Privacy policy

Data controller

The data controller is the site publisher, identified in the legal notice. For any question about your data, use the contact address given there.

What we collect

We collect only what running the platform requires:

• Account: email address, display name, and a hash of your password. Your password is never stored in clear text.
• Sessions: creation and expiry times, IP address and user agent, so you can recognise and revoke a session you did not start.
• Learning: lessons viewed and completed, time spent, quiz and lab attempts, bookmarks, personal notes.
• Preferences: language, theme, time zone.
• Consent: which categories you accepted or refused, the policy version, the date, and a hash of your IP address.

Legal bases

Performance of the contract covers your account and your progress: without them the platform cannot provide the service you signed up for.

Legitimate interest covers security logging and abuse prevention, including limiting repeated sign-in attempts.

Consent covers optional cookies. You can withdraw it at any time without losing access to the service.

Retention

• Account and progress: kept while the account exists, then erased after the 30-day grace period following a deletion request.
• Sessions: removed on expiry, on sign-out, or on password reset.
• Verification and reset tokens: one hour.
• Export archives: downloadable for seven days, then destroyed.
• Consent records: retained beyond account deletion where demonstrating consent requires it.
• Administrative audit log: retained after the actor's account is deleted, with their identifier detached.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. Exporting your data and deleting your account are available directly from your account area.

You may lodge a complaint with your supervisory authority — in France, the CNIL — if you believe the processing does not comply.

Processors and transfers

The hosting provider is identified in the legal notice. No data is transferred outside the European Union in the configuration described here. Were that to change, this policy would be updated and your consent sought where the law requires it.

Security

Passwords are hashed. IP addresses kept for security purposes are stored as a keyed hash rather than in clear text. Traffic is encrypted with HTTPS.