Privacy.

Who is responsible

JB Advisory, a French simplified joint-stock company (société par actions simplifiée), whose registered office is at 144 avenue de Malakoff, 75016 Paris, France, is the controller of your data for this website and for the app (app.upsilar.com).

A question, a request: contact@upsilar.com.

The website

You can read the website without an account and without giving us any information. We use no advertising cookies, no audience-measurement tool and no tracking pixel, and the typefaces are served by the site itself: no request is sent to a third-party font service.

• In your browser, never sent to us. Whether you have seen the homepage introduction and, if you take the short mock exam, your answers and progress, kept for seven days so you can pick up where you left off. Clearing the site's data in your browser erases them.
• At the host. Like any website, this one is served by a hosting provider, which sees your IP address and the pages requested for as long as it takes to send them and to protect the service.
• If you write to us. We use your address and your message to answer you, nothing else. Legal basis: our legitimate interest in answering the requests addressed to us.

The app

To use the app, you create an account. The service is open to people aged 15 or over. Here is what we then process, and why.

• Your account. Your e-mail address, your password — which we never see in clear text: our authentication service keeps only a fingerprint of it —, your first and last name if you provide them, the date your account was created and that of your last sign-in. If you choose to sign in with Google or Apple, that service sends us your e-mail address and your name; we do not receive your password. Why: to create your account and protect it. Legal basis: performance of the service you request.
• Your sign-up questionnaire. The test you are preparing for, the month you take it, your target schools, any previous attempt and its best score, the length of your sessions, your working days per week, and how you heard about us. Why: to build your study plan; the last answer also tells us which channels work. Legal basis: performance of the service, and our legitimate interest for the last answer.
• Your learning activity. Your answers, your attempts and their results, the topics you master, your progress, your favourite questions, your settings and your achievements. These calculations are automatic, but they only serve to order your work: no decision that binds you follows from them. Why: to measure what you master and recommend what to work on, in what order. Legal basis: performance of the service.
• The AI Coach. When you consult it from your results, your message and what is needed to answer (the question, your answer, the topics involved) are sent to OpenAI, which produces the answer. We send neither your name nor your e-mail address: OpenAI only receives a pseudonymised identifier, and we ask it not to store the exchange. Avoid writing personal information in it. Why: to answer your request. Legal basis: performance of the service.
• Service e-mails. Account confirmation, password reset, a school's invitation. Legal basis: performance of the service.
• Information e-mails. Only if you tick the box offered at sign-up: study tips and news about the test you are preparing for. We keep the date of your consent. Legal basis: your consent, which you can withdraw at any time by writing to us.
• Security. Our hosts' technical logs (IP address, date and nature of requests) are used to detect abuse and protect accounts. Legal basis: our legitimate interest in securing the service.

We do not sell your data and do not pass it on to any advertiser.

Who receives your data

Your data is accessible only to us and to the technical providers below, which act on our behalf.

Netlify, Inc. ↗

Hosting of the website and of the app, and technical logs of requests. United States, worldwide delivery network.

Supabase, Inc. ↗

Database and authentication of the app: your account, your questionnaire, your activity. United States (Ohio).

OVHcloud ↗

Domain name and the contact mailbox: the messages you write to us. France.

OpenAI ↗

AI Coach, only when you consult it from your results. United States.

Resend ↗

Sending invitation e-mails, when a school invites you to join Upsilar. United States.

Outside the European Union

Several of these providers are US companies, and the app's database is hosted in the United States. These transfers rely on the mechanisms provided by the GDPR: the EU–US Data Privacy Framework where the provider is certified under it, or, failing that, the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards.

How long we keep it

• Your account and your activity: as long as your account exists. If you ask for it to be deleted, we erase the account and the data attached to it within one month.
• Your messages to contact@upsilar.com: as long as it takes to deal with your request.
• The short mock exam: seven days in your browser, then the copy is deleted.
• Technical logs: the short period set by each of our hosts.

Your rights

You can ask to access your data, to have it corrected or erased, to restrict its use, to object to it, to receive it in a reusable format, and withdraw at any time a consent you have given. You can also tell us what should become of your data after your death.

Just write to contact@upsilar.com, from your account's address: that way we can recognise you without asking for an identity document. We reply within one month.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority, cnil.fr ↗, or with the authority of the country where you live.

Cookies and local storage

We use no advertising cookies and no audience-measurement tool, on the website or in the app: no consent banner is therefore needed. The app keeps in your browser the session that keeps you signed in and a few interface settings; they are essential to the service and stay on your device.