Privacy policy

Léo Jayles — leo.jayles@edhec.com. For any question about your data or to exercise your rights, write to this address.

Account: email address, username, password (stored encrypted by Supabase, never readable), profile photo (optional), chosen language.

Sign-in with Google: if you choose “Continue with Google”, Google sends ACE your name, email address and Google profile photo. ACE never receives your Google password.

Revision: progress (mastered notes, flashcards, MCQ drafts), results in MCQs, mock exams and cases, revision time, points and rank, saved diagrams.

Activity: the time of your last activity on the site (updated at most once a minute while you are signed in), visible only to the administrator to see who is online.

Contributions: reviews (rating, optional comment, username or anonymous; without an account, always anonymous: to limit abuse, ACE keeps a hashed fingerprint of the browser's anonymous identifier and, for 24 hours, of the IP address), messages sent with “An idea? A problem?” (message, page, device and browser, optional screenshot, optional email if you are not signed in).

Essays: the texts sent for AI correction (Composition and Communication Skills), with their mark and feedback.

Audience measurement: for each page opened, with or without an account, the site records an identifier picked at random by your browser, the page, the day and where you came from (the referring site or link). Not your email, your account or your IP address. It is only used to count visits (the administrator's statistics); no advertising and no advertising tracker is used.

Usage statistics (PostHog): to understand how ACE is used and improve it, the site sends usage events to PostHog: pages viewed, course, chapter, key notes and tools opened, active time spent on a course, start, answers (right or wrong, time to answer), end or abandonment of an MCQ, drill or mock exam (with the score), flashcard sessions (number of cards, duration), questions asked to the assistant (never their text), rating of a published review, sign-in and review pop-ups shown and closed, sign-up and sign-in (with the method). PostHog also infers the device type, browser, approximate country and city (from the IP address, which is not kept) and the source of the visit (referring site, utm links). Without an account, events are linked to the random identifier described above (“ace-visitor”, renewed every 13 months), to recognise your browser from one visit to the next; signed in, to your account's internal identifier (a string of characters): never to your email, name or username. PostHog sets no cookie and stores nothing else in your browser; no recording of your sessions, nothing you type.

Providing the service (account, progress, results, essay correction, AI assistant): performance of the contract (the Terms).

Handling your requests and reports, preventing abuse (sending limit, daily AI limit): legitimate interest.

Measuring the site's audience and usage to improve it (anonymous statistics, no cookie): legitimate interest. You can object at any time: Account → Settings → My data → “Stop counting me”.

Publishing your review: your choice, when you publish it.

Supabase (database, accounts, files, account emails) and Vercel (website hosting).

Anti-robot protection: when you sign up, sign in or reset your password, Cloudflare Turnstile checks that you are not a robot. To do so, Cloudflare processes technical information (IP address, browser), for this purpose only.

Usage statistics: PostHog Inc., data hosted in the European Union (PostHog Cloud EU, Frankfurt, Germany). The IP address is not kept.

Essay correction: the essay text and topic are sent to Google (Gemini API) to be graded. Do not put personal information in your essays.

Course AI assistant: your question, the latest messages of the conversation and extracts from the course are sent to Google (Gemini API) to generate the answer. Neither your email nor your username is sent. The conversation history stays in your browser; only the number of questions asked per day is stored in your account. Do not put personal information in your questions.

ACE uses the paid tier of the Gemini API: Google does not use these texts to improve its products; it keeps them for a limited period, only to detect abuse.

Your data is never sold or used for advertising.

Some of these providers are located outside the European Union (notably in the United States); transfers are covered by the European Commission's standard contractual clauses or the Data Privacy Framework.

Your account data is kept as long as your account exists, then deleted within 30 days of your deletion request.

Messages sent without an account are kept for 12 months.

Audience measurements and usage statistics (PostHog) are kept for 25 months at most; your browser's identifier is renewed every 13 months.

Cookie: only one, your sign-in session (sb-…-auth-token, set by Supabase when you sign in). It is needed to stay signed in.

Local storage: your language, your light/dark theme, your current progress (also without an account), your favourites and drafts, and when you closed the sign-in pop-up (so it is not shown again for 3 days). This storage is needed for the site to work and is not used to track you. This is why no cookie banner is shown.

It also keeps the audience measurement identifier (“ace-visitor”, 13 months at most), used only to count visits to ACE and never shared. You can delete it at any time by clearing the site's data in your browser.

You can access, correct, export, object to the processing of, or request the deletion of your data by writing to leo.jayles@edhec.com.

To delete your account and all your data, write to leo.jayles@edhec.com: the deletion is done within 30 days.

You can also lodge a complaint with the CNIL (www.cnil.fr).