Privacy Policy

Josselin DOUINEAU, sole trader (SIRET 98108366000028), 9bis Kerscoul, 22540 Louargat, France — josselin.douineau.1987@gmail.com — is the controller responsible for personal data collected on this site.

Booking and payment for a session: name, email address, phone number. Legal basis: performance of the contract formed with you at booking (article 6(1)(b) GDPR).

Documents you send us to prepare for a session (where applicable): used solely for that session. Legal basis: performance of the contract (article 6(1)(b) GDPR).

Follow-up email sent when a pack of sessions is finished with no new booking. Legal basis: legitimate interest (article 6(1)(f) GDPR) — marketing follow-up to an existing client, under the CNIL "soft opt-in" exception. You can opt out of this follow-up at any time (right to object, article 21 GDPR) via the one-click unsubscribe link included on every email, with no need to justify it.

Stripe (payment processing), Resend (transactional and follow-up email delivery), Google Calendar (session scheduling and video-call link creation), Neon (database hosting, located in the European Union), and Sentry (technical error monitoring, hosted in the European Union, with personal data removed before transmission) have access to some or all of your data, strictly to the extent needed to provide these services (data minimisation principle, article 5(1)(c) GDPR). Two further providers receive strictly limited data, for technical protection purposes only: Upstash (request rate limiting — your IP address, and your email address when you request a login link, kept for one hour at most) and Cloudflare (anti-bot protection of the contact form, which receives your IP address).

In accordance with article 28 of the GDPR, each of these sub-processors is bound by a Data Processing Agreement (DPA) guaranteeing a level of data protection equivalent to that required by the GDPR.

The site itself is hosted by Vercel Inc. in the United States (see the "Hosting" section of the legal notice): data passing through the site may therefore be transferred outside the European Union, under the European Commission's standard contractual clauses and/or the EU-US Data Privacy Framework.

The security of your data relies on appropriate technical and organisational measures (article 32 GDPR): encrypted connections to the site (HTTPS/TLS), a database hosted in the European Union with restricted access, and payment data processed exclusively by Stripe (PCI-DSS compliant) — the site never has access to your full card number, only to limited transaction information (such as the last 4 digits and card type) needed to reconcile payments. Each sub-processor is also bound by a data processing agreement (see "Data recipients"), and only strictly necessary data is collected.

In accordance with the storage limitation principle (article 5(1)(e) GDPR), an unfinished booking (abandoned payment) is automatically deleted after about 1 hour. Once confirmed, your contact details and lesson information are kept for 3 years from your last session, then automatically deleted; any document you send us to prepare for a session is deleted after 1 year. The records required to meet our accounting and tax obligations (proof of payment) are, however, kept for the applicable legally-required retention period, in accordance with article 17(3)(b) GDPR.

Even after an erasure request, we keep your email address on file — the same way we already do for the follow-up-email unsubscribe list — solely to the extent necessary to prevent repeated use of the one-time "free discovery session" offer. Legal basis: legitimate interest (article 6(1)(f) GDPR).

Under GDPR, you have a right of access (article 15), rectification (article 16), erasure (article 17), restriction of processing (article 18), objection (article 21), and data portability (article 20) over your personal data. This site is operated from France and is therefore subject to GDPR regardless of where you are booking from; if your own country of residence has a data protection law with international reach, you may also benefit from rights under that law.

On an access or portability request, you receive a copy of your data as a JSON file — a structured, commonly used, machine-readable format (article 20 GDPR) — covering your contact details, your bookings and sessions, your acceptance of the terms of sale, and any session still owed to you. The file also states the purposes, recipients and retention periods that apply. Such a request is answered within one month (article 12(3) GDPR).

You can view your bookings at any time via the magic link sent from the My Bookings page, opt out of marketing follow-ups via the unsubscribe link included in every follow-up email, or exercise any other right by writing to josselin.douineau.1987@gmail.com.

You also have the right to lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr (article 77 GDPR).

This site only uses technical storage required for it to function (theme, telephone number country format, and regular teacher preference — kept in the browser's local storage). No audience-measurement, advertising, or tracking cookie is used.

On the interactive practice pages, your quiz progress (current question and answers) is kept in session storage (sessionStorage) solely so you can resume where you left off; it is automatically cleared when you close the tab or end your session. This storage is technical and involves no tracking and no consent.

No consent banner is therefore shown: GDPR and the CNIL's "cookies" rules only require consent for non-essential cookies (audience measurement, advertising), which is not the case here.

For any question regarding this privacy policy or your personal data, you can contact us at josselin.douineau.1987@gmail.com or by phone at +33 6 25 45 01 76.