Privacy policy

Last update: 20 avril 2026

This privacy policy describes how EduTools collects, uses and protects users' personal data, in accordance with EU Regulation 2016/679 (GDPR) and the amended French Data Protection Act of 6 January 1978.

1. Data controller

The controller of personal data collected on the EduTools platform is:

• Name: EduTools
• Legal form: sole trader
• Registered office: 162 rue du PDT F Mitterrand 91160 Longjumeau
• SIRET: 52841027700016
• Publication director: Laurent ATTAR
• GDPR contact: rgpd@edutools.fr

2. Data we collect

2.1 Data provided by the teacher / trainer user

When creating an account and using the platform, we collect:

• Username (chosen pseudonym)
• Email address
• Password (stored hashed with bcrypt — never in plain text)
• Information related to the subscribed plan
• Dashboard display preferences

2.2 Data about learners / participants

When a teacher adds students or participants join a session:

• First and last name (if entered by the teacher)
• Email address (optional, if entered)
• Pseudonym used to join a room
• Group / class
• Quiz answers, contributions to boards, mindmaps, sticky notes, word clouds
• Connection timestamps, session duration

2.3 Automatically collected data

• IP address (used only for security purposes — protection against intrusion attempts)
• Technical information needed for the session (PHP session cookie)
• Security event logs (failed login attempts, sensitive actions)

2.4 Payment data

Payments are fully processed by our provider Stripe Payments Europe Ltd. EduTools stores no banking or credit card information. Only a customer identifier and payment status (paid / unpaid) are kept in our database.

3. Purposes and legal bases

4. Data recipients and processors

Your data is accessible exclusively:

• to the EduTools team, within the scope of their duties;
• to the teacher or institution manager, for data of the attached learners;
• to our technical processors, strictly as needed for their mission.

List of processors

Fonts are self-hosted on our servers: no data is sent to Google Fonts while you browse the platform.

5. Transfers outside the European Union

Some of our processors (Stripe, the jsDelivr CDN, the ip-api geolocation service — the latter receiving only a truncated, anonymised IP address) may process data outside the European Union, in particular in the United States. These transfers are framed by the Standard Contractual Clauses adopted by the European Commission and, where applicable, by the EU-US Data Privacy Framework.

6. Retention periods

7. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

• Right of access — get confirmation that your data is processed and receive a copy;
• Right of rectification — correct inaccurate or incomplete data;
• Right to erasure (right to be forgotten) — ask for the deletion of your data;
• Right to restriction of processing in cases provided for by law;
• Right to portability — receive your data in a structured, machine-readable format;
• Right to object to processing based on legitimate interest;
• Right to set post-mortem instructions regarding your data.

How to exercise your rights?

Send your request by email to rgpd@edutools.fr or by post to the registered office address indicated in section 1. We will reply within one month of receiving your request (extendable by two months if complex).

For security reasons, we may ask for proof of identity before acting.

8. Data security

EduTools implements the following technical and organisational measures:

• Password hashing with the bcrypt algorithm (adaptive cost);
• HTTPS / TLS encrypted communications with HSTS policy;
• Prepared SQL queries (injection prevention);
• CSRF protection on all sensitive actions;
• Login attempt rate limiting (anti brute-force);
• Strict tenant data isolation between accounts;
• Security event logging and regular review;
• HTTP security headers (CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy).

9. Cookies and trackers

EduTools uses exclusively cookies that are strictly necessary for the platform's operation. These cookies do not require prior consent (French Data Protection Act art. 82).

No audience-measurement, advertising or social-network cookie is placed. No third-party tracker (Google Analytics, Facebook Pixel, etc.) is active on the platform.

10. Data concerning minors

EduTools is used in a pedagogical context. When minor learners use the platform:

• It is the teacher or institution that enters the data or invites the learners to join a room;
• The responsibility of collecting parental authorisations lies with the school or legal guardian, in accordance with article 8 GDPR (parental consent required for minors under 15 in France);
• Learner data is limited to what is strictly necessary for the pedagogical activity;
• No profiling or automated decision-making is performed on learners.

11. Changes to this policy

This policy may be updated to reflect legal changes or changes in our processing. The date of the last update is indicated at the top of the page. We will inform you by email or via the platform in case of substantial change.

12. Contact us

For any question regarding this policy or your data:

• By email: rgpd@edutools.fr
• By post: 162 rue PDT F Mitterrand 91160 Longjumeau

← Back to home