Privacy policy

Data controller

The data controller is the website publisher, SLB Consulting (see the legal notice). For any question relating to your data, you may contact it.

Email (personal data)

contact@thefleow.com

Data we collect

• Account and profile: last name, first name, email address, password (stored hashed, never in plain text), French level (CEFR), learning goals, time zone.
• Bookings and lessons: booked time slots, lesson history, attendance.
• Payment and invoicing: packs and credits purchased, amounts, invoices. Bank card data is entered directly with the payment provider and does not pass through our servers.
• Internal messaging: content of messages exchanged with the teacher.
• Teaching documents: materials and homework shared in your space.

Purposes and legal bases

Manage your account and lessons

Performance of the contract (art. 6.1.b GDPR).

Process payments

Performance of the contract (art. 6.1.b GDPR).

Issue and retain invoices

Legal accounting obligation (art. 6.1.c GDPR).

Provide learning follow-up and messaging

Performance of the contract (art. 6.1.b GDPR).

Retention periods

Account, profile, messages, documents

For the duration of the contractual relationship, then three years after the last lesson; thereafter, deletion or anonymization.

Invoices and accounting records

10 years, in accordance with article L123-22 of the French Commercial Code.

Recipients and processors

Your data is neither sold nor transferred. It is accessible to the teacher and to processors strictly necessary for the service:

• o2switch (website hosting, in France).
• Stripe (card payment processing).
• PayPal (additional payment method).
• Google (Google Calendar and Google Meet: a lesson event is created and you are invited by email to your own lesson).

Transfers outside the European Union

Some providers (in particular Stripe and Google) may involve data transfers outside the European Union. These transfers are governed by appropriate safeguards (European Commission standard contractual clauses and/or the Data Privacy Framework).

Your rights

In accordance with the GDPR, you have the following rights regarding your data:

• Right of access and rectification.
• Right to erasure.
• Right to restriction of processing.
• Right to object.
• Right to portability of your data.

You may exercise these rights by contacting the publisher; a response will be provided within one month. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).

Cookies and audience measurement

The website uses only cookies that are strictly necessary for its operation (session and authentication), which are exempt from consent. No advertising tracker or audience measurement tool is currently active; a consent banner will be added if such a tool is deployed.

Security

We implement technical and organizational measures to protect your data: hashed passwords, access to documents restricted to their owner, encrypted communications (HTTPS) and server-side role verification.