Privacy policy

Data controller

The data controller is the website publisher, SLB Consulting (see the legal notice). For any question relating to your data, you may contact it.

Email (personal data)

contact@thefleow.com

Data we collect

• Account and profile: last name, first name, email address, password (stored hashed, never in plain text), French level (CEFR), learning goals, time zone.
• Bookings and lessons: booked time slots, lesson history, attendance.
• Payment and invoicing: packs and credits purchased, amounts, invoices. Bank card data is entered directly with the payment provider and does not pass through our servers.
• Internal messaging: content of messages exchanged with the teacher.
• Teaching documents: materials and homework shared in your space.

Purposes and legal bases

Manage your account and lessons

Performance of the contract (art. 6.1.b GDPR).

Process payments

Performance of the contract (art. 6.1.b GDPR).

Issue and retain invoices

Legal accounting obligation (art. 6.1.c GDPR).

Provide learning follow-up and messaging

Performance of the contract (art. 6.1.b GDPR).

Retention periods

Account, profile, messages, documents

For the duration of the contractual relationship, then three years after the last lesson; thereafter, deletion or anonymization.

Invoices and accounting records

10 years, in accordance with article L123-22 of the French Commercial Code.

Recipients and processors

Your data is neither sold nor transferred. It is accessible to the teacher and to processors strictly necessary for the service:

• o2switch (website hosting, in France).
• Stripe (card payment processing).
• PayPal (additional payment method).
• Google (Google Calendar and Google Meet: a lesson event is created and you are invited by email to your own lesson).

Transfers outside the European Union

Some providers (in particular Stripe and Google) may involve data transfers outside the European Union. These transfers are governed by appropriate safeguards (European Commission standard contractual clauses and/or the Data Privacy Framework).

Your rights

In accordance with the GDPR, you have the following rights regarding your data:

• Right of access and rectification.
• Right to erasure.
• Right to restriction of processing.
• Right to object.
• Right to portability of your data.

You may exercise these rights by contacting the publisher; a response will be provided within one month. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).

Cookies and audience measurement

The website uses only cookies that are strictly necessary for its operation (signing in to your account, your chosen language, showing the welcome screen), which are exempt from consent. No advertising tracker is used.

The level test counts its sessions anonymously, in order to improve its questions: right or wrong answers, level obtained, pace chosen, clicks to the contact page or prices. No data that could identify you is collected: no name, no email address, no IP address.

So that you can pick up the test where you left off, your progress is kept in your browser for 7 days at most. It never leaves your device, and you can delete it by starting the test again from scratch or by clearing the site's data.

Security

We implement technical and organizational measures to protect your data: hashed passwords, access to documents restricted to their owner, encrypted communications (HTTPS) and server-side role verification.

Blog comments

If you post a comment under an article, we process the text you write, the date it was sent and your account identity.

**What is public**: your first name and the initial of your last name (for example “Maria G.”), the text of your comment and its date. Your email address is never displayed.

**Legal basis**: your consent, given by sending the comment (art. 6.1.a GDPR). **Retention**: as long as the article is online, or until you delete the comment.

**Your rights**: you can delete your own comment at any time from the article page. Deleting your account also deletes all your comments. Every comment is reviewed before publication; a rejected comment is never displayed.