Last updated: July 25, 2026
Your data belongs to you. This policy explains, in plain language, what we collect, why, where it goes, how long we keep it, and how you stay in control. No dark patterns, no selling of data — ever.
1. Who is responsible
The data controller is Anthony Lucas (sole trader, France), operating Social French (socialfrench.com). Contact for anything privacy-related: hello@socialfrench.com. We are not required to appoint a Data Protection Officer; Anthony handles privacy matters personally.
2. What we collect and why
| Data | Why we use it | Legal basis (GDPR art. 6) |
|---|---|---|
| Account data — name, email, password (hashed), language of the interface | Create and run your member account | Contract |
| Subscription & payment data — plan, invoices, payment status. Your card number goes directly to Stripe; we never see or store it | Billing, subscription management, accounting | Contract; legal obligation (accounting) |
| Learning profile — level, goals, native language, learning preferences (collected progressively, some of it only when you book your first lesson) | Personalise your learning path and lessons | Contract |
| Learning activity — course progress, quiz results, homework | Run the learning space, show your progress | Contract |
| Lesson data — bookings, attendance, lesson notes, your personal whiteboard | Provide one-to-one lessons and follow-up | Contract |
| Lesson recordings — online lessons are recorded (video/audio) | (a) let you rewatch your lesson in your classroom space; (b) generate your lesson summary and personalised follow-up, with AI assistance (see §4) | Contract (the rewatch + follow-up are part of the service). You are informed at booking, and you can ask for a lesson not to be recorded |
| Community content — posts, comments, profile photo, messages | Run the community | Contract |
| Emails — transactional (account, billing, lessons) and, separately, news/tips | Keep you informed; marketing only with your consent | Contract (transactional); Consent (marketing — unsubscribe in one click in every email) |
| Technical data — server logs, IP, security events | Keep the platform secure and working | Legitimate interest (security) |
We don’t collect anything we don’t need. Fields that are optional are marked as such.
3. Where your data goes (processors)
We use a small number of service providers, each bound by a data processing agreement. Summary (full detail in our processor register):
- Hostinger — hosting of the website and its database (server located in Paris, France — European Union);
- Stripe — payment processing;
- SureCart — subscription checkout and management (cloud service);
- Google — video lessons (Google Meet), calendar, email, temporary storage of lesson recordings, and AI-assisted lesson analysis (Gemini) — see §4;
- Make — automation of internal workflows (e.g. routing lesson recordings to analysis);
- CloudConvert — conversion of lesson recordings to audio for analysis;
- Bunny (EU) — media storage/delivery, when activated.
We never sell or rent your data. No third-party advertising trackers.
4. AI-assisted lesson follow-up — transparency
After an online lesson, the recording is processed to produce your lesson summary, vocabulary notes and personalised follow-up. Part of this analysis uses an AI model (currently Google Gemini). What this means for you:
- the recording is used only to produce your learning follow-up — nothing else;
- raw recordings are kept temporarily and then deleted (see §6);
- the human in charge remains your teacher: AI drafts, Anthony reviews.
We use Google’s paid API tier: under its terms, Google does not use this data to train its models.
5. International transfers
Some providers process data outside the EU (e.g. Stripe and SureCart in the United States). Where that happens, transfers rely on the European Commission’s adequacy decisions (EU-US Data Privacy Framework) and/or Standard Contractual Clauses. You can ask us for details per provider at any time.
6. How long we keep things
| Data | Retention |
|---|---|
| Account & learning data | While your account is active, then deleted or anonymised within 3 years after your last activity |
| Invoices & accounting records | 10 years (French legal obligation) |
| Lesson recordings (rewatch in your classroom space) | 6 months maximum after the lesson, then deleted. Temporary processing copies are deleted earlier (within 30 days) |
| Lesson summaries & learning follow-up | While your account is active (they’re part of your learning record) |
| Community content | Until you delete it or your account is deleted |
| Marketing consent & emails | Until you unsubscribe, or 3 years after your last interaction |
| Server logs | 12 months maximum |
7. Your rights
You can, at any time: access your data, correct it, delete it, receive a copy (portability), restrict or object to certain uses, and withdraw a consent. Just email hello@socialfrench.com — we answer within one month at most.
You can also complain to the French supervisory authority, the CNIL (cnil.fr), or to the authority of your country of residence.
8. Security
Access to your data is restricted and protected (passwords hashed, HTTPS everywhere, credentials stored in a password manager, least-privilege access for tools). No system is 100% risk-free; if a breach ever affects your data, we’ll inform you and the CNIL as the law requires.
9. Minors
Social French is intended for adults. If you’re under 18, you need a parent or guardian’s consent to subscribe.
10. Changes
If this policy changes in a meaningful way, we’ll tell you by email or on the platform before the change applies.
Anthony – Social French
