In short
- Learners' data
- Processed on behalf of your organization, which decides why and for whom. We act as its processor (article 28 GDPR).
- Visitors and security
- For the website, sign-in security and our own administration, Tokenacademy is the controller.
- Never
- No advertising, no selling of data, no training of AI models on your sessions. Audience measurement on the public website only, and only if you accept it.
- Where
- Hosted in the United States today (Vercel, Neon), error reports in the European Union (Sentry, Frankfurt).
- Your rights
- Access, correction, deletion, portability, objection: through your organization, answered within a month.
1Who is responsible for your data
Tokenacademy is used by organizations for their employees' training. For the data of learners and of the organization's learning designers and administrators, your organization is the controller: it decides to train you on Tokenacademy, who takes part and who follows the results. Tokenacademy acts as its processor, under a data processing agreement (article 28 of the GDPR), and processes this data only on its instructions. Your organization's own privacy notice also applies.
Tokenacademy is the controller for the public website, for the security of sign-in (the audit log, the protection against repeated attempts), and for the management of the relationship with our clients.
To reach us about your data, write to your organization's Tokenacademy administrator, who passes it on to us.
2What data we handle, and why
| Data | Why | Legal basis |
|---|---|---|
| Account: first and last name, email, password (stored only as a salted hash), photo if you add one, organization and team | Creating your account, signing you in, showing who you are to your organization | Your organization's contract with us; for it, its legitimate interest in training its staff |
| Company sign-in: your identity provider's identifier, email and the attributes it sends (such as department or groups) | Signing you in with your organization's account, placing you in the right team | Same as above |
| Learning: your sessions, what you write to the agent, the agent's answers and actions, the files of your project, milestones, tokens counted, scores, XP, rank | Running the sessions, checking milestones, the coach's feedback, the token report, progress and leaderboards within your organization | Same as above |
| Studio: the sessions you author, the files you upload, your conversation with the Studio's agent | Making and publishing sessions | Same as above |
| Security: IP address, the actions recorded in the audit log (sign-ins, changes of roles or settings), sign-in attempts and demo requests counted per address | Protecting accounts against fraud and abuse, investigating incidents | Our legitimate interest in the platform's security (article 6.1.f) |
| Technical: error reports (the page or request concerned, the browser's type), server logs | Keeping the platform working | Our legitimate interest |
| Demo requests: your name, job title, work email, phone, your company, its size and how many accounts it needs, where it stands with AI (training run, initiatives launched), your message | Answering your request and arranging a demo with you | Our legitimate interest in answering companies that ask about our services (article 6.1.f) |
| Visitors of the public website (the home page, the demo request page and these documents): pages viewed, an identifier stored in a cookie, the browser's type, the approximate location derived from the IP address | Measuring the website's audience with Google Analytics, never in the platform itself | Your consent, which you can withdraw at any time from Cookie settings (article 6.1.a) |
The platform does not ask for sensitive data and is not designed to hold it: please do not enter any (see the terms of use). We make no automated decision producing legal effects on you: a milestone validated by the platform is a training step, which your organization chooses how to use.
3AI providers
To answer you, the agents, the coach and the checks send the session's content (your requests, the conversation, the project's files) to an AI model provider. Only the content needed for each answer is sent, through our servers: providers receive no account details from us.
- Anthropic (Claude models), for every session;
- OpenAI, only for sessions an organization has set to use Codex.
Under their commercial API terms, these providers do not train their models on this content, and keep it only for a limited time to detect abuse. The agents' own telemetry is switched off in the cloud environments.
4Who else handles it
Your data is visible to the people of your organization allowed to see it (administrators, learning designers, and other learners for what the leaderboards and profiles show), and to the Tokenacademy staff who need it to run and support the platform. We use the following subprocessors:
| Provider | What for | Location |
|---|---|---|
| Vercel Inc. | Hosting the website and the application | United States |
| Neon (Databricks, Inc.) | Database | United States |
| E2B (FoundryLabs, Inc.) | Cloud environments in which projects are built, and their previews | United States |
| Anthropic, PBC | AI models | United States |
| OpenAI, L.L.C. | AI models, for Codex sessions only | United States |
| Functional Software, Inc. (Sentry) | Error reports, without the content of sessions | European Union (Germany) |
| Google LLC (Google Fonts) | Serving the typefaces of the application | United States |
| Google LLC (Google Analytics) | Measuring the public website's audience, if you accept it | United States |
| Your organization's identity provider | Company sign-in, when your organization uses it | As chosen by your organization |
We never sell your data, and share it with no one for their own marketing.
5Transfers outside the European Union
Several providers above are in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses adopted by the European Commission, included in each provider's data processing terms, with additional measures (encryption in transit and at rest, access limited to what each service needs). You can ask for a copy of these safeguards through your organization's Tokenacademy administrator, who passes it on to us.
6How long we keep it
| Data | Kept |
|---|---|
| Account, sessions, files, progress, Studio work | As long as your organization's contract runs, then deleted within three months of its end, unless the organization asks for an export or an earlier deletion |
| A learner removed by their organization | Deleted on the organization's request |
| Sign-in sessions | 30 days (12 hours with company sign-in), ended after 14 days without use or when you sign out |
| Audit log, including IP addresses | 400 days |
| Counts of sign-in attempts and of demo requests, per address | 25 hours |
| Cloud environments of sessions | Deleted minutes after a session ends or is left |
| Error reports | 90 days at most |
| Audience measurement of the public website | Its cookies 13 months, its data 14 months at most; your choice itself 6 months, then asked again |
| Demo requests | 3 years after the request is sent, unless you ask us to delete it sooner |
| Contract and billing records with organizations | 10 years, as French commercial law requires |
A page you choose to save and share may stay reachable by its link until it is deleted with your account.
7How we protect it
We apply technical and organizational measures suited to the risk, among them:
- encryption of every connection (HTTPS) and of the database at rest;
- passwords stored only as salted hashes, sign-in tokens stored only as hashes, secrets of company sign-in encrypted;
- each organization's learners kept apart: no one sees the learners, pages or rankings of another organization;
- each session's project run in its own isolated cloud environment, deleted afterwards;
- access by our staff limited to those who need it, and security-relevant actions recorded in an audit log;
- error reports that leave out the content of sessions, request bodies, cookies and user details.
If a breach affects your data, we tell your organization without undue delay so that it can meet its obligations, and the CNIL where we are the controller.
8Your rights
Under the GDPR and the French Data Protection Act, you have the right to:
- access your data and get a copy of it;
- have it corrected or completed;
- have it deleted;
- restrict its processing, or object to it on grounds relating to your situation;
- receive the data you provided in a structured, machine-readable format (portability);
- withdraw a consent you gave, at any time;
- give instructions on what happens to your data after your death.
Address your request to your organization's Tokenacademy administrator, who passes it on to us, giving your name and the email of your account. For learners' data, we act on your organization's instructions. If you asked for a demo, tell the person from Tokenacademy who contacts you about it. We answer within one month (three for a complex request, in which case we tell you why), and may ask you to prove your identity if we have a reasonable doubt.
You may also lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr) or with the supervisory authority of your country.
9Changes to this policy
We update this policy when the platform or the law changes; the date at the top says when it last did. We tell organizations of any material change, and of any new subprocessor, before it applies.