Privacy policy

Who is responsible

The controller of your personal data is Atlesque Media VOF. For anything about your data, email privacy@atlesque.dev.

Without an account

You can use every lesson without an account. Your progress (which lessons you finished, where you left off, and the radio's settings at that step) and your light or dark theme are kept in your own browser (localStorage). They never leave your device unless you sign in, and you can clear them with your browser's site data.

We don't use advertising, tracking cookies or third-party trackers. Fonts and all other files are served from this site itself.

What we store when you have an account

• Your email address, the date your account was created and the time you last signed in. Needed to sign you in and to know which progress is yours.
• Your lesson progress, the same data as in your browser, so it follows you to your other devices.
• Sign-in links: when you request one we store a hash of the link's code, your email address, a hash of your IP address, the page to return to and the time. The link works once, for 15 minutes. The IP hash is only used to limit how many links can be requested (10 per hour per IP address, 3 per email address).
• Sessions: one cookie (rl_session) keeps you signed in. It is strictly necessary for signing in, so it needs no consent. We only store a hash of its value, with the date it expires.

Why, and on what legal basis

• Your account, sign-in and saved progress: to provide the service you ask for when you sign in (GDPR art. 6(1)(b), performance of a contract).
• Limits on sign-in links, short-lived server logs and anonymous visit statistics: to keep the site secure, prevent abuse and see how it's used (art. 6(1)(f), legitimate interest).

We only email you sign-in links you asked for. No newsletters, no marketing, and we never sell or share your data.

Who processes it, and where

The site runs on Cloudflare (Cloudflare, Inc. and Cloudflare Ltd.), our processor under its Data Processing Addendum. Account data is stored in a Cloudflare D1 database restricted to the European Union. Sign-in emails are sent through Cloudflare Email Sending. Cloudflare's network handles requests in the data centre closest to you, and Cloudflare may process data in the United States under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.

Visit statistics come from Cloudflare Web Analytics, which sets no cookies and stores nothing on your device. It counts page views with the page address, referrer, browser and country, without identifying you.

How long we keep it

• Account and progress: until you delete your account.
• Sign-in links: removed 24 hours after they were requested.
• Sessions: 90 days, or until you sign out.
• Server logs (errors and request details, which can include your IP address): a few days, then deleted by Cloudflare.

Your rights

You have the right to access, correct, delete and take a copy of your data, to restrict or object to its processing, and to complain to a supervisory authority. In Account settings you can download your data and delete your account yourself: deletion removes your email address, your progress, your sessions and your sign-in links straight away. For anything else, email us and we'll answer within one month.

In Belgium the supervisory authority is the Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be.

Changes

If we change what we store or why, we update this page and its date.