This document is a courtesy translation. In case of discrepancy, only the French version is authoritative, as the service is provided from France and subject to French law.
1. Data Controller
The personal data collected via looping.academy is processed by UNYX, 60 rue François Ier, 75008 Paris, France, SIREN 100 489 004, represented by its manager Michaël Haim Chiche. Contact: [email protected].
UNYX acts as a data controller within the meaning of the General Data Protection Regulation (GDPR, Regulation EU 2016/679) and the amended French Data Protection Act.
When a school or teacher uses the "Looping Classe" space for their students, UNYX acts as a data processor for the class data and as a data controller for managing the teacher's account.
2. Data Collected
Looping applies a principle of minimization: only the data necessary for the operation of the service is collected.
| Category | Data | Person Concerned |
|---|---|---|
| Parent Account | Email address, full name (optional), encrypted password, or Google login ID if you choose this mode | Parent |
| Student Profile | First name, age, school level, avatar color, login code | Minor Student |
| Educational Activity | Quizzes, dictations, and dialogues completed, answers given, grades obtained, time spent, chapters worked on, correction contests | Minor Student |
| Rewards | Screen time earned, points, badges, streaks, history of gains | Minor Student |
| Subscription | Subscribed plan, status, dates, Stripe payment ID (no banking data is stored by UNYX) | Parent |
| Registration Origin | Campaign parameters present in the arrival address (advertising click IDs, utm, affiliate code), landing page, referring site | Parent |
| Navigation (public pages) | IP address, browser type, pages viewed, duration, origin — after consent only | Visitor |
| Assistance | Content of exchanges with support, bug reports | Parent |
No sensitive data as defined by Article 9 of the GDPR (health, origin, opinions, orientation) is requested. We invite you not to communicate such data in free fields or in imported documents.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage the parent account and student profiles | Performance of the contract |
| Generate educational content and correct activities | Performance of the contract |
| Track progress and produce statistics for the parent | Performance of the contract |
| Award non-monetary rewards (screen time, points, badges) | Performance of the contract |
| Send service emails (confirmation, correction ready, invitations) | Performance of the contract |
| Manage subscription, billing, and accounting | Legal obligation |
| Measure the audience of public pages and the effectiveness of campaigns | Consent (cookie banner) |
| Retain the origin of registration to measure our campaigns | Legitimate interest, with right to object |
| Secure the service and combat fraud and abuse | Legitimate interest |
| Improve the service (aggregated and anonymized usage analysis) | Legitimate interest |
4. Children's data — specific commitments
- The account is created by an adult with parental authority, who consents to the processing for their child (Article 8 of the GDPR, age of consent set at 15 in France).
- The student does not have independent credentials: they log in with a code issued and revocable by the parent, without a mandatory email address.
- No advertising, no targeted advertising, and no third-party trackers in the child, parent, teacher, and administration areas.
- No profiling for commercial purposes, no fully automated decision-making producing legal effects concerning the child.
- The student's productions are never used to train an artificial intelligence model, neither by us nor by our suppliers, who are contractually committed to this.
- Exchanges between the child and the AI can be viewed by the parent from their space, and topics proposed by the child undergo automatic moderation.
5. Retention periods
| Data | Duration |
|---|---|
| Account and student profiles | For the entire duration of the subscription, then 12 months after the last login |
| Educational activity and progress | Duration of the subscription, then 12 months — deletable at any time from the parent space |
| Invoices and accounting documents | 10 years (legal obligation) |
| Prospect data (information request without registration) | 3 years from the last contact |
| Audience measurement and cookies | Maximum 13 months |
| Origin of registration | Lifetime of the account |
| Technical and security logs | 12 months |
At the end of these periods, the data is deleted or irreversibly anonymized.
6. Recipients and subcontractors
The data is accessible only to authorized persons of UNYX and the following technical subcontractors, bound by a contract compliant with Article 28 of the GDPR:
| Subcontractor | Role | Framework |
|---|---|---|
| Cloudflare, Inc. (United States, EU infrastructure) | Hosting of the site and API, content delivery | Standard contractual clauses |
| Supabase (EU — Ireland) | Database, authentication, file storage | Hosting in the European Union |
| Stripe Payments Europe, Ltd. (Ireland) | Subscription payment processing | Hosting in the European Union |
| Resend (United States) | Sending transactional emails (account, corrections, invitations) | Standard contractual clauses |
| Mistral AI (France) | Generation and correction of quizzes, dictations, and dialogues | Hosting in the European Union |
| OpenAI, L.L.C. (United States) | Fallback solution if the French provider is unavailable | Standard contractual clauses |
| Anthropic PBC (United States) | Preparation of oral exams and revision sheets (Revision section) | Standard contractual clauses |
| Google Ireland Ltd. | Audience measurement of public pages (Google Analytics 4), only after consent | Hosting in the European Union |
UNYX does not sell, rent, or transfer any personal data. Data is only communicated to an authority when a legal obligation requires it.
7. Transfers outside the European Union
The storage of accounts, content, and progress is carried out within the European Union. Some subcontractors are based in the United States (see table above): these transfers are governed by the European Commission's standard contractual clauses, supplemented where necessary by additional measures (encryption in transit, data minimization).
In practice, when a quiz is generated, only the school level, theme, and relevant program excerpt are transmitted to the model provider. Neither the student's name, identifier, nor contact details are transmitted.
8. Your rights
- Right of access: obtain a copy of the data concerning you and your children.
- Right to rectification: have inaccurate or incomplete data corrected.
- Right to erasure: request the deletion of data, in cases provided by law.
- Right to restriction: request the temporary suspension of processing.
- Right to object: oppose processing based on legitimate interest.
- Right to data portability: receive your data in a structured and machine-readable format.
- Right to withdraw your consent at any time, without affecting processing already carried out.
These rights are exercised mainly from your parent space (deletion of a student profile, account deletion, export), or by email at [email protected] with proof of identity attached. UNYX responds within one month, extendable by two months for a complex request.
The rights of a minor child are exercised by the holder of parental authority. A minor over 15 years old can exercise their rights of access and rectification themselves by writing to the same address.
9. Complaint to the CNIL
If you believe that your rights are not being respected, you can file a complaint with the CNIL: online at cnil.fr/fr/plaintes, or by mail to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
10. Security
UNYX implements appropriate technical and organizational measures: encryption of exchanges (HTTPS), passwords stored in encrypted form and never in plain text, access compartmentalization by role, session tokens with limited duration, regular backups, logging of administrative access, and incident management procedures.
In the event of a data breach that may pose a risk to your rights and freedoms, UNYX notifies the CNIL within 72 hours and informs you when the risk is high.
11. Modifications
This policy may be modified to reflect changes in the service or regulations. Any substantial modification is brought to your attention by email or during your next login, and the update date is indicated at the top of the page.
Editor
UNYX, Société à responsabilité limitée à associé unique (EURL), capital 1 € · SIREN 100 489 004 · 60 rue François Ier, 75008 Paris, France
Contact : [email protected]