Privacy Policy

Account data: first name, last name, email address, hashed password, language, country (optional), and Google ID if you sign in with Google.

Payment data: cardholder name, billing address, card fingerprint and last four digits, and transaction history. Full card numbers never pass through our servers and are stored exclusively by Stripe.

Usage data: course progress, exercise answers, saved vocabulary, journal entries, and assessed level.

Voice data: audio recordings and transcripts when you use pronunciation exercises or speak with Jean.

Technical data: IP address, device type, browser, pages viewed, UTM parameters, error logs, and a device identifier used to prevent free-trial fraud.

Data required to perform the contract, including your email address, identity, and payment information, is mandatory. Other data is optional.

Performance of a contract (Article 6(1)(b) GDPR): account management, course access, progress tracking, payments, invoices, transactional emails, and support.

Legitimate interests (Article 6(1)(f)): improving the Services, audience measurement, fraud prevention, and security.

Consent (Article 6(1)(a)): nonessential cookies, newsletters, and voice recording and processing. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Legal obligations (Article 6(1)(c)): retaining invoices for 10 years as required by the French Commercial Code and responding to requests from public authorities.

When you speak with Jean, the voice assistant, your voice is processed by ElevenLabs, which operates the conversational agent: transcribing your voice, generating the response, and synthesizing speech. When you use a pronunciation or dictation exercise, your recording is analyzed by Microsoft Azure Speech (pronunciation scoring) or transcribed by OpenAI (Whisper, GPT-4o Transcribe), depending on the exercise and audio format. Written feedback and learning recaps are generated by Anthropic (Claude), with OpenAI as a fallback in case of outage.

The content of your conversations with Jean is encrypted using AES-256-GCM. Raw audio recordings are not retained after processing. For members, the script of your conversations with Jean and the word-for-word quotes in their learning recaps are kept for a rolling 12 months for learning purposes (finding your past mistakes, reviewing the suggested rephrasings, tracking your progress), then deleted automatically; for members, the word-for-word transcript of the level-assessment conversation and the quotes in its recap follow the same rolling 12-month period; for visitors who take the assessment without becoming members, the transcript is deleted after 3 days and the quotes after 30 days. The learning recap, the mistakes to review, and a few factual notes that let Jean remember you between sessions remain attached to your account. These notes, the personalized content derived from them, and the mistakes to review are automatically deleted after 365 days of account inactivity.

Our agreements with these service providers prohibit them from using your data to train their models.

None of this processing produces a decision with legal or similarly significant effects concerning you within the meaning of Article 22 GDPR. You may stop using voice and AI features at any time.

- Account data: for the life of the account, then for 3 years after the last login. - Invoices and accounting data: 10 years (Article L123-22 of the French Commercial Code). - Voice recordings: temporarily retained for processing and delivery through your account, then deleted no later than when your account is deleted. - Conversations with Jean (members): the conversation script and the word-for-word quotes in learning recaps are kept for a rolling 12 months, for learning purposes: reviewing past mistakes, revisiting suggested rephrasings, and tracking your progress. They are then deleted automatically. Jean's memory (factual notes, encrypted), the personalized content derived from it, and the mistakes to review are deleted after 365 days of account inactivity; recaps (summary and advice, without quotes) are kept for the life of the account. - Level-assessment conversation: for members, the word-for-word transcript and the quotes in the recap are kept for a rolling 12 months, like their other conversations with Jean. For visitors who are not members, the transcript is deleted after 3 days and the quotes after 30 days. - Other transcripts (pronunciation and dictation exercises): for the life of the account. - Technical logs: 30 to 90 days. - Audience-measurement cookies: up to 13 months, in line with CNIL recommendations. - Newsletter data: until you withdraw your consent or 3 years after our last contact.

- Anti-fraud identifier after account deletion: after your account is deleted, we retain a limited technical identifier derived from your email address solely to prevent fraud and abuse of free trials. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. We retain this identifier only for as long as necessary for that purpose.

After these periods, the data is deleted or irreversibly anonymized.

We use strictly necessary cookies for sessions, authentication, and checkout. With your consent, we also use cookies for audience measurement (Google Analytics 4, with anonymized IP addresses), advertising (Google Ads), and behavioral analytics (Microsoft Clarity heatmaps and session recordings).

On your first visit, a banner allows you to accept or reject nonessential cookies. You can change this choice at any time through your browser settings.

Your data is available to authorized BEPITE SAS personnel and to the following service providers. Each provider is bound by an agreement that complies with Article 28 GDPR:

- Stripe (payments) - https://stripe.com/privacy - Supabase (database and authentication) - https://supabase.com/privacy - Vercel (hosting) - https://vercel.com/legal/privacy-policy - Cloudflare (CDN and Turnstile bot protection) - https://www.cloudflare.com/privacypolicy/ - Brevo (email and newsletters) - https://www.brevo.com/legal/privacypolicy/ - Zoho (invoicing) - https://www.zoho.com/privacy.html - ElevenLabs (voice conversations with Jean, speech synthesis) - https://elevenlabs.io/privacy - OpenAI and Anthropic (transcription, feedback, and educational AI features) - Microsoft Azure Speech (pronunciation scoring) - https://privacy.microsoft.com/privacystatement - Google (OAuth, Analytics 4, and Ads) - https://policies.google.com/privacy - Microsoft Clarity (behavioral analytics) - https://privacy.microsoft.com/privacystatement - Sentry (technical error monitoring) - https://sentry.io/privacy/

We do not sell your data or share it with commercial partners for marketing purposes.

Some service providers are located outside the European Union, primarily in the United States. These transfers are protected by the safeguards set out in Chapter V of the GDPR: the EU-U.S. Data Privacy Framework (adequacy decision 2023/1795) when the provider is certified, or otherwise the Standard Contractual Clauses (decision 2021/914).

You may request a copy of these safeguards by emailing boutique@hellofrench.com.

We use appropriate technical and organizational safeguards, including encryption in transit (TLS), application-level encryption (AES-256-GCM) of conversations with Jean, personal notes linked to Jean, and personalized learning content, hashed passwords, PostgreSQL Row-Level Security, regular encrypted backups, access restricted to authorized personnel, and data processing agreements (DPAs).

If a data breach is likely to create a risk to your rights and freedoms, we will notify the CNIL within 72 hours under Article 33 GDPR and, where required, notify you directly under Article 34.

Under the GDPR, you have the following rights: access (Article 15), correction (Article 16), deletion (Article 17), restriction of processing (Article 18), data portability (Article 20), objection (Article 21), withdrawal of consent at any time (Article 7), and the right to provide instructions regarding your data after death under Article 85 of the French Data Protection Act.

To exercise these rights, email boutique@hellofrench.com. We will respond within one month as required by Article 12(3) GDPR. You can also manage your email address, password, newsletter subscription, and account deletion directly from your profile.

When you delete your account from your profile, we delete your account, progress, conversations, and voice recordings, and unsubscribe you from all mailing lists. We retain only the invoices that we are legally required to keep (see “Retention Periods”) and the anti-fraud identifier described above. Account deletion is permanent and irreversible. If you have an active paid subscription, you may choose either to stop renewal only or to delete your account immediately and give up the remaining access without a refund.

If you believe your rights have not been respected, you may file a complaint with the CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, https://www.cnil.fr.

BEPITE SAS, 14 Rue Ernest Psichari, 75007 Paris, France. Email: boutique@hellofrench.com.

Effective date: January 26, 2023. Last updated: August 3, 2026.