Privacy policy
Last updated: November 7, 2026. This policy covers academy.corsen.ai and the Corsen Academy learner area. It applies Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act of January 6, 1978. The French version prevails.
1. Data controller
CORSEN AI, SASU, 58 rue de Monceau, CS 48756, 75380 Paris Cedex 08, France, SIREN 102 970 407.
For any question about your data or to exercise your rights: [email protected]. We have not appointed a data protection officer; this address is read by the person in charge of these matters.
2. In short
- Courses can be read without an account: without an account and without consent to analytics, we only keep the server's technical logs.
- The free account saves your progress. We do not sell or rent your data, and we run no advertising.
- Data is hosted in France, with OVHcloud.
- Google Analytics only loads if you accept it in the banner.
3. What we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and manage your account | Name, email address, password (stored as a one-way hash), language, two-factor authentication if you enable it | Performance of the service you request (Art. 6(1)(b)) | While the account exists; deleted after 3 years without sign-in, with a warning email first |
| Save your progress | Courses followed, lessons started and completed, time spent, quiz results, with the IP address and browser at the time of recording | Performance of the service (Art. 6(1)(b)) | Deleted with the account |
| Completion certificates, if you earn one | Name, course, hours, completion rate, verification code. The public verification page only shows your initials | Performance of the service (Art. 6(1)(b)) | 5 years after issue, so it can be verified |
| Assess your learning (entry questionnaire, final quiz, assessments) | Answers, score, date, duration | Performance of the service; legal duty of proof for funded courses | 5 years after the end of the course |
| Handle your reports and complaints | Email, subject, description, nature, reference, IP address, follow-up | Legitimate interest (quality obligations) | 5 years |
| Keep proof of your consents | Version of the terms accepted, date, IP address, browser | Legal obligation (GDPR, art. 7) | Account lifetime + 5 years |
| Protect forms against bots | Cloudflare Turnstile challenge token, IP address and browser signals processed by Cloudflare; we only keep the outcome | Legitimate interest (security) | Outcome: 12 months in logs |
| Keep the service secure | Sign-in logs (date, IP address, browser, action), sessions, server technical logs | Legitimate interest: preventing unauthorized access and abuse (Art. 6(1)(f)) | 12 months |
| Account emails | Email address, name | Performance of the service (address verification, password reset, sign-in codes); legitimate interest for reminders about courses in progress (Art. 6(1)(f)) | Only for sending; you can opt out of reminders by writing to [email protected] |
| Enrollment through an employer or funding program, when offered | Organization name, company number, contact, funding file reference | Performance of the contract with the organization (Art. 6(1)(b)) and legal obligations related to training (Art. 6(1)(c)) | Duration of the training, then the legal retention period for supporting documents |
| Reply to your messages, feedback and complaints | What you write to us, your email address | Legitimate interest (Art. 6(1)(f)) | 3 years after the last exchange |
| Audience measurement | Pages viewed, referrer, device and browser type | Your consent (Art. 6(1)(a)), which you can withdraw at any time | Cookies: 13 months at most; data in Google Analytics: 14 months at most |
No payment is collected today: every course is free. We process no sensitive data and make no automated decisions about you.
4. Who receives your data
Only the CORSEN AI staff who need it have access. Our processors:
- OVHcloud (France): hosting of servers, database, email and backups, in France.
- Cloudflare, Inc. (USA): traffic delivery and protection, inbound email routing.
- Google LLC (USA): Google Analytics, only with your consent; Google Fonts, which serves the site's fonts and therefore receives your IP address.
If your employer enrolled you, it can see your progress in the courses it assigned to you.
5. Transfers outside the European Union
Cloudflare and Google are based in the United States and certified under the EU–US Data Privacy Framework (adequacy decision of July 10, 2023); the European Commission's standard contractual clauses apply in addition.
6. Security
Encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, a database reachable only from the server, restricted administrative access, encrypted backups. Found a flaw? Write to [email protected].
7. Your rights
You can access your data, have it corrected or erased, restrict or object to its processing, receive a copy in a machine-readable format, and withdraw your consent at any time. Under French law, you can also leave instructions on what happens to your data after your death.
Write to [email protected] from your account's email address. We reply within one month. To delete your account and all your progress, a simple request is enough.
To withdraw consent to audience measurement: the “Cookie settings” button in the cookie policy.
8. Children
Accounts are for people aged 15 and over. Under 15, an account must be created with the consent of a holder of parental responsibility.
9. Complaints
If you believe your rights are not respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr, or with the supervisory authority of your country.
10. Cookies and changes
Cookies are detailed in the cookie policy. Each version of this policy is dated; for significant changes, we notify account holders by email.