Personal data and GDPR

• A student can play without an account: a mission code and a first name are enough, no email needed.
• A student's exchanges are only visible to the teacher who created the mission.
• No advertising, no profiling, no selling of data, no tracking cookies.
• The database is hosted in Ireland (European Union).
• Game sessions are automatically deleted after 12 months.
• Every user can export or delete their account themselves, from their profile.

Parlova applies the data minimisation principle (Article 5 GDPR):

• Student without an account: a freely entered first name (a nickname works), the messages exchanged with the character, the score and completion rate.
• Account (teacher, curious or student): email, display name, chosen role.
• Mission: the content and settings defined by the teacher.

Parlova never asks for a surname, date of birth, photo, address or phone number, and does not rely on any special-category data within the meaning of Article 9.

• Students join a mission with a code provided by the teacher. No sign-up is required.
• Only the teacher who created the mission can see their students' exchanges and progress.
• The end-of-mission score is suggested by the AI as a guide. It is neither a grade nor an automated decision within the meaning of Article 22: the teacher reviews it, can correct it, and remains the sole judge.

Who is responsible for what? When a teacher uses Parlova with their students as part of their school, the school (represented by its head) is the controller of the students' data. Parlova acts as a processor (Article 28): it only processes this data to provide the service. Informing families is the school's responsibility.

Good practice we recommend to teachers:

• have students enter a first name only or a nickname, never a full name;
• remind students not to write personal information (address, phone number, health…) in their exchanges with the characters;
• delete missions you no longer need.

The characters reply using an OpenAI model, called from our servers. In practice:

• What is sent: the mission context and the messages of the conversation. Neither the student's first name nor their email is sent.
• No training: under OpenAI's API terms, this data is not used to train its models.
• Retention at OpenAI: up to 30 days at most, solely for abuse monitoring, then deleted.

Parlova is designed to fit the framework for the use of AI in education published by the French Ministry of Education in June 2025:

• No student accounts: the framework forbids asking students to create an account on an AI service. With Parlova, a mission code and a first name are enough.
• Levels: students use generative AI themselves from 4e (age 13–14), supervised and supported by the teacher. In 6e and 5e, Parlova is used with the whole class: the teacher leads the dialogue on the board.
• Transparency: before starting and throughout the dialogue, students are told that the characters are played by an AI that can be wrong, and are encouraged to check against their lessons.
• Human oversight of assessment: the end-of-mission score is suggested by the AI as a guide. The teacher reviews it and can correct it from their dashboard; the teacher's score is the one that counts.
• Critical thinking and reliability: teachers can restrict characters to their own documents, and all content generated for a mission remains editable.
• Data protection: minimisation, hosting in the EU, no reuse to train models (sections 1, 3 and 5).
• Frugality: Parlova uses small models and short replies.

As with any digital tool used with students, classroom use takes place with the agreement of the head of school, who is the data controller.

Transfers to the United States are covered by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses, as provided in these providers' data processing agreements. No data is sold or shared for commercial purposes.

• Game sessions (messages, score): 12 months, then automatically deleted every night.
• Demo-mode conversations (without an account): 12 months, then automatically deleted.
• Account: until the user deletes it.
• Missions: until the teacher deletes them.

• All connections are encrypted (HTTPS).
• Access to data is controlled table by table in the database (PostgreSQL Row Level Security): each user can only access their own data, and a teacher only the sessions of their own missions.
• Privileged access keys stay on the server and are never exposed in the browser.
• Deleting an account erases the data attached to it (profile, sessions, messages, progress).

• Export: download all your data as JSON from your profile (right of access and portability).
• Deletion: delete your account from your profile, without having to write to us.
• Rectification, objection, other requests: write to contact@parlova.fr.
• Student without an account: the student or their family can contact the teacher or the school, or write to us directly, naming the mission concerned.

You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.

Parlova only uses the technical cookies needed to sign in, which is why there is no consent banner. Audience measurement works without cookies and does not follow visitors from one site to another. Fonts are served by Parlova itself, and no advertising or tracking network is used.

The one exception: some historical illustrations in missions (archive documents, artworks) are displayed from Wikimedia Commons. The browser then contacts the Wikimedia Foundation's servers directly, which receive the IP address, as with any visit to Wikipedia.

• Privacy policy: legal bases, purposes, rights
• Terms of use
• Legal notice

For any question, including from a school or education-authority DPO: contact@parlova.fr.