo and the figures you capture or upload) and the documents you upload as “My format” for the report. For a laboratory curve, its points and the file name are kept, not the file. Word reports are generated when you request them and are not kept on the server. The server keeps each project only while you are working on it (section 4); your custom materials, their libraries and your report formats stay in your account. | From you |
| Issued reports | For each official report: holder and company, license and plan, the license type (commercial or academic) and, if the license belongs to an institution, its name, version, document and revision, cases with their material and their key values, date of issue and status (valid, voided or superseded), with who voided it and why, if it was voided. | From your work, when you issue the report |
| Vysia AI | What you write to it, and what you confirm or correct in its proposals. | From you |
| Problem reports | What you write when you report a problem from the program and, if you add them, a capture of the view (which may show your model) and the interface’s technical log: its version, the engine mode, the browser and the operating system, the language, the screen size and the messages of the latest errors, without file names or model data. They are stored with your account. | From you, when you report |
| Acceptance of the legal texts | Which version of the Terms of Use and of this policy you accepted, when, whether it was when activating the account or within the program, and in which language they were shown to you. | From you, when you accept them |
| Service records | The calculations you request from the server (imports, mesh previews and calculations of your cases), without their data, and the downloads of your data. | From your use of the service |
| Security | For each session: IP address, type of browser or program, sign-in, last activity, whether it went through the second factor and, if you renewed it with “Stay signed in”, when. Also failed sign-in attempts (with the IP address and the email entered) and failed second-factor attempts, the server’s technical logs (events and errors of its operation, without the IP address of each request) and the log of Mecanius staff access to your account. | From your use of the service |
| Trusted devices and failed sign-in notice | A signed cookie with which the server recognizes the devices from which you have already signed in successfully to your account (section 10), so that failed attempts from other devices do not make you wait. For the failed attempts with your email since your last sign-in, the date and the type of device (operating system and browser), without the IP address, to notify you when you sign in. | From your use of the service |
| Payment and billing | Payment status and billing details. The card is processed by Flow: Mecanius does not receive or store it. | From you and the payment processor |
The scanned signatures you upload for the report cover are not stored: they are used only to generate that report.
3. Why we use them and on what legal basis
We use your data only to provide, protect and charge for the service. We do not use it for advertising or for commercial profiling.
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and your preferences, and recording which version of the Terms of Use and of this policy you accepted | Contract |
| Calculating, keeping your projects while you are working on them and generating reports | Contract |
| Verifying the reports you issue, so that whoever receives them can check that they are authentic, also after you close your account | Contract: you request it when issuing |
| Letting Vysia AI learn within your account | Contract |
| Handling the problems you report | Contract: you request it when reporting |
| Letting the administrators of your institution or company add and remove accounts, see the use of their licenses and know when a report issued under them is voided | Contract with your institution or company |
| Internal statistics from the record of issued reports, always aggregated, which do not identify anyone | Legitimate interest |
| Security: sessions, second factor, trusted devices, blocking attacks, failed sign-in notices, logs and the staff access log | Legitimate interest and security duty |
| Billing and invoicing | Contract and tax obligations |
| Service notices by email: activation links and links to change the password, changes, security and the voiding of your issued reports | Contract |
If we ever send advertising, it will be only with prior consent.
4. Your projects
Your projects and your work are yours, stay on your computer and only you decide what is done with them. Calculations are made on the company’s servers, its own or those of its cloud provider, Google Cloud.
- The server uses your projects only while you are working on them:
- your work stays on your computer, in the .mecx file you save, under your control;
- the server deletes each project when you leave with “Sign out” or after 24 hours without use, but never while a calculation is in progress: its result waits for you to save it;
- before you sign out, if there are changes or results that are not in your .mecx file, we warn you so that you can save it.
- Who sees them:
- you and the people your company authorizes. The administrators of your institution or company do not see them (section 6);
- Mecanius staff, only when essential for support or security, with prior consent and leaving a record. Whenever staff read or change your account’s data with the administration tools, it is logged with who did it, when, what they did and why, and you receive that log in “Download my data”.
- What we never do:
- sell them;
- share them with third parties;
- show them to other users;
- use them to train models that serve others.
- Signed results: we sign every calculation, so that you can prove that the file was not modified afterwards.
- Verification of your reports, at your choice: when you issue an official report, anyone with its code or its QR code can see, on the Mecanius verification page, the data on its final sheet (holder and company, license and plan, the use it authorizes, version, document and revision, date of issue and status) and the cases with their material and their key values; if the license belongs to an institution, also its name. When issuing, you can choose to show only its authenticity. Your models, your files, your email and your other projects are never shown. We keep no data about the person who verifies: neither their IP address nor the code they look up.
- Your issued reports: you see them in “My issued reports”, on the user card, and from there you can void any of them by confirming with your password and choosing the reason. Voiding cannot be undone: anyone who verifies that code will see that it was voided, who did it (you or Mecanius) and why, and we notify you by email.
- The record of your issued reports is permanent, so that a code or a QR code never stops being verifiable: it is kept in a separate database, apart from the projects, with a backup copy in a second location, and it is kept even after you close your account. Your data stay in it while the report is valid, because there is always an engineer behind a report. To withdraw them from one, you void it and check “Also withdraw my data from this report”: your personal data (your name, that of your company, your license number, your institution and the names of your cases) are withdrawn and the verification will keep saying that it is voided, its date, its document and revision and its values. When you close your account you can also withdraw them from your voided reports.
- Internal statistics: we also use that record for statistics that are always aggregated, such as at what times most reports are issued, how many reports there are per plan and which calculation types and materials are used most. They do not identify anyone.
5. Vysia AI, the Mecanius assistant
Vysia AI is Mecanius’s own assistant: it helps you set up each simulation in the best way. It runs on Mecanius servers and does not send your texts or your models to external services.
- What it does: it interprets what you write, in 49 languages, and turns it into loads, constraints and meshes that you review before calculating.
- It is not a generative AI: it does not invent texts or images; it proposes a load case.
- It learns only within your account:
- it learns from what you confirm or correct;
- that learning is yours and is not mixed with that of other users;
- it does not travel in .mecx files.
- You can make it forget everything it has learned with “Forget what it learned”, on the user card (“Your data” section) or in Preferences. What it learned and the history of your corrections are deleted.
6. Who we share them with
Only with the providers essential to provide the service. They act on behalf of Mecanius, under contract and with confidentiality and security obligations, and they may not use your data for anything else.
| Provider | Purpose | What it receives |
|---|---|---|
| Google (Google Cloud) | Hosting the service and making the calculations, when they are not made on the company’s own servers | What the service stores and calculates |
| Google (Google Workspace) | Sending Mecanius emails: activation links and links to change the password, and notices about your account and your issued reports | Your email address, your name and the notice or the link |
| Flow (Flow S.A., flow.cl) | Processing payments. Mecanius does not receive or store your card details | What is needed to charge |
| Cloudflare | The Mecanius website and its DNS: taking visits to the website and to the verification page to the Mecanius server and protecting them from attacks; and, once activated, keeping the backup copy of the record of issued reports | The IP address and the address requested by the visitor, in passing; and that record |
- Your institution or company: if your account is part of its Prime Plan, its administrators see your name, your email address, the status of your account and its end date, your last sign-in, how many calculations you made and the log of the changes to your account, and they can remove your account, set an end date for it or require the second factor. They never see your projects or the names of your models. If a report you issued under its license is voided, they also receive the notice by email, with your name, the document and the reason (never the report or its values).
- Emails: they are sent from soporte@mecanova.cl through Google Workspace, the company’s email, and carry only the notice or the link: never reports, models or problem reports.
- International transfers: if the data is hosted outside Chile, it is sent only to countries with an adequate level of protection, or with contractual safeguards, as required by Law No. 21,719. With Google and Cloudflare, their data processing agreements apply, with clauses that protect these transfers.
- Problem reports: they stay on Mecanius servers and are read only by the Mecanius staff who handle them; every reading is logged in the staff access log, with its reason. They are never sent by email or to third parties.
- Authorities: only when required by law and with an order from a competent authority. We will notify you when the law allows it.
- Sale or merger of Mecanius: the data is transferred with the same protections, and we will notify you beforehand.
7. How long we keep them
We keep each piece of data only as long as it serves the service or as the law requires. The periods that depend on the server are enforced by an automatic cleanup that runs every hour.
| Data | Period |
|---|---|
| Account | While it is active. If you close it, it can no longer be used to sign in, and the rest of its data is deleted 30 days after closure |
| Account of an institution or company | If its administrator removes it, or its end date arrives, it can no longer be used to sign in. Within the following 30 days, the administrator can add it back as it was; after that it is closed, and your valid issued reports can still be verified with your data: if you need to void any of them, do it before your end date (we notify you of it by email) or ask support. If the contract of the institution or company is suspended, none of its accounts can sign in, but nothing is deleted. If it expires, its accounts are kept for 12 months without being able to sign in: if it is renewed within that period, everything works again as before; after that they are closed, with a notice to its administrators 30 days before. The record of issued reports is always kept |
| Preferences | While your account exists; deleted with it |
| Second factor | While you keep it on; deleted when you turn it off and with your account |
| Projects: models, cases, meshes, results and their report | Only while you are working on them: they are deleted from the server when you leave with “Sign out” or after 24 hours without use (never while a calculation is in progress), and immediately if you close your account. They remain in your .mecx files. What an earlier version of the program left saved on the server is not deleted automatically: it stays until you save it on your computer or delete it, from Home |
| Custom materials and their libraries, with their laboratory curves | Until you delete them. If you close your account, they are deleted immediately |
| Report formats (“My format”) | Until you delete them. If you close your account, they are deleted immediately |
| Vysia AI’s learning and the history of your corrections | Until you ask it to forget. If you close your account, they are deleted immediately |
| Problem reports | 180 days after you send them. If you close your account, they are deleted immediately |
| Record of issued reports | With no time limit, also after you close your account, so that your reports can still be verified; your data stay while the report is valid. When you void a report you can withdraw them (and, when you close your account, from your voided reports): your name, that of your company, your license number, your institution and the names of your cases are deleted, and the record keeps saying that the report is voided. Once the account is deleted, the record is no longer linked to it |
| Log of the changes to your account of an institution or company | While your account exists; deleted with it. Your name is removed from the changes you made as an administrator |
| Acceptance of the Terms of Use and of this policy | While your account exists; deleted with it |
| Sessions, with their IP address, browser, when they were renewed and the failed sign-in notice they showed | 60 days after they expire or are closed |
| Calculations requested from the server and downloads of your data | 60 days after they finish |
| Failed sign-in and second-factor attempts, with the IP address, the email entered or the trusted device | 24 hours after the last attempt, except while they make sign-in wait |
| Date and type of device of the failed attempts with your email, to notify you | Until your next successful sign-in, when they move to the record of that session. If you do not sign in again, 60 days after the attempt |
| Activation links and links to change the password | Deleted when used or when they expire |
| Log of staff access to your account | While your account exists; deleted with it |
| Server backups | Made every day, and each one is kept for 14 days: whatever is deleted from the server disappears from them when they expire |
| Server technical logs, without the IP address of each request | Rotated automatically by size: only the most recent ones are kept |
| Billing data | The period required by tax law |
8. Security
We protect your data with these measures:
- Passwords: stored only as a hash (scrypt). No one can read them, not even Mecanius.
- Second factor: in addition to the password, a 6-digit code that changes every 30 seconds, from an authenticator app on your mobile phone. It is mandatory for administrator accounts and optional for the others; your institution or company may require it. If you lose your phone, you sign in with one of your backup codes, each of which works only once; if you do not have them either, Mecanius removes it only after verifying that it is you, and this is recorded in the staff access log, with its reason.
- Encrypted connection (HTTPS) in the cloud service.
- Sessions:
- they end when the program or the browser is closed and expire after 12 hours. A few minutes before, the program warns you and offers “Stay signed in”, which extends the session for another 12 hours from that moment, never beyond 24 hours from sign-in; after that you must sign in again with your password. In the cloud service they also expire after 2 hours of inactivity;
- there is a maximum of 2 per account;
- they are protected against forged requests.
- Sign-in:
- from the first failed attempt we tell you how many remain before a wait; from the third on, each failed attempt makes you wait longer, up to 15 minutes at most, and sign-in is never blocked permanently;
- failed attempts from other devices do not make anyone who signs in from a trusted device wait;
- when you sign in, we notify you of the failed attempts with your email since your last sign-in;
- with an email that has no account, the response is the same and takes the same time, so as not to reveal which emails are registered;
- “Forgot your password?” sends a single-use link to the account’s email address to choose a new password, which also lifts the sign-in wait.
- Calculations: each calculation runs separately, and the computer that makes it deletes its files when it finishes; computers that calculate from another location receive only the data of that calculation, over an encrypted connection.
- Signed results, to detect whether a file was modified.
- Restricted and logged internal access: whenever staff read or change an account’s data with the administration tools, it is logged, with its reason. Viewing the list of accounts or how much space each one takes up, without opening its content, is not recorded in that log.
If a breach affecting your data occurs, we will report it without delay to the Personal Data Protection Agency (Agencia de Protección de Datos Personales) and, where applicable, to you, as required by law.
9. Your rights and how to exercise them
You can request access to, rectification, erasure, portability and blocking of your data, and object to its processing, as recognized by Law No. 21,719.
- From your account: on the user card (opened with the circle with your initials, in the header), “Your data” section, you can:
- download your data, with “Download my data”;
- make Vysia AI forget what it learned, with “Forget what it learned”;
- close your account, with “Close my account”. Whatever remains of your projects on the server (models, calculations and cases), your custom materials and their libraries, your report formats, your problem reports, what Vysia AI learned and your photo are deleted immediately, and the rest of the account data 30 days later. When you close it, you choose whether to withdraw your personal data from the record of your voided reports; those of your valid reports are kept (section 4).
- For anything else, for example correcting your data or objecting to processing, write to soporte@mecanova.cl. We respond within the legal period of 30 calendar days.
- Portability: “Download my data” provides a .zip file with your account data in a structured format (JSON) and, in .mecx format, the projects the server has at that moment. Your saved projects are already in your .mecx files.
- Complaints: if you are not satisfied, you can file a complaint with the Chilean Personal Data Protection Agency.
- Users in the European Union and in Brazil: they have the same rights and the others granted to them by the GDPR and the LGPD, and they can file a complaint with the authority of their country. If applicable, Mecanius will appoint a representative in the European Union.
10. Cookies and local storage
We use only what is necessary for the service to work. We do not use advertising, analytics or third-party cookies or storage. Everything described here is set by Mecanius itself, and only the cookies travel to the server: the two session cookies and the trusted device cookie.
Cookies. Set by the server:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeping you signed in. It contains only a random identifier; the server stores its hash, not the identifier | Until the browser or the program is closed. The session expires earlier on the server: after 12 hours (up to 24 hours from sign-in if you renew it with “Stay signed in”), after a period of inactivity in the cloud service, or one minute after the last tab is closed |
| Session protection cookie | Protecting against forged requests from other sites | Same as the previous one |
| Trusted device cookie | Recognizing that you have already signed in successfully to your account from this device, so that failed attempts from other devices do not make you wait. It gives no access: the password is still required. For each account that signed in from that device (up to 5) it holds a random identifier, a hash of the account that does not contain its email or its identifier, and the date; it is signed by the server so that it cannot be forged | 180 days from the last successful sign-in from that device. Signing out does not delete it |
When you sign out or close your account, the server invalidates the session immediately and deletes both session cookies.
Browser local storage. Stays on your computer. What is used in a project (its report or its unit system) is also stored with that project, as described in section 2:
| What is stored | Purpose | Duration |
|---|---|---|
| Your language and the one you chose when installing the desktop program | Showing Mecanius in your language. The installer’s choice is applied only once | Until you delete it |
| Screen and results viewer preferences, such as the width of the left panel, which labels are shown and their size, and the thickness with which beams are drawn | Keeping the screen the way you left it | Until you delete it |
| The color palette of the results and a copy of your preferences: a general palette and, for each account that signs in from that browser, a copy of its preferences, including its palette and its unit system | Remembering what you chose and showing the screen the way you left it while your account’s preferences arrive; those are stored on the server and are the ones that count. Each account’s entries are stored with a hash of the account: 16 characters calculated from its internal identifier, which do not contain its email, its name or that identifier | Until you delete them or close the account from that browser |
| Your company details for the report, for each account: its name, its logo and the names of the people who prepare, check and approve the report | Proposing them in that account’s next report. They are stored with the account’s hash | Until you delete them or close the account from that browser |
| What you have written in each project’s report: title, client, signatories, date, revision, code, material, sections, texts and figure captions. It does not store scanned signatures or figure images | Remembering what you have written in each project’s report, even if the page is closed before it is stored with the project | Until you delete it. When the account is closed from that browser, the entries of its saved projects are deleted |
| A mark for each project you have not saved yet | Deleting from the server a project that was never saved if its window was closed without warning | Until the project is saved or deleted |
| The open Mecanius tabs | Knowing when the last one is closed, in order to end the session | A few seconds after each tab is closed |
| The time of the last renewal of the session with “Stay signed in” | Letting the other open tabs know that the session was renewed so that they do not show the notice | Until you delete it. It is overwritten at each renewal |
| The failed sign-in notice you have already seen: an identifier of the session in which it was shown and how many attempts it reported | Showing it only once per session | Until you delete it. It is overwritten with each notice |
Tab storage. Deleted when the tab is closed:
| What is stored | Purpose | Duration |
|---|---|---|
| An identifier of the window | Distinguishing this window from the others | Until the tab is closed |
| The open project, when changing the language | Reopening it after the change | Until the tab is closed |
| Your account’s language, when it is applied on sign-in | Switching the page to that language only once per tab | Until the tab is closed |
| The chosen 3D background | Remembering it during the session | Until the tab or the session is closed |
Browser database. It stores the Home list of that computer, separated by account (each account sees only its own): for each project you opened or saved on it, its name, the names of its file and its model, how many cases and calculations it has, its dates and its image. It stays until you remove the project from Home (the file stays on your computer) or close the account from that browser. In addition, so that “Save” writes again to the same .mecx file on your computer and so that it can be opened again from Home, it stores for each project the file identifier provided by the browser (the file name and the permission to write to it), only in Edge, Chrome and the desktop program, until you delete it.
All of the above is deleted with the browser’s tools (“clear site data”).
In the desktop program (Windows), all of the above is kept in the Mecanius folder within the Windows application data (%APPDATA%), together with:
- the program settings: the chosen server (Mecanius Cloud or a Mecanius Dedicated Server), the local server folder, the window position and the title bar colors, without any account data;
- the list of the projects you opened or saved with the program, for Home: the path of each file, the server it was used with and the date, without any account data;
- the program log (in the logs subfolder): connection, errors and server addresses. It is emptied when it exceeds 1 MB and does not record cookies or passwords.
The session cookies are stored encrypted, and the program deletes them when it closes and when it opens. The folder is kept when the program is uninstalled, so that your preferences are not lost; you can delete it whenever you want.
If the website adds analytics, it will ask for your prior consent.
11. Minors, changes and effective date
- Minors: the service is professional, for people aged 18 or over. We do not knowingly collect data from minors.
- Changes: important changes require a new acceptance.
- Effective date: this policy is effective from the date of its version, shown at the beginning.