Privacy policy

Last update: 8 septembre 2026

This privacy policy describes how EduTools collects, uses and protects users' personal data, in accordance with EU Regulation 2016/679 (GDPR) and the amended French Data Protection Act of 6 January 1978.

1. Data controller

The controller of personal data collected on the EduTools platform is:

• Name: EduTools
• Legal form: sole trader
• Registered office: 162 rue du PDT F Mitterrand 91160 Longjumeau
• SIRET: 52841027700016
• Publication director: Laurent ATTAR
• GDPR contact: rgpd@edu-tools.fr

2. Data we collect

2.1 Data provided by the teacher / trainer user

When creating an account and using the platform, we collect:

• Username (chosen pseudonym)
• Email address
• Password (stored hashed with bcrypt — never in plain text)
• Information related to the subscribed plan
• Dashboard display preferences

2.2 Data about learners / participants

When a teacher adds students or participants join a session:

• First and last name (if entered by the teacher)
• Email address (optional, if entered)
• Pseudonym used to join a room
• Group / class
• Quiz answers, contributions to boards, mindmaps, sticky notes, word clouds
• Connection timestamps, session duration

2.3 Automatically collected data

• IP address (used only for security purposes — protection against intrusion attempts)
• Technical information needed for the session (PHP session cookie)
• Security event logs (failed login attempts, sensitive actions)

2.4 Payment data

Payments are fully processed by our provider Stripe Payments Europe Ltd. EduTools stores no banking or credit card information. Only a customer identifier and payment status (paid / unpaid) are kept in our database.

2.5 Data relating to student accounts (the « Study online » space)

A student may create their own free account, without going through a teacher or an institution. We are then the data controller for that data, and the student is our direct counterpart:

• Email address (the account identifier) and password, stored as a hash
• First name, last name and institution, if the student chooses to provide them
• Display language, creation date and last login date
• The content they upload or create: course files, revision decks, mind maps, boards, quizzes and games they design themselves
• The study groups they create or join, and the resources they share there

No age is collected and no tracker is set in this space: only the session cookie, strictly necessary for it to work. Teachers have no access to the contents of a student account, and content created in this space appears in no back office. At any time, from « My account », the student can correct their details, download all their data as an archive, and permanently delete their account.

3. Purposes and legal bases

4. Data recipients and processors

Your data is accessible exclusively:

• to the EduTools team, within the scope of their duties;
• to the teacher or institution manager, for data of the attached learners;
• to our technical processors, strictly as needed for their mission.

List of processors

Fonts are self-hosted on our servers: no data is sent to Google Fonts while you browse the platform.

5. Transfers outside the European Union

Some of our processors (Stripe, the jsDelivr CDN, the ip-api geolocation service — the latter receiving only a truncated, anonymised IP address) may process data outside the European Union, in particular in the United States. These transfers are framed by the Standard Contractual Clauses adopted by the European Commission and, where applicable, by the EU-US Data Privacy Framework.

6. Retention periods

7. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

• Right of access — get confirmation that your data is processed and receive a copy;
• Right of rectification — correct inaccurate or incomplete data;
• Right to erasure (right to be forgotten) — ask for the deletion of your data;
• Right to restriction of processing in cases provided for by law;
• Right to portability — receive your data in a structured, machine-readable format;
• Right to object to processing based on legitimate interest;
• Right to set post-mortem instructions regarding your data.

How to exercise your rights?

Send your request by email to rgpd@edu-tools.fr or by post to the registered office address indicated in section 1. We will reply within one month of receiving your request (extendable by two months if complex).

For security reasons, we may ask for proof of identity before acting.

8. Data security

EduTools implements the following technical and organisational measures:

• Password hashing with the bcrypt algorithm (adaptive cost);
• HTTPS / TLS encrypted communications with HSTS policy;
• Prepared SQL queries (injection prevention);
• CSRF protection on all sensitive actions;
• Login attempt rate limiting (anti brute-force);
• Strict tenant data isolation between accounts;
• Security event logging and regular review;
• HTTP security headers (CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy).

9. Cookies and trackers

EduTools uses exclusively cookies that are strictly necessary for the platform's operation. These cookies do not require prior consent (French Data Protection Act art. 82).

No audience-measurement, advertising or social-network cookie is placed. No third-party tracker (Google Analytics, Facebook Pixel, etc.) is active on the platform.

10. Data concerning minors

EduTools is used in a pedagogical context. When minor learners use the platform:

• It is the teacher or institution that enters the data or invites the learners to join a room;
• The responsibility of collecting parental authorisations lies with the school or legal guardian, in accordance with article 8 GDPR (parental consent required for minors under 15 in France);
• Learner data is limited to what is strictly necessary for the pedagogical activity;
• No profiling or automated decision-making is performed on learners.

Self-created student accounts. The « Study online » space is aimed at higher education and professional training. Creating an account is restricted to adults, who declare this when they register. As no institution is involved, there is no third party responsible for obtaining parental consent: we therefore do not open this space to minors. If we learn that an account was created by a minor, it is deleted.

11. Changes to this policy

This policy may be updated to reflect legal changes or changes in our processing. The date of the last update is indicated at the top of the page. We will inform you by email or via the platform in case of substantial change.

12. Contact us

For any question regarding this policy or your data:

• By email: rgpd@edu-tools.fr
• By post: 162 rue PDT F Mitterrand 91160 Longjumeau

← Back to home