Privacy Policy

1. Introduction

Connaiscience, publisher of the Edesio platform, is committed to protecting users' privacy and processing their personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

This privacy policy explains how we collect, use, and protect your personal data.

2. Data controller

The controller of personal data is:

• Legal name: Connaiscience
• SIREN: 444 415 327
• Address: 50 boulevard de la Courtille, 28000 Chartres, France
• Email: contact@edesio.ai

3. Data collected

We collect the following categories of data depending on the type of user:

3.1 For institutions

• Institution name
• Contact email address
• Password (encrypted)
• Login and usage data

3.2 For teachers

• First and last name
• Email address
• Password (encrypted)
• Uploaded teaching materials (courses, PDFs)
• Login and usage data

3.3 For students

• First name (or pseudonym chosen by the student)
• Email address (optional)
• Answers to educational questions
• Learning progress and statistics
• Chatbot interaction history

4. Purposes of processing

Your personal data is collected and processed for the following purposes:

• Account management: Creating and administering user accounts
• Service delivery: Operating the educational platform and AI chatbot
• Educational tracking: Analyzing student progress for teachers
• Service improvement: Optimizing the AI algorithm and user experience
• Communication: Sending service-related information (notifications, updates)
• Security: Protection against fraud and abusive use

5. Legal basis for processing

Our data processing is based on the following legal grounds:

• Performance of a contract: Providing the educational service
• Consent: For optional marketing communications
• Legitimate interest: Service improvement and security
• Legal obligation: Retaining certain data for tax purposes

6. Recipients of data

Your data may be shared with the following categories of recipients:

• Connaiscience staff: For administration and support
• Technical subprocessors: Hosting (Supabase, Replit), AI processing (OpenAI)
• Educational institutions: Access to data of affiliated teachers and students
• Teachers: Access only to their students' progress data

We never sell your personal data to third parties.

7. Transfers outside the EU

Some data may be processed by subprocessors located outside the European Union:

• OpenAI (United States): AI processing of content to generate educational questions
• Replit (United States): Application hosting

These transfers are framed by appropriate safeguards (standard contractual clauses, certifications) in accordance with GDPR requirements.

Database data is hosted by Supabase on servers located in the European Union.

8. Retention period

Your data is retained for the following periods:

• Account data: For the entire duration of service use, then 3 years after the last activity
• Teaching materials: For the duration of use, deleted upon the teacher's request
• Student progress data: For the current school year, archived for 1 year
• Chatbot history: Maximum 1 year
• Billing data: 10 years (legal obligation)

9. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Obtain a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data (“right to be forgotten”)
• Right to restriction: Restrict the processing of your data
• Right to data portability: Receive your data in a structured format
• Right to object: Object to the processing of your data
• Right to withdraw consent: At any time for processing based on consent

9.1 How to exercise your rights

To exercise your rights, send your request by email to contact@edesio.ai, specifying:

• Your first and last name
• Your login email address
• The right you wish to exercise
• A copy of an identity document (for access, rectification, or erasure requests)

We commit to responding to your request within one month of receipt. This period may be extended by two additional months for complex requests, in which case we will inform you.

If you encounter difficulties exercising your rights or disagree with how your data is processed, you have the right to lodge a complaint with the CNIL (French Data Protection Authority): www.cnil.fr or by mail to: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

10. Data security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction:

• Encryption of data in transit (HTTPS/TLS)
• Password encryption (hashing)
• Secure authentication
• Role-based access controls
• Regular data backups
• Access monitoring and logging

11. Protection of minors

Edesio may be used by minors in an educational context. We collect a minimum of personal data for students (first name or pseudonym). Collection of email addresses from minor students is optional and subject to authorization by legal guardians through the educational institution.

Institutions and teachers are responsible for informing legal guardians about the use of the platform.

12. Cookies

The Edesio platform uses only technical cookies essential to the operation of the service:

• Authentication cookies: Maintaining the user session
• Preference cookies: Saving settings (theme, language)

We do not use advertising cookies or third-party tracking.

13. Changes to this policy

We reserve the right to modify this privacy policy at any time. Changes will be published on this page with the update date. In the event of substantial changes, we will notify you by email or through a notification on the platform.

14. Contact

For any questions about this privacy policy or to exercise your rights, you can contact us:

• Email: contact@edesio.ai
• Address: Connaiscience, 50 boulevard de la Courtille, 28000 Chartres, France