Privacy policy

Data controller

INODICO, 7 Avenue du Maréchal Maunoury 77680, Roissy En Brie. For any question: contact@theatalk.com.

Data we collect

• Account (parent, or adult student): last name, first name, email, phone, password (stored encrypted, never in clear text), chosen website language (French or English) so that we write to you in your language.
• Teacher application: last name, first name, email, phone, password (encrypted), levels and age ranges taught, other languages spoken, availability given (optional), role-play or improvisation practice, introduction and introduction video (uploaded file or link to an online video), photo (optional, cropped into a square and stripped of its metadata, such as the GPS position). This information is only seen by our team; the video is never published. Once the teacher is approved, their photo and first name are shown to the families and students of their groups, never on the public website; they can change or remove their photo and video from “My profile”. The slots they offer to teach (“My slots”) are only seen, with their name, by our team; they are removed from them if the application is declined or the account deleted. If the application is declined, this information is deleted six months after our reply.
• Cancelled sessions: the sessions a family (or the student from 15) cancels, with their date and the account that cancelled them; seen by the group's teacher and our team. Deleted with the student.
• Video meetings: when our team invites you to a meeting, we record the invitation (meeting, date, email sent) and the time you first entered the room. A person invited without an account only gives us their name and email address, erased 30 days after the meeting; their access link is personal and only works until the end of the meeting. Meetings are not recorded; picture and sound go through our video conferencing provider, as for the classes.
• A student's personal access, created by their family if they wish: username chosen by the family (or, for accesses created before October 2026, an email address) and password (stored encrypted). No email address of the student is asked for. It only gives access to the student's group, classes and exercises, and to the video classes; the family can change its password or remove it at any time from their space.
• Messaging: messages exchanged on the platform between a teacher and the family or the student (text, attachments, author, date). They are only read by their participants; the parents of a minor student can read, without writing, their child's exchanges with their teachers. An email alert, without the content of the message, announces a new message. They are deleted with the family account, or when the student is anonymised.
• Homework: homework given by the teacher to the group or to some students, and the date each student marked it done. Seen by the student, their family and their teacher; deleted with the student's account.
• Teachers' notes: observations written by teachers about a student (progress, points to work on), with their author and date. They are read only by the student's current teachers and our team, never by other families; they are included in the export of your data and deleted with the student's account or when the student is anonymized.
• Class reviews: after each class, the teacher may mark a student absent (the family is told by email and in "My space") and share a report on the class with the family. The report is written from the teacher's notes with the help of an artificial intelligence service, which only receives the student's first name, the group's name, the date and those notes; the teacher reads it before sending it. Reports are only read by the family, the teacher and our team; they are included in your data export and deleted with the student's account or when it is anonymised.
• Class ratings: when leaving a video class, the student may rate it (stars, two short questions and an optional comment), for a week. Ratings are only read by the group's teacher and our team; they are included in your data export and deleted with the student's account or when it is anonymised.
• Students: title, last name, first name, date of birth, English level, available time slots and other availability given (day and time), number of classes wished per week, preferred start date of the classes, and optionally their own email and phone.
• Purchases: trial course and course packs bought for each student (kind and number of courses, price, date, payment status, Stripe payment reference). Courses may also be added by our team, offered or paid outside the platform: we then record the payment method (bank transfer, cash, cheque) and an internal note (cheque number, transfer reference…). The site collects no bank details: payment is made on Stripe's secure page. Invoices and credit notes: billing name and address entered on the payment page, account email, student's name, details and amount of the purchase. Courses used: each class held by the group counts one course, to compute the courses left. Deleted with the family account; kept without personal data when the account is anonymised.
• Class organisation: groups, assignment history, emails sent to the groups.
• Video classes: first name and initial of the last name shown in the room, image, voice and chat messages transmitted live to the participants of the class (camera and microphone can be turned off; the chat is not kept), attendance (arrival and departure times, connected time). Image and voice are not kept, unless class recording is enabled: a banner then says so before entering and during the class.
• Contact form: last name, first name, email, phone (optional), message.
• Consent: date and version of this policy accepted when registering or contacting us.

The date of birth is only used to determine the student's age range, in order to offer suitable time slots and a suitable group.

Why, and on what legal basis

• Managing registrations, forming groups and organising classes: performance of the contract (or pre-contractual measures).
• Communicating with you and your group (practical information, time slot changes): performance of the contract.
• Answering your contact requests: legitimate interest / pre-contractual measures.
• Securing the website and accounts (limiting attempts, technical logs): legitimate interest.

We do not use your data for advertising purposes and never sell it.

Who has access

• The English in Action team, to organise the classes.
• Teachers, only for their own groups: first name, last name, age and level of the students (not your contact details), and the teachers' notes about these students.
• Our technical providers (hosting, email delivery), strictly within the scope of their mission: [To be completed: list of processors].
• Stripe (Stripe Payments Europe), which collects card payments on its own page: it receives the account email, the amount and the details of the order, and collects the bank details and billing address itself.
• LiveKit (LiveKit Cloud), which carries the image and sound of the video classes; the room is only open to the participants of the group, during the time slot.

Emails sent to a group are sent as blind copies: families do not see each other's addresses.

How long

• Accounts and students: for the duration of the registration, then 36 months after the end of the activity; the data is then anonymised (only statistics without personal data remain).
• Contact messages: 12 months.
• Invoices and credit notes: 10 years from the end of the financial year (legal obligation, article L123-22 of the French Commercial Code), including after the account is deleted or anonymised.
• Video class attendance: like the student's data. Class recordings (if enabled): kept in our storage space, only accessible to our team, for [To be completed: retention period of the recordings].
• Password reset links: 1 hour (7 days for an invitation).

Minors

For a minor student, the account is created and managed by a parent or legal guardian, who exercises the rights below on behalf of their child and decides whether the child gets a personal access.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data.

• From your account (app): download all your data in JSON format and delete your account together with all of your children's data.
• From "My space": delete a student from your account, with their personal access, messages, their teachers' notes and remaining classes (their invoices are kept, see above).
• Or by writing to us at contact@theatalk.com.

You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Cookies

This website only uses cookies it needs to work. They are required to use the site (login, forms, video classes): a banner tells you about them on your first visit and asks you to accept them. No analytics, advertising or social media cookie is set, and these cookies send no data to third parties.

• Session (PHPSESSID): keeps you logged in during your visit; deleted when you close your browser.
• Persistent login (REMEMBERME): set if "Stay logged in" is ticked when you log in; 7 days, deleted when you log out.
• Form protection (csrf-token…): checks that the forms sent come from the site; for the visit.
• Cookie choice (cookie_consent): remembers that you accepted the banner; 13 months, then the banner is shown again.

During a video class, your browser also keeps, on your device only (local storage), the camera and microphone you chose and your presence in the room; this information is not sent to us.

You can delete these cookies at any time in your browser settings; you will then be logged out and the banner will appear again.

The introduction video, if it is hosted on YouTube or Vimeo, is only loaded when you click "play" (YouTube in "privacy-enhanced" mode, Vimeo without tracking). Before that click, no data is sent to these services. The same goes for the YouTube videos of the courses, in your space and on the board of the video class: each one is only loaded when you click "play".

Security

Encrypted connections, hashed passwords, role-based access (family, teacher, administration), protection against repeated attempts.

The registration, teacher application and contact forms are protected against robots by an "I'm not a robot" box (ALTCHA): your browser solves a small calculation given by our site. This service is hosted by us: it sets no cookie and sends no data to any third party.

This English version is provided for convenience; the French version prevails.