Privacy Policy

1. Data Controller

The data controller for personal data collected on the BrainRoads platform (the "Platform") is:

BrainRoads
Location: France
Contact: neljaouh@gmail.com

2. Data We Collect

In accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and applicable French law, we collect the following data:

• Identity data: first name, last name, email address (when creating an account).
• Connection data: IP address, browser type, operating system, pages visited, date and time of connection.
• Learning data: course progress, quiz results, flashcard activity — stored locally in your browser (localStorage) and on our servers for account holders.
• Voluntarily submitted data: messages sent via the contact form or the AI Tutor chat.

3. Purposes and Legal Bases

4. Data Retention

• Account data: retained for the duration of the account, then deleted within 30 days of account closure.
• Connection logs: retained for 12 months as required by French law.
• Contact messages: retained for 3 years from the last interaction.

5. Data Sharing

We do not sell your personal data. We may share it with:

• Hosting provider: Vercel Inc. (infrastructure hosting)
• Authentication: Google LLC, GitHub Inc. (if you use social sign-in)
• Payment processor: Stripe Inc. (for billing, if you subscribe to a paid plan)
• AI services: OpenAI (for AI Tutor and content generation features)
• Analytics: Plausible Analytics (privacy-first, no cookies, no personal data)

All third-party processors are bound by data processing agreements compliant with GDPR.

6. Cookies

BrainRoads uses strictly necessary cookies for authentication and session management. We use Plausible Analytics, which is cookieless and does not track you across sites. You may decline optional analytics via the cookie banner on your first visit.

7. Your Rights

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to processing
• Data portability (receive your data in a structured format)
• Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact us at neljaouh@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the CNIL (cnil.fr).

8. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. This includes encrypted connections (HTTPS/TLS), hashed password storage, and access controls.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice on the Platform. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

10. Contact

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us at neljaouh@gmail.com or via our contact form.