Privacy policy (GDPR)

Controller and contact

France Student Hub decides why and how the personal data described here is processed and is therefore the data controller within the meaning of Article 4(7) GDPR. For any privacy question or request, write to yafemedo@gmail.com. The full identity and address of the publisher are set out in the legal notice.

What we collect and why

We only process data we actually need, for the purposes listed below (Article 5(1)(c) GDPR, data minimisation).

• •Account data (email, and optionally name, nationality, study level, target city and intake) — to create and operate your account. Legal basis: performance of a contract, Article 6(1)(b).
• •Guidance and contact requests (name, email, nationality, topic, plan, message) — to answer you and deliver a requested service. Legal basis: contract or pre-contractual steps, Article 6(1)(b).
• •Orders and payments (plan, amount, currency, status, payment reference) — to process a purchase and meet accounting obligations. Legal basis: contract, Article 6(1)(b), and legal obligation, Article 6(1)(c). Card details are never received or stored by us; they are handled by our payment provider.
• •AI assistant questions — to answer you and to identify gaps in our guides. Legal basis: legitimate interest in improving the service, Article 6(1)(f). Please do not enter identity-document numbers or health data in the chat.
• •Content feedback (helpful / not helpful and an optional comment) — to improve our content. Legal basis: legitimate interest, Article 6(1)(f).
• •Newsletter address — sent only if you subscribe. Legal basis: consent, Article 6(1)(a); you may withdraw it at any time.
• •Tool data (budget calculator, roadmap, checklists) — saved in your browser and, if you are signed in, in your account so you can return to it. Legal basis: contract, Article 6(1)(b).

No sensitive data, no automated decisions

We do not intentionally collect special-category data (Article 9 GDPR) such as health, religion or biometric data, and we do not use your data for automated decision-making or profiling with legal effects (Article 22 GDPR). The AI assistant produces informational answers only; it never issues an official decision.

Recipients and processors

Your data is not sold or rented. It is shared only with processors acting on our documented instructions under Article 28 GDPR:

• •Our hosting, database and authentication provider, which stores the application data.
• •Our payment provider, which processes card, wallet and bank payments and is an independent controller for fraud prevention and regulatory purposes.
• •Our AI model provider, which processes the text of a question in order to generate an answer.
• •Public authorities, only where we are legally required to disclose data.

International transfers

We aim to keep data in the European Union. Where a processor operates outside the EEA, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses together with additional safeguards (Chapter V GDPR). You may ask us for a copy of the relevant safeguard.

How long we keep data

Retention is limited to what each purpose requires:

• •Account data: for as long as your account exists, then deleted within 30 days of a deletion request.
• •Guidance and contact requests: 3 years from our last exchange with you (standard CNIL guidance for prospect and client relations).
• •Orders and invoices: 10 years, as required by French commercial and tax law.
• •AI questions and content feedback: 24 months, then deleted or anonymised.
• •Newsletter address: until you unsubscribe, then a suppression record only.

Your rights

Under Articles 15 to 22 GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to portability, and to withdraw consent at any time without affecting past processing. You may also give instructions on the fate of your data after your death (Article 85 of the French Data Protection Act). Write to yafemedo@gmail.com; we answer within one month. If you believe your rights are not respected, you may lodge a complaint with the CNIL (cnil.fr) or with your national supervisory authority.

Cookies and local storage

This site does not use advertising or third-party tracking cookies. We use only what is strictly necessary to run the site — a session cookie when you sign in — which under Article 82 of the French Data Protection Act does not require consent. Calculator and roadmap answers are stored in your browser's local storage and can be cleared at any time from your browser settings. If we ever add measurement or marketing cookies, we will ask for your consent first through a banner that lets you refuse as easily as accept.

Security

Access to stored data is restricted by row-level database rules so that a signed-in user can reach only their own records, and administrative data is limited to authorised administrators. Data is encrypted in transit. No system is perfectly secure; in the event of a personal data breach likely to result in a risk to your rights, we notify the CNIL within 72 hours and inform affected users where required (Articles 33 and 34 GDPR).

Children

The service is intended for users aged 15 and over, the age of digital consent in France. If you are younger, please use the service only with the involvement of a parent or guardian.

Changes

We may update this policy to reflect legal or technical changes. Material changes will be signalled on this page with a new effective date.