Privacy policy

The controller of the data described below is Quentin Kral, publisher of the site — see the legal notice for full identification. Dedicated contact for personal data: contact@parlova.fr.

For student data processed during classroom use, each party's role is set out in section 4.

Parlova only collects the data that is strictly necessary:

• Teacher / curious / student accounts: email, display name, chosen role. This data is needed to sign in and personalise the experience.
• Anonymous game sessions (students without an account): freely entered first name, messages exchanged during the session, score and completion rate. No identifying data is required.
• Missions created: content generated by the teacher and configuration settings.

We use no tracking cookies. Our audience measurement tool (Vercel Analytics) processes the IP address transiently to produce aggregated, anonymous visit statistics (country, page visited, device type) — it is never stored or linked to a user account.

Some preferences and session information (first name entered when joining without an account, answer draft in progress, display preferences) are kept locally in your browser (localStorage) — they stay on your device and are never sent to our servers beyond their normal functional use (e.g. joining a mission).

Each processing activity relies on one of the legal bases set out in Article 6 GDPR:

• Account creation and management, authentication, access to the service, dialogues with AI characters — performance of the service requested by the user (Art. 6(1)(b))
• Showing learning statistics to the teacher (student progress) — performance of the service for the teacher; in a school setting, the school's public-interest teaching mission (Art. 6(1)(e), see section 4)
• Detecting and flagging inappropriate messages (insults, violence, sexual or hateful content, distress, attempts to hijack the AI) to the teacher and the Parlova team — protecting students and preventing abuse: Parlova's legitimate interest (Art. 6(1)(f)) and, in a school setting, the school's public-interest teaching mission (Art. 6(1)(e)). Detection is performed by the AI playing the character; it leads to no automated decision: a human judges the flagged message.
• Transactional and notification emails (account confirmation, learning alerts) — performance of the service (Art. 6(1)(b))
• Aggregated audience measurement, retention of demo-mode conversations, abuse prevention — Parlova's legitimate interest in improving and securing the service (Art. 6(1)(f)); you may object at any time

We never sell, rent or share your data with third parties for commercial purposes.

Parlova is used in a school setting supervised by the teacher:

• Anonymous sessions only collect a first name freely entered by the student
• Learning exchanges are only accessible to the teacher who created the mission and to the teachers they invited to co-run it
• Messages detected as inappropriate are automatically flagged to these teachers (by email and in their dashboard) and to the Parlova team, who may read them to protect students. Students are told about this before they start playing
• No data is used for profiling or advertising

When a teacher uses Parlova with their students as part of their school, the school (represented by its head) is the controller of the students' data, and Parlova acts as a processor within the meaning of Article 28 GDPR: Parlova only processes this data to provide the service, on the school's instructions. Informing families (Article 13 GDPR) is the school's responsibility.

• Supabase — authentication and database (data hosted in Ireland, European Union)
• OpenAI — AI generation of characters and dialogues
• Vercel — hosting of the web interface and audience measurement (Vercel Analytics)
• Resend — sending of transactional and notification emails (account confirmation, learning alerts)

The data sent to OpenAI is the messages exchanged during a session. Under OpenAI's API terms, it is not used to train its models; OpenAI may keep it for up to 30 days for abuse monitoring, then deletes it.

Some historical illustrations in missions are displayed directly from Wikimedia Commons: your browser then contacts the Wikimedia Foundation's servers, which receive your IP address as with any visit to Wikipedia. No other data is sent to them.

Transfers outside the European Union: OpenAI, Vercel and Resend are companies based in the United States, and some data may be processed there. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses, as provided in the data processing agreements with these providers. The main database (Supabase) remains hosted in the European Union.

Emails sent by Parlova are subject to technical delivery tracking (opens, clicks) through our email provider, to ensure reliable delivery and manage unsubscriptions — never for advertising or profiling.

• Account data: kept until the account is deleted
• Game sessions: kept for 12 months, automatically purged afterwards
• Flagged messages: kept for 12 months at most, deleted together with the corresponding game session
• Demo-mode games ("Try without an account"): automatically deleted after 7 days, together with the visitor's anonymous account; conversations from the former demo mode: kept for 12 months, automatically purged afterwards
• Missions created: kept until deleted by the teacher

You have the following rights, which you can exercise at any time:

• Access — obtain a copy of your data
• Rectification — correct inaccurate information
• Erasure — delete your account and all your data (available from your profile)
• Portability — receive your data in a structured format (JSON export available from your profile)
• Objection — object to certain processing

To exercise your rights: contact@parlova.fr

You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Parlova only uses technical cookies required for authentication (user session). No tracking or advertising cookies are used.

The site's audience measurement (Vercel Analytics) works entirely without cookies: it counts page views in aggregate, without individually identifying visitors or tracking them across sites.

Your browser's local storage (localStorage), separate from cookies, is also used for some preferences and session information — see section 2.

Parlova uses the YouTube Data API (YouTube upload scope) to publish educational videos on its official YouTube channel.

• Data accessed: an OAuth2 access token linked to the platform's YouTube account. No personal data of YouTube users is collected.
• Use: the token is used exclusively to upload videos to Parlova's YouTube channel according to a publishing schedule. It is not used for any other purpose.
• Transfer: the OAuth token is never passed on to third parties, sold, or shared for commercial purposes.
• Protection: the token is stored securely and only accessible to the platform's authorised operators.
• Retention and deletion: the token can be revoked at any time from the settings of the associated Google account. It is deleted as soon as the account is disconnected.
• AI / machine-learning models: data received through Google APIs is not used to train, improve or develop AI or machine-learning models.

The use of data received through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

For any question about your data: contact@parlova.fr

A detailed overview of the measures in place, intended in particular for schools and DPOs, is available on the Personal data and GDPR page.