Privacy policy

1. Controller

The controller is Mr Brandonn Etheve, sole trader — Equarith, 8 Ruelle Boulot, 97400 Saint-Denis, Réunion, France (SIREN 943 191 031).

For questions or to exercise a right, email legal@equarith.com. For ordinary support, email contact@equarith.com.

Equarith has not appointed a data protection officer because the processing described in this policy does not require one. The contact above remains directly available.

2. Local-first principle

The symbolic-regression software is designed to process datasets, projects, variables, formulae, results and checkpoints locally on the user's device. They are not uploaded to Equarith to run a search. The Free edition does not contact the activation API.

Equarith receives project data only if a user chooses to attach or paste it into a support request. Users should anonymise files first. A support file is used only to handle the request and is deleted no later than 30 days after closure, unless evidence, a legal obligation or a justified contrary request requires otherwise.

3. Data, purposes and legal grounds

Website delivery and security

The server may process the IP address, date and time, requested URL, response code, referrer, browser type and technical security data. This is used to deliver the website, detect abuse, enforce rate limits, investigate incidents and preserve evidence. The legal ground is Equarith's legitimate interest in operating and securing the service. Ordinary logs are retained for no longer than 12 months, except extracts needed for an incident or legal claim.

Customer account and authentication

Equarith processes the email address, optional first and last name, organisation, language, account status and associated subscriptions, licences and invoices. A one-time login code is stored as a hash, expires after 10 minutes and its technical record is deleted within 90 days. Processing is necessary to perform the contract and secure the account.

Orders, payment and invoicing

Equarith processes identity and billing details, offer, seat count, expected and final price, currency, order references, payment, refund and subscription status, the accepted terms version, consent timestamps and, for a perpetual licence, the version-entitlement mode and the “new versions included through” instant. Equarith does not receive the full card number.

The legal ground is taking pre-contractual steps and performing the contract. Invoices and accounting documents are kept for 10 years to meet legal duties. Contract records and proof of acceptance are kept throughout the relationship and for 5 years afterwards. An unsuccessful order attempt is erased or anonymised within 13 months unless documented fraud prevention requires otherwise.

Licensing and activation

For a paid edition, activation processes the protected licence key, internal references, a cryptographic installation and machine binding, the chosen device name, application version, installation public key, activation/deactivation dates and signed certificates. A raw hardware identifier is not sent. This provides the licence, enforces seat counts and enables deactivation or certificate renewal. The grounds are performance of the EULA and the legitimate interest in preventing abusive key sharing. Records are kept for the licence term and 5 years afterwards for proof and dispute resolution.

Contact and support

The form processes name, email, optional organisation, subject, message and language. The ground is the user's request, contractual support or the legitimate interest in replying. A prospect enquiry with no follow-up is kept for up to 3 years after the last exchange; a contract-related file follows the 5-year contract period. Messages may be kept longer where law or litigation requires it.

Application error reports

Automatic reports are enabled by default in the application and can be disabled. Before transmission they are encrypted and limited to protocol-schema version, Equarith version, platform, architecture, exception type and structured stack frames without a free-text message. They must not contain datasets, projects, formulae, results, checkpoints, files, paths, messages, logs, email addresses, keys or installation/licence identifiers.

The reverse proxy processes the IP address transiently for rate limiting; the application uses only an ephemeral salted fingerprint in memory on these routes. Aggregated errors are deleted 90 days after the last occurrence. The ground is the legitimate interest in fixing defects and securing the software. Users can object at any time by disabling reports in settings.

Audience measurement — Google Analytics

When Google Analytics is allowed by the technical configuration and the user separately consents to the “Audience measurement” purpose, Equarith uses it to measure visits, viewed pages, technical events, referrers and visit duration in order to improve the website. Google may then process a random identifier, the IP address to route the request and infer an approximate area, and browser and device information. The configuration excludes personalised advertising, Google Signals, advertising-service linking and the sending of an Equarith account identifier. Google Analytics is blocked on routes containing /account, /checkout, /contact or /admin; on other allowed pages, the page_location value sent is limited to the origin and path, without a query string or fragment. The legal ground is consent only. Event data in the property is retained for no longer than 14 months. If the tool is not allowed by the configuration or the user does not consent to this purpose, its script is not loaded and no measurement signal is sent to Google.

Session replay — BRDReplay

The current technical configuration allows BRDReplay/BRDlytics, served from analytics.brdtools.com, on public pages that are not excluded. The recorder is loaded only if the user separately consents to the “Session replay” purpose. Equarith then uses it to detect interface errors and navigation friction and improve website usability. Replay may process the full page URL, page title, viewport dimensions, a random session identifier, DOM mutations, clicks, pointer movements, scrolling, selections, errors and console messages, as well as technical events explicitly sent by the website. The IP address, User-Agent and referrer are also technically received with the HTTP request.

Before the recorder loads, the website marks the whole public page for text masking. The recorder also masks every input field; it does not capture canvas content, cross-origin iframe content or network-request bodies. Routes containing /account, /checkout, /contact or /admin are technically excluded. Any page whose URL has a non-empty query string is also excluded so that the recorder does not receive those parameters. It is not loaded on any of these pages, even if consent has been granted. The legal ground is consent only.

BRDReplay recordings are currently kept until manual deletion or, when the service storage quota is exceeded, until automatic eviction of the oldest sessions. The service applies no automatic maximum based on age. An erasure request may be sent to legal@equarith.com with information enabling the relevant session to be found.

4. Recipients and processors

Data is accessible only to the publisher and, as necessary for their tasks, these providers or bodies:

• OVH SAS, for hosting, network and email;
• Payment Hub infrastructure operated for Equarith at OVH, to orchestrate orders;
• Stripe Payments Europe, Ltd., for payments, fraud prevention and the billing portal;
• VosFactures, to issue and provide invoices;
• CM2C, the independent consumer mediator, only when a consumer refers a dispute or information must be supplied for mediation;
• Google Ireland Limited, only when Google Analytics is allowed by the technical configuration and enabled following audience-measurement consent;
• BRDReplay/BRDlytics infrastructure, a service operated for Equarith and hosted by OVH SAS in France, only following session-replay consent.

Data may also be disclosed to an authority or adviser when required by law or necessary to defend a right. It is not sold or rented.

5. Transfers outside the EEA

Primary hosting is provided by OVH. BRDReplay is hosted by OVH SAS in France. International providers, including Google when Google Analytics is technically allowed and enabled following consent, or Stripe, may involve entities or resources outside the European Economic Area. Where this occurs, the transfer relies on an applicable adequacy decision, the EU–US Data Privacy Framework for certified organisations, or the European Commission's standard contractual clauses with additional technical and organisational measures where needed.

Relevant safeguards may be requested from legal@equarith.com, subject to confidential information.

6. Cookies and sessions

The essential session cookie is described in the cookie policy. The preference manager presents the “Audience measurement” purpose with Google Analytics and the “Session replay” purpose with BRDReplay separately. Each optional tool is enabled only when it is allowed by the website’s technical configuration and the user has consented to its purpose; otherwise, its script is not loaded and it receives no data. Refusing or withdrawing either consent does not prevent access to essential features.

7. Automated decisions

Equarith does not make decisions producing legal or similarly significant effects about a person solely by automated processing. Mathematical outputs generated by the software follow user-selected parameters and are not profiling performed by the publisher.

8. Security

Measures in place include TLS encryption, hashed authentication secrets, encrypted stored licence keys, signed certificates, rate limiting, environment separation, backups, access controls and minimised sensitive logs. No system can provide absolute security. Report a vulnerability to legal@equarith.com.

9. Your rights

Subject to the GDPR and French data-protection law, individuals may request access, correction, erasure, restriction or portability; object to processing based on legitimate interests; withdraw consent at any time; and give instructions concerning data after death. Withdrawal does not affect prior lawful processing.

Send a request to legal@equarith.com with enough information to identify the relevant account or exchange. Identity evidence is requested only where there is reasonable doubt and is limited to what is necessary. Equarith normally responds within one month.

A complaint may be submitted to the French Data Protection Authority (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or to the competent authority where the individual lives or works.

10. Changes

This policy may change to reflect the product, providers or law. Equarith gives appropriate notice of any material change affecting ongoing processing. An earlier consent that did not cover a newly described optional tool does not authorise its activation.