<p>Last updated: June 28, 2026</p> <p>This policy explains how ICIA (hereinafter “ICIA”) collects, uses, and protects your personal data when you use the service. ICIA is a free web platform open to all, which offers training content generated by artificial intelligence. We attach importance to the protection of your privacy and are committed to processing your data fairly and transparently.</p> <h3>1. Controller and contact</h3> <p>The controller of your personal data is the company Mentivis, a simplified joint-stock company (SAS) with share capital of 10,000 euros, registered with the Paris Trade and Companies Register under number SIREN 941 914 814, whose registered office is located at 60 rue François Ier, 75008 Paris, France.</p> <p>For any question relating to your personal data or to exercise your rights, you can write to us at the dedicated contact address: <a href="mailto:dpo@mentivis.com">dpo@mentivis.com</a>.</p> <p>This address is a contact address for your personal data. As of today, Mentivis has not appointed a data protection officer.</p> <h3>2. Data we collect</h3> <p>We collect the following categories of data.</p> <h4>Mandatory data at registration</h4> <ul> <li>Your email address</li> <li>Your password (stored in a hashed and non reversible form, never stored in plain text)</li> <li>Your first name and last name</li> <li>Your postal code and your country</li> <li>Your training objective</li> </ul> <h4>Optional data</h4> <ul> <li>Your telephone number</li> <li>The documents you choose to upload (for example a CV)</li> </ul> <h4>Data received when logging in via Google or Microsoft (SSO)</h4> <p>When you choose to log in via Google or Microsoft (SSO), we receive from your provider the information necessary to create your account, namely your email address, your name, and a unique account identifier.</p> <h4>Data collected automatically</h4> <ul> <li>Your IP address</li> <li>Technical connection data (activity logs: date and time of connection, type of device and browser)</li> </ul> <p>Your IP address and your connection data are used for security purposes and for the prevention and detection of abuse and fraud.</p> <p>We do not collect your date of birth and we do not carry out any age verification, since the service does not contain sensitive content.</p> <h3>3. Why we use your data and on what legal basis</h3> <p>We use your data for the following purposes.</p> <ul> <li>To create and manage your account, including when you log in via Google or Microsoft (SSO), this login method being a choice you make to access your account. Legal basis: performance of the contract constituted by our terms of use.</li> <li>To provide the training service and personalize your learning paths according to your objective and the content you provide. Legal basis: performance of the contract.</li> <li>To adapt the service to your geographical context and compile usage statistics by region based on your postal code and your country. Legal basis: performance of the contract and our legitimate interest in understanding and improving the use of the service.</li> <li>To manage usage limits linked to the free model (for example the number of sections per day or the number of learning paths). Legal basis: performance of the contract.</li> <li>To ensure the security of the service, and to prevent and detect abuse and fraud, in particular by means of your IP address and your connection data. Legal basis: our legitimate interest in protecting the service and its users.</li> <li>To respond to your support requests. Legal basis: our legitimate interest in providing you with support.</li> <li>To comply with our legal and regulatory obligations. Legal basis: compliance with a legal obligation.</li> <li>To send you, where applicable, informational emails or emails presenting our offers (newsletter, presentation of the Pro offer). Legal basis: your consent, which you can withdraw at any time using an unsubscribe link included in each email.</li> </ul> <h3>4. Specific case of minors</h3> <p>The service is open to minors. Minors aged 15 or over can create an account on their own. Minors under 15 must first obtain the consent of a holder of parental authority. By registering, you declare that you have this consent if you are under 15 years of age.</p> <p>A parent or holder of parental authority may at any time request the deletion of their child's account by writing to <a href="mailto:dpo@mentivis.com">dpo@mentivis.com</a>.</p> <h3>5. Artificial intelligence generated content and your data</h3> <p>The educational content (learning paths, modules, lessons, exercises) is generated by artificial intelligence. To produce your training, we may transmit to artificial intelligence providers the information necessary, including, where applicable, the content of the documents you upload.</p> <p>The documents and content you upload are not used to train or improve artificial intelligence models. They are used solely to provide you with the training service. We use artificial intelligence providers within a contractual framework that excludes the reuse of your content to train their models and that does not provide for the retention of this content beyond the processing necessary for your training.</p> <h3>6. With whom your data is shared</h3> <p>Your data is never sold. It may be shared with the following recipients and processors, only to the extent necessary for the operation of the service.</p> <ul> <li>o2switch, our hosting provider, located in France (European Union), which provides hosting of the service and routing of the emails we send you.</li> <li>Cloudflare, which provides technical management of domain names (DNS) and redirection.</li> <li>Google and Microsoft, when you use login via their services (SSO), which may involve data transfers outside the European Union.</li> <li>Providers of generative artificial intelligence, in particular OpenAI, Anthropic, Google, Microsoft, Perplexity, and Mistral, as well as other providers depending on uses and their evolution. Some of these providers are located outside the European Union.</li> </ul> <p>When data is transferred outside the European Union, these transfers are governed by appropriate safeguards, in particular standard contractual clauses approved by the European Commission or, where applicable, an adequacy decision of the European Commission covering the destination country. The list of artificial intelligence providers actually used is kept up to date, and you are informed by an appropriate means if a new provider located outside the European Union is added.</p> <h3>7. How long we keep your data</h3> <ul> <li>Account and profile: kept as long as your account is active. In the event of inactivity, your account is deleted or anonymized 12 months after your last login. You can also request immediate deletion at any time.</li> <li>Uploaded documents (for example a CV): deleted at the latest when your account is closed. You can also delete them manually at any time. Content transmitted to artificial intelligence providers is not retained by them beyond the processing necessary to generate your training.</li> <li>Technical connection logs: kept for 12 months.</li> <li>Data relating to security and the fight against abuse, including your IP address: kept for up to 12 months, unless it is necessary to keep it longer for the establishment, exercise, or defense of legal claims.</li> <li>Data relating to your support requests: kept for the duration of the processing of your request and then archived for up to 3 years for relationship follow up and evidential purposes.</li> <li>Data relating to informational emails: kept until you withdraw your consent. Proof of your consent is kept for 3 years from its withdrawal or from your last contact, in accordance with the recommendations of the CNIL.</li> </ul> <h3>8. Your rights</h3> <p>In accordance with the regulations, you have the following rights over your personal data:</p> <ul> <li>Right of access to your data</li> <li>Right to rectification of your data</li> <li>Right to erasure of your data</li> <li>Right to object to processing</li> <li>Right to restriction of processing</li> <li>Right to data portability</li> <li>Right to withdraw your consent at any time, where processing is based on your consent</li> </ul> <p>You can exercise these rights by writing to <a href="mailto:dpo@mentivis.com">dpo@mentivis.com</a>.</p> <p>You can also delete your account yourself directly from your “My account” space, or by asking us to do so at <a href="mailto:dpo@mentivis.com">dpo@mentivis.com</a>.</p> <p>If you believe that your rights are not being respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), <a href="https://www.cnil.fr">www.cnil.fr</a>.</p> <h3>9. Cookies and trackers</h3> <p>As of today, the service uses only cookies that are strictly necessary for its operation, which do not require your consent. These include session and login cookies, security cookies, the cookie that records your choice regarding cookies, and the cookie that records your display theme preference.</p> <p>In the future, we may implement other categories of trackers, for example audience measurement tools or third party trackers. These trackers will only be activated after your consent has been collected, which you will be able to give or refuse by means of the cookie management banner.</p> <h3>10. Data security</h3> <p>We implement appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure, or alteration. In particular, your password is stored in hashed form and is never kept in plain text. Access to your data is limited to the persons and providers who need it for the operation of the service.</p> <h3>11. Changes to the policy</h3> <p>We may update this privacy policy, in particular to take into account changes to the service, new tools, or changes in regulations. In the event of a significant change, we will inform you by an appropriate means. The last updated date shown at the top of this page allows you to know which version applies.</p>