Privacy Policy
Last updated: 2026-07-18
1. Data Controller
The controller of the personal data collected through this site is elearning-generator.
For any question regarding your personal data: contact-elearning-generator@luxuryoperations.org.
Remember to replace this address with your actual contact address before going live.
2. Data Collected and Purposes
The personal data collected depends on the features you use. The exhaustive list is in the Subprocessors section below, where each recipient indicates precisely what data they process and for what purpose.
For security and accountability purposes (legal basis: legitimate interest, Art. 6.1.f GDPR), the application keeps two internal logs accessible to the administrator only: a connection log (email, role, browser and operating system type - never the IP address - kept for 90 days) and an audit log of sensitive actions (who deleted a module, enabled a portal, managed collaborators or restored a version; actor, action and affected item, without content, kept for 12 months). Older entries are deleted automatically. No monitoring of behaviour, time spent or productivity is performed.
If a question assistant is enabled on a module, a learner may, when no answer is found in the module, forward their question to the creator and optionally provide their email address (legal basis: consent, art. 6.1.a GDPR). This address is used solely to send them the creator's reply, then is automatically deleted after 90 days. The question itself is kept anonymously to help the creator improve the module.
If a module offers the ANCHORING program (spaced repetition), the learner may opt in at the end of the module and then provides their email address (legal basis: consent, art. 6.1.a GDPR). This address is used ONLY to send 6 reminders over 30 days; they can unsubscribe at any time via the link in every email, and the address is deleted on unsubscribe and at the end of the program.
3. Legal Basis for Processing
The processing of your data relies on one of the legal bases set out in Article 6 of the GDPR depending on the context: contract performance, legitimate interest, consent, or legal obligation.
4. Subprocessors and Recipients
To provide this service, we work with third-party subprocessors. Each subprocessor only handles the data strictly required for their task, under a contract compliant with Article 28 of the GDPR.
Vercel Inc.
440 N Barranca Ave #4133, Covina, CA 91723, USA
- Purpose
- Hosting and serverless function execution (Frankfurt region - fra1)
- Data processed
- IP addresses
- Server logs
- Session cookies
- Retention
- 30 days for logs
- Legal basis
- Legitimate interest (Art. 6.1.f GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). Functions run in the EU (Frankfurt) but legal entity is US-based
- More info
- Privacy policyData Processing Agreement (DPA)
Neon, LLC (filiale de Databricks, Inc.)
160 Spear Street, 13th Floor, San Francisco, CA 94105, USA
- Purpose
- PostgreSQL database hosting
- Data processed
- All application data stored in the database
- Retention
- Account lifetime (deletion on request)
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). Database hosted in the European Union (Frankfurt region, eu-central-1). As Neon is a Databricks subsidiary, the applicable data processing agreement is Databricks'.
- More info
- Privacy policyData Processing Agreement (DPA)
Plus Five Five, Inc. (Resend)
2261 Market Street #4667, San Francisco, CA 94114, USA
- Purpose
- Transactional email delivery
- Data processed
- Recipient email
- Content of sent emails
- Retention
- 30 days for delivery logs
- Legal basis
- Contract performance / legitimate interest
- Transfer / details
- Standard Contractual Clauses (SCC)
- More info
- Privacy policyData Processing Agreement (DPA)
Cloudflare, Inc.
101 Townsend Street, San Francisco, CA 94107, USA
- Purpose
- File storage (R2: uploaded source documents, generated images, voiceovers, videos, SCORM exports), domain DNS management, and routing of incoming emails to the owner's mailbox (Email Routing)
- Data processed
- User-uploaded files
- Metadata (name, MIME type, size)
- Emails received at the contact address and routed to the owner's mailbox (sender, subject, content)
- Retention
- Account lifetime (deletion on request). Emails are only routed, not durably stored by Cloudflare.
- Legal basis
- Contract performance (Art. 6.1.b GDPR)
- Transfer / details
- Standard Contractual Clauses (SCC). R2 storage is set to strict EU jurisdiction: files are kept in the European Union and never leave it.
- More info
- Privacy policyData Processing Agreement (DPA)
Anthropic PBC
548 Market Street #84749, San Francisco, CA 94104, USA
- Purpose
- AI inference (Claude models) for e-learning module generation: document structuring, pedagogical rewriting, quizzes, translation, and optional web search (only when the user enables it). Anthropic does not train its models on data sent through the API (commercial terms).
- Data processed
- Content of uploaded documents and entered text, sent to the model for generation
- When web search is enabled: search queries derived from the module content, sent to Anthropic and its search providers (Brave, TurboPuffer) to retrieve web pages
- Retention
- Inputs and outputs automatically deleted within 30 days. Exceptions: content flagged by Anthropic's trust and safety systems (up to 2 years) and feedback data (5 years). Zero data retention (ZDR) is available on request from Anthropic.
- Legal basis
- Contract performance / legitimate interest / consent (depending on context)
- Transfer / details
- Standard Contractual Clauses (SCC), modules 2 and 3, automatically incorporated into Anthropic's commercial terms (no separate signature). SCCs governed by Irish law.
- More info
- Privacy policyData Processing Agreement (DPA)
OpenAI, L.L.C.
1960 Bryant Street, San Francisco, CA 94110, USA
- Purpose
- Image generation (gpt-image) and text-to-speech (voiceover) for e-learning modules
- Data processed
- Text prompts sent to generate images and voiceover
- Retention
- 30 days on the OpenAI side (unless opted out)
- Legal basis
- Contract performance / legitimate interest
- Transfer / details
- Standard Contractual Clauses (SCC)
- More info
- Privacy policyData Processing Agreement (DPA)
5. Your Rights
Under the GDPR, you have the following rights over your data:
- Right of access and rectification
- Right to erasure (right to be forgotten)
- Right to data portability
- Right to object and to restrict processing
- Right to withdraw your consent at any time (when processing is based on consent)
- Right to lodge a complaint with the CNIL (cnil.fr) or any other competent authority
To exercise your rights: contact-elearning-generator@luxuryoperations.org. We commit to responding within a maximum of one month.
6. Cookies
By default, this site only uses cookies strictly necessary for its operation (session, preferences). No advertising or profiling cookie is set without your explicit consent.
If an audience analytics feature requiring consent is enabled (for example Google Analytics), a consent banner is displayed before any non-essential cookie is set.
7. Modifications
This policy may be updated to reflect changes to the services and subprocessors used. The last update date is shown at the top of this page. Substantial changes will be notified by email to registered account holders.