Privacy Policy

This Privacy Policy describes how KrafTeach (krafteach.com), published by EI Romain Ferré (SIRET 514 429 240 00039), processes personal data in connection with the service described in the Terms of Service.

Effective date: TBD

1. Who is responsible for your data

Regarding the teacher's own account data (name, email, profile photo, usage history), KrafTeach is the data controller. Regarding student data entered by the teacher (e.g. first names, gender, birth date) to generate a class's resources, the teacher is the data controller and KrafTeach acts only as the data processor within the meaning of Article 28 GDPR — meaning KrafTeach processes that data solely on the teacher's instructions and for the purpose the teacher chose it for.

2. What data is collected

Account data: name, email address and profile photo provided by Google sign-in, plus an optional username. Class data, entered by the teacher: student first names, and optionally gender and birth date, used only to personalize the generated PDF resources. Usage data: a history of past generations (class, generator used, date, options chosen) shown back to the teacher in their own dashboard.

3. Why this data is processed, and on what legal basis

Account and class data are processed to perform the contract between the teacher and KrafTeach (Art. 6.1.b GDPR): creating an account, generating and emailing the requested PDF resources, and showing generation history. Where KrafTeach offers a paid Prime tier, payment records are processed to comply with a legal accounting obligation (Art. 6.1.c GDPR). No data is used for advertising, and none is sold to third parties.

4. Who this data is shared with

Data is hosted on servers operated by OVH SAS (France/EU). Generated PDFs are sent by email through Resend, an email delivery provider. Sign-in is handled by Google. Once available, payments will be processed by Stripe. Each of these providers only receives the data strictly necessary to perform its function, under its own applicable data processing terms.

5. How long data is kept

Account and class data are kept for as long as the account is active. Payment records (once the Prime tier launches) are kept for 10 years to comply with French accounting-retention rules, even after an account is deleted, as described below. Precise retention periods for inactive accounts and technical logs are still under review (TBD) and will be detailed here once finalized.

6. Your rights

For data that KrafTeach controls (your account data), you have the right to access, rectify, restrict, object to the processing of, and receive a copy of your data (portability), by contacting KrafTeach at the address below. For student data you entered as a teacher, you — not KrafTeach — are the controller: your own class-management tools already let you edit or remove a student or a class directly.

Right to erasure (deleting your account)

You can delete your own account at any time from your profile page, without needing to contact anyone: after typing your email to confirm, your account is anonymized immediately (name, email, photo and username removed) and every class, student and group you own is permanently deleted. This also erases the student names in your generation history, though the history entries themselves (date, generator used, counts) are kept for support purposes. If you'd rather have KrafTeach handle this for you, contact the email below and an administrator will process the deletion on your behalf, within one month as required by Art. 12.3 GDPR. Payment records, where applicable, are kept afterward for the legal accounting-retention period described above.

7. Security

Access to class and student data is restricted server-side to the account that owns it, re-verified on every request rather than trusted from the browser. Student names and other user-provided text are escaped before being inserted into generated documents or emails to prevent injection.

8. Cookies and analytics

KrafTeach uses Umami, a self-hosted, privacy-friendly analytics tool that does not use cookies and does not collect personal data, hosted on the same OVH infrastructure as the rest of the service. No cookie consent banner is required as a result.

9. International data transfers

Some providers listed above (e.g. Google, Resend) may process data outside the European Union. Where this is the case, it relies on the safeguards required by GDPR (such as standard contractual clauses). The exact list of safeguards per provider is under review (TBD) and will be detailed here.

10. Filing a complaint

If you believe your data protection rights have not been respected, you can lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority, at www.cnil.fr.

11. Changes to this policy

KrafTeach may update this Privacy Policy, in particular to reflect changes to the service or applicable regulations. Users will be notified of any material change before it takes effect.

12. Contact

For any question regarding this Privacy Policy, or to exercise your rights: admin@krafteach.com