Privacy Policy

1. Data controller

MENiAC Oy
Helsinki, Finland
Email: info@meniac.tech
VAT: FI33405864

For privacy-related requests, contact us at info@meniac.tech or via our contact form.

2. Personal data we collect

Depending on how you use the Services, we may process:

• Account data — email address, optional display name, password (stored as a one-way hash), account creation date, and internal account identifiers.
• Session and security data — login session tokens, session expiry, and when you log in: IP address and browser user-agent string (stored with the session record for security and abuse prevention).
• Purchase and billing data — product entitlements, subscription status, seat counts, trial dates, and Stripe customer identifiers. Payment card details are collected and processed by Stripe; we do not store full card numbers on our servers.
• Product usage data — for IonFrame: project names, editor content you save, thumbnails, and related metadata tied to your account. For MENiAC Air: license activation records (e.g. machine identifiers and activation timestamps) as required to enforce seat limits.
• Support and contact data — name, email, and message content when you contact us.
• Technical logs — standard web server logs (e.g. requested URLs, timestamps, IP address) maintained by our hosting provider for operation and security.

We do not currently use third-party analytics or advertising trackers on our websites. If that changes, we will update this policy and, where required, ask for consent before non-essential cookies are set.

3. Why we use your data and legal bases

Under the EU General Data Protection Regulation (GDPR), we rely on the following bases:

• Contract — to create and manage your MENiAC Account, provide purchased or trial access to IonFrame, MENiAC Air, and downloads, and process subscriptions.
• Legitimate interests — to keep the Services secure, prevent fraud and abuse, maintain session integrity, and improve reliability (balanced against your rights).
• Legal obligation — to meet accounting, tax, and other legal requirements where applicable.
• Consent — where we ask for it explicitly (for example, when you accept this Privacy Policy at registration or when optional marketing is introduced in the future).

4. Cookies and similar technologies

We use one essential cookie to keep you signed in across MENiAC sites on *.meniac.tech:

• meniac_session — authenticates your MENiAC Account session. It is HttpOnly, sent only over HTTPS, and scoped to .meniac.tech. Duration depends on session settings (typically up to several weeks while active). This cookie is strictly necessary for login and does not require consent under EU cookie rules.

Logging out clears the session cookie. You can also remove it through your browser settings, which will sign you out of the Services.

5. Processors and sharing

We share personal data only as needed to operate the Services:

• Stripe, Inc. — payment processing, subscriptions, billing portal, and receipts. Stripe acts as an independent controller/processor under its own privacy policy.
• Hosting and infrastructure providers — store website, account, and application data on our behalf under contractual safeguards.
• Email delivery — transactional messages (e.g. purchase confirmations) may pass through our host’s mail system or other providers we configure.

We do not sell personal data. We may disclose information if required by law or to protect our rights, users, or the public.

Some processors may process data outside the European Economic Area. Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

6. Retention

We keep personal data only as long as necessary for the purposes above, including:

• Account data — while your account exists and for a reasonable period after deletion to handle disputes, backups, and legal obligations.
• Sessions — until expiry, logout, or manual revocation; expired sessions are deleted periodically.
• IonFrame projects — while your account is active unless you delete projects or request account deletion.
• Billing records — as required by Finnish accounting and tax law (typically several years).
• Contact messages — as long as needed to respond and maintain a reasonable support history.

7. Your rights

If you are in the EU/EEA (or where similar laws apply), you may have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase data in certain circumstances;
• restrict or object to certain processing;
• data portability where applicable;
• withdraw consent at any time where processing is based on consent (without affecting prior lawful processing);
• lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

To exercise these rights, email info@meniac.tech. We may need to verify your identity before responding.

8. Security

We use technical and organizational measures appropriate to the risk, including HTTPS, hashed passwords, HttpOnly session cookies, and access controls on production systems. No method of transmission or storage is completely secure; please use a strong, unique password and keep your account credentials confidential.

9. Children

The Services are intended for professionals and businesses. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

10. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be communicated through the Services or by email where appropriate.

11. Contact

Questions about privacy: Contact MENiAC or info@meniac.tech.