Privacy Policy
This policy describes how AL Technologies ("we", "the publisher") collects, processes and protects your personal data in connection with the Immersio service, in accordance with Regulation (EU) 2016/679 (GDPR) and the amended Data Protection Act.
1. Data Controller
AL Technologies, 50 avenue des Champs-Élysées, 75008 Paris — SIRET 982 128 720 00017.
Contact for any data protection questions: privacy@altechnologies.fr.
2. Data Collected and Purposes
| Purpose | Data | Legal Basis |
|---|---|---|
| Account creation and management | Email, first name, last name, password (hashed), registration date | Contract performance (art. 6.1.b GDPR) |
| Subscription and billing management | Subscribed plan, Stripe identifiers (customer, subscription), payment history | Contract performance |
| Tracking learning progress | Scenarios accessed, scores, certificates, gauges, choices made | Contract performance |
| Authentication and security | Session token (JWT), IP address at connection time, technical logs | Legitimate interest (service security) |
| Service communications | Email, identity, events (OTP, confirmation, expiration, certificate) | Contract performance |
| Anonymous audience measurement | Pages visited, duration, browser (anonymized) | Consent (art. 6.1.a) |
| Responding to GDPR requests | Contact email, request content, transmission log | Legal obligation (art. 6.1.c) |
3. Retention Periods
- Active user account: as long as the account is not deleted.
- Closed and inactive account: retained for 90 days after termination, with monthly email reminders to allow invoice and certificate recovery. Complete deletion thereafter.
- Billing data: 10 years from the end of the financial year (accounting legal obligation).
- Technical connection logs: 12 months (CNIL recommendation).
- Cookie consent proofs: 5 years from collection (CNIL recommendation).
- Audience measurement cookies: 13 months maximum.
4. Recipients and Sub-processors
Your data is never sold or transferred to third parties. It may be processed by the following sub-processors, selected for their security standards and bound by processing agreements (DPA):
| Sub-processor | Service | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, S3 storage, email sending (SES) | Ireland (EU) |
| Stripe Payments Europe Ltd | Card payments, subscription management | Ireland (EU), processing in the United States with Standard Contractual Clauses |
| Anthropic PBC | AI content generation (Claude) | United States, Standard Contractual Clauses |
| Google LLC | Image generation (Imagen) | United States, Standard Contractual Clauses |
5. Transfers Outside the European Union
When data is transferred outside the EU (Stripe, Anthropic, Google), such transfer is governed by the Standard Contractual Clauses of the European Commission (decision 2021/914), ensuring a level of protection equivalent to GDPR.
6. Security
Data is stored on servers located in the European Union (AWS Ireland region). Access to the service is encrypted (TLS/HTTPS), passwords are stored as cryptographic hashes, session tokens are signed and time-limited. Backups are encrypted at rest (AES-256).
7. Your Rights
In accordance with articles 15 to 22 of the GDPR, you have the following rights regarding your data:
- Right of access: obtain a copy of data concerning you.
- Right of rectification: correct inaccurate data.
- Right to erasure ("right to be forgotten"): request deletion of your account.
- Right to data portability: receive your data in a structured and readable format.
- Right to object: object to processing based on legitimate interest.
- Right to restrict processing: temporarily freeze processing.
- Right to establish post-mortem directives on the fate of your data.
- Right to withdraw consent at any time, when processing is based on consent.
To exercise these rights, write to privacy@altechnologies.fr or use the dedicated options in your personal space. You will receive a response within a maximum of one month.
8. Complaint to CNIL
If you believe, after contacting us, that your rights are not being respected, you may lodge a complaint with the National Commission for Computing and Freedoms (CNIL):
- 3 place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
- Phone: 01 53 73 22 22
- Website: www.cnil.fr
9. Cookies and Tracers
The use of cookies and tracers on Immersio is detailed in the Cookies Policy. You can modify your preferences at any time from your personal space.
10. Updates
This policy may be subject to changes. Any material modification will be notified to you by email and will be reflected in an updated date at the top of the page.