Privacy Policy

Account data: first name, last name, email address, hashed password, language, country (optional), and Google ID if you sign in with Google.

Payment data: cardholder name, billing address, card fingerprint and last four digits, and transaction history. Full card numbers never pass through our servers and are stored exclusively by Stripe.

Usage data: course progress, exercise answers, saved vocabulary, journal entries, assessed level, and your settings for conversations with Jean (including feminine or masculine agreement, if you choose one).

Voice data: audio recordings and transcripts when you use pronunciation exercises or speak with Jean.

Technical data: IP address, device type, browser, pages viewed, UTM parameters, error logs, and a device identifier used to prevent free-trial fraud.

Level assessment without an account: if you take the level assessment without signing in, we create a temporary account with no email address, linked to your browser. It is used to save your answers, your pronunciation recording and your conversation with Jean, and to show you your recap. To limit abuse of the free assessment, we keep with this account a hashed identifier of your IP address and of your device, along with the country inferred from your IP address and the site language. This account becomes your account if you buy a course with an email address that does not have an account with us yet. If you ask to receive your corrections by email, we store that address, and your temporary account becomes your account when you click the link you receive; if that address already has an account with us, your recap moves to that account only when you sign in on the browser where you took the assessment. If you sign in afterwards on the same browser, your recap moves to your account and the temporary account is deleted. If, during the assessment, you ask to receive a link to resume it later, where you left off and on any device, we store, without creating an account, your email address, the site language, the answers you have already given (encrypted) and, to limit abuse, a hashed identifier of your IP address; we email you this link right away, then send a single reminder about 24 hours later if you have not resumed or finished the assessment, and this reminder includes an unsubscribe link.

Data required to perform the contract, including your email address, identity, and payment information, is mandatory. Other data is optional.

Performance of a contract (Article 6(1)(b) GDPR): account management, course access, progress tracking, payments, invoices, transactional emails, and support, as well as the free level assessment, with or without an account (pre-contractual steps taken at your request).

Legitimate interests (Article 6(1)(f)): improving the Services, internal audience measurement without third-party cookies, fraud prevention, limiting abuse of the free level assessment, and security.

Consent (Article 6(1)(a)): nonessential cookies, newsletters, and voice recording and processing. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Legal obligations (Article 6(1)(c)): retaining invoices for 10 years as required by the French Commercial Code and responding to requests from public authorities.

Some features rely on service providers specializing in artificial intelligence, which process your voice, transcripts of what you say, and your written answers. When you speak with Jean, the voice assistant, your voice is transcribed, then Jean's reply is generated and read aloud. In pronunciation and dictation exercises, your recording is analyzed or transcribed, depending on the exercise, to give you feedback on your pronunciation or your answer. Your spoken answers in role-plays and other speaking exercises are transcribed. These providers also generate written feedback, learning recaps, and conversation-table reports.

The transcript of your conversations with Jean is encrypted, as are the personal notes that let Jean remember you from one session to the next. The audio recording and transcript of these conversations are kept so that members can listen to them again, then deleted automatically. Recordings from pronunciation and dictation exercises are not kept after they are analyzed, except the recording of the first sentence you read in the level assessment and your new readings of it 30 and 90 days later, which are kept encrypted to compare your pronunciation. If you are a member and record a starting sentence from your progress page, that recording and its new readings are kept encrypted in the same way, until 365 days of account inactivity or until you delete your account. Your learning recap and the mistakes to review also remain attached to your account. The “Retention Periods” section states how long each of these is kept.

During conversation tables between learners, your microphone is recorded with your consent: this recording is transcribed, then used to write the reports. When the conversation slows down, Jean may also use the table's last few minutes to suggest a question; nothing is kept. The other participants at the table see the first name you choose to display, the flag you chose to add next to it, and the conversation transcript; your personal corrections are visible only to you. We suggest a flag based on your billing country, but it is shown to others only if you choose it. The HelloFrench team may view conversation transcripts and their automated analysis for two reasons only: handling a report, and improving the conversation tables feature. Only authorized people at BEPITE SAS have access. Outside of a report, it is never used to judge a learner, and no excerpt is published without your consent. For improving the tables, it is based on our legitimate interest: you can object at any time by writing to us, without losing access to the tables.

If you write in the table chat, your messages are kept with the table for 12 months for moderation, and an AI service reads your own messages to suggest a correction that only you can see. The “I’m looking for a word” feature sends the word you type to an AI service without storing it. You can star learners you have shared a table with: this list of favorites stays private, the learner is never told, and it is used only to let you know when a favorite signs up for a session and to seat you at the same table when possible. It is deleted along with your account, and you can remove a favorite at any time.

None of this processing produces a decision with legal or similarly significant effects concerning you within the meaning of Article 22 GDPR. You may stop using voice and AI features at any time.

After some conversations with Jean, you can rate the conversation from 1 to 5. If you give it a 1 or 2, you can also briefly describe what went wrong (500 characters at most). This rating and comment are stored with the conversation session, are used only to improve Jean, and are kept for as long as the conversation itself (see “Retention Periods”).

- Account data: if you have never made a purchase, your account is deleted 3 years after your last login. If you have purchased a course, your account is kept, along with your access and your progress, until you delete it yourself. - Invoices and accounting data: 10 years (Article L123-22 of the French Commercial Code). - Voice recordings from pronunciation and dictation exercises: only for as long as it takes to analyze them. - Recording of the first sentence you read in the level assessment: it is encrypted and used to compare your pronunciation when you read the same sentence again 30 and then 90 days later (these new readings are kept the same way). For visitors who are not members, it is deleted after 30 days; for members, it is kept until 365 days of account inactivity, or until you delete your account. - Audio recording and transcript of conversations with Jean, including the level assessment: 12 months, so that members can listen to their conversations again, then deleted automatically, or sooner if you delete your account. - Conversations with Jean (members): the conversation transcript and the word-for-word quotes in learning recaps are kept for a rolling 12 months, for learning purposes: reviewing past mistakes, revisiting suggested rephrasings, and tracking your progress. They are then deleted automatically. Jean's memory (factual notes, encrypted), the personalized content derived from it, and the mistakes to review are deleted after 365 days of account inactivity; recaps (summary and advice, without quotes) are kept for the life of the account. - Level-assessment conversation: for members, the word-for-word transcript and the quotes in the recap are kept for a rolling 12 months, like their other conversations with Jean. For visitors who are not members, the transcript is deleted from our systems after 3 days and the quotes after 30 days. - Temporary level-assessment account (assessment taken without signing in): deleted automatically, with all its data, 30 days after it was created, unless it became your account when you made a purchase or through the link in your corrections email. The request to email your corrections (your address and the link we sent) is deleted after the same 30 days. If you asked for a link to resume the assessment, your address, your answers, the hashed identifier of your IP address and the scheduled emails are deleted automatically 30 days after your request, and the link no longer works after that. If you sign in on the same browser before then, your recap and the recording of your first sentence move to your account, and the temporary account is deleted right away. This deletion includes the hashed identifiers of your IP address and device, as well as the recording and transcript of the conversation with Jean. If the account becomes yours, these identifiers are still erased 30 days after it was created. As for other visitors, the word-for-word transcript of the conversation is deleted after 3 days, and the recording of your first sentence after 30 days. - Conversation tables between learners: the audio recording of your microphone is used only to prepare the reports and is deleted as soon as they are ready, no later than 48 hours after the table. The transcript, the reports and any misconduct reports are kept for a rolling 12 months, then deleted automatically. - Coaching request with Elisabeth: your answers to the form and, if you record one, your one-minute spoken introduction are sent by email to the HelloFrench team so we can review your request. They are kept for 12 months at most, then deleted. - Comparison transcripts between two transcription services (test ended on October 11, 2026): kept encrypted, then deleted after 30 days. - Other transcripts (pronunciation and dictation exercises): for the life of the account. - Technical logs: 30 to 90 days. - Audience-measurement cookies: up to 13 months, in line with CNIL recommendations. - Newsletter data: until you withdraw your consent or 3 years after our last contact.

- Anti-fraud identifier after account deletion: after your account is deleted, we retain a limited technical identifier derived from your email address solely to prevent fraud and abuse of free trials. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. We retain this identifier only for as long as necessary for that purpose.

After these periods, the data is deleted or irreversibly anonymized.

We use cookies that are strictly necessary for the site to work: sessions, authentication, checkout, language, and free-trial fraud prevention. They do not require your consent.

If you take the level assessment without signing in, a technical cookie, valid for 30 days, links your temporary account to your browser so that we can give you back your recap if you sign in afterwards. It is one of the strictly necessary cookies.

Only with your consent, we also use audience-measurement cookies (Google Analytics 4 and, for signed-in members, Microsoft Clarity heatmaps and session recordings, with personal content masked) and advertising cookies (Google Ads, including sending your email address in hashed, unreadable form to measure sign-ups and purchases). Until you make a choice, Google sets no cookies and receives only technical signals without identifiers.

A banner asks for your choice on your first visit. Signed-in members see it on their dashboard or course home page, never during an exercise. You can change your choice or withdraw your consent at any time with the “Cookie settings” link at the bottom of the site's pages and in your profile.

We also measure, ourselves and without third-party cookies, the pages visited and where visits come from (UTM parameters) to improve the site; the identifier used for this is renewed after 13 months. An ad click identifier (gclid) is kept only if you consent to advertising.

Embedded content: videos on our presentation pages are hosted by a specialized video service; YouTube videos on the worksheets load only when you start playback; the playlist included with The France Travel Kit is embedded from Spotify. Our hosting provider measures the technical performance of pages, without cookies.

Your data is available to authorized BEPITE SAS personnel and to our service providers. Each provider is bound by an agreement that complies with Article 28 GDPR. They fall into the following categories:

- Payments: Stripe - https://stripe.com/privacy - Hosting, database, authentication, and file storage - Content delivery, bot protection, and audio and video relay for conversation tables - Email delivery (newsletters, follow-up emails, and account emails) - Invoicing - Artificial intelligence (voice conversations, transcription, speech synthesis, feedback and learning recaps, pronunciation scoring) - Sign-in with Google - Audience measurement and advertising, only with your consent (see “Cookies”) - Technical error monitoring

The up-to-date list of our service providers is available on request at boutique@hellofrench.com.

We do not sell your data or share it with commercial partners for marketing purposes.

Some service providers are located outside the European Union, primarily in the United States. These transfers are protected by the safeguards set out in Chapter V of the GDPR: the EU-U.S. Data Privacy Framework (adequacy decision 2023/1795) when the provider is certified, or otherwise the Standard Contractual Clauses (decision 2021/914).

You may request a copy of these safeguards by emailing boutique@hellofrench.com.

We use appropriate technical and organizational safeguards. Data exchanged with our services is encrypted, as are the transcripts of your conversations with Jean, the personal notes Jean keeps, and your personalized learning content. Passwords are hashed, access to data is strictly controlled in our database and limited to authorized personnel, and our regular backups are encrypted. Conversation data is kept to a minimum and deleted automatically, and each service provider is bound by a data processing agreement.

If a data breach is likely to create a risk to your rights and freedoms, we will notify the CNIL within 72 hours under Article 33 GDPR and, where required, notify you directly under Article 34.

Under the GDPR, you have the following rights: access (Article 15), correction (Article 16), deletion (Article 17), restriction of processing (Article 18), data portability (Article 20), objection (Article 21), withdrawal of consent at any time (Article 7), and the right to provide instructions regarding your data after death under Article 85 of the French Data Protection Act.

To exercise these rights, email boutique@hellofrench.com. We will respond within one month as required by Article 12(3) GDPR. You can also manage your email address, password, newsletter subscription, and account deletion directly from your profile.

When you delete your account from your profile, we delete your account, progress, conversations, and voice recordings, and unsubscribe you from all mailing lists. We retain only the invoices that we are legally required to keep (see “Retention Periods”) and the anti-fraud identifier described above. Account deletion is permanent and irreversible. If you have an active paid subscription, you may choose either to stop renewal only or to delete your account immediately and give up the remaining access without a refund.

If you believe your rights have not been respected, you may file a complaint with the CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, https://www.cnil.fr.

BEPITE SAS, 14 Rue Ernest Psichari, 75007 Paris, France. Email: boutique@hellofrench.com.

Effective date: January 26, 2023. Last updated: November 11, 2026.