Legal
Privacy policy
This policy explains what personal data Coursewright collects, why we process it, how long we keep it and the rights you hold under the General Data Protection Regulation (GDPR).
Last updated August 1, 2026 · Coursewright SAS · Paris, France
1. Data controller
- Controller
- Coursewright SAS
- Place of business
- Paris, France
- Contact for privacy requests
- contact@coursewright.online
- Supervisory authority
- CNIL — Commission nationale de l'informatique et des libertés, Paris
Coursewright SAS decides why and how your personal data is processed when you visit the site, use the demo, or hold an account. Where we process lecture material on your instruction, we act as processor and you remain the controller of that content.
2. What we process and on what legal basis
| Data | Purpose | Legal basis | Source |
|---|---|---|---|
| Email address, password hash | Account creation, authentication, service emails | Contract (Art. 6(1)(b)) | You |
| Uploaded audio/video, pasted transcripts | Transcription and course-kit generation | Contract (Art. 6(1)(b)) | You |
| Generated course kits and your edits | Storing and displaying your library | Contract (Art. 6(1)(b)) | Produced by the service |
| Usage counters (lessons per month, plan) | Quota enforcement and billing accuracy | Contract (Art. 6(1)(b)) | Produced by the service |
| Truncated IP address for the public demo | Abuse prevention and rate limiting | Legitimate interest (Art. 6(1)(f)) | Your browser |
| Contact and newsletter form entries | Answering you, sending product updates | Consent (Art. 6(1)(a)) / Legitimate interest for replies | You |
| Cookie and analytics identifiers | Measuring site use, remembering preferences | Consent (Art. 6(1)(a)) except strictly necessary cookies | Your browser |
| Invoicing and accounting records | Legal bookkeeping obligations | Legal obligation (Art. 6(1)(c)) | You and our payment provider |
3. Processors and transfers
We use a small number of vetted processors: a database and authentication host, an AI provider for speech-to-text and text generation, an email delivery provider, and hosting/CDN infrastructure. Content sent to the AI provider is processed to return your course kit and is not used by us to train models.
Where a processor operates outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses together with technical measures such as encryption in transit and at rest.
4. Retention
| Category | Retention period | What happens next |
|---|---|---|
| Account data | For the life of the account | Deleted within 30 days of account closure |
| Uploaded media files | Processed then deleted within 24 hours | Only the transcript-derived kit remains |
| Course kits and edits | Until you delete them or close the account | Permanently deleted, backups purged within 30 days |
| Public demo runs and truncated IP | 30 days | Automatically deleted |
| Contact and lead form entries | 24 months from last contact | Deleted or anonymised |
| Newsletter subscription | Until you unsubscribe | Removed within 7 days |
| Invoices and accounting records | 10 years | Retained under French commercial law |
| Server and security logs | 12 months | Automatically rotated |
5. Your rights
Under the GDPR you may exercise the following rights at any time by writing to contact@coursewright.online. We answer within one month.
- 1Right of access — obtain a copy of the personal data we hold about you.
- 2Right to rectification — correct inaccurate or incomplete data.
- 3Right to erasure — have your data deleted where no legal obligation requires us to keep it.
- 4Right to restriction of processing — freeze processing while a dispute is resolved.
- 5Right to data portability — receive your account data and course kits in a machine-readable format.
- 6Right to object — object to processing based on our legitimate interests, including profiling.
- 7Right to withdraw consent — withdraw consent at any time, without affecting past lawful processing.
- 8Right to lodge a complaint — complain to the CNIL (cnil.fr) or your local supervisory authority.
6. Security
- TLS encryption for all traffic and encryption at rest for stored data.
- Row-level security so each account can only read its own records.
- Secrets such as AI provider keys are held server-side and never exposed to the browser.
- Least-privilege access for staff, with access reviewed when roles change.
- Media files are deleted after processing to reduce the amount of data at risk.
- Personal-data breaches affecting your rights are notified to the CNIL within 72 hours and to you without undue delay.
7. Children
Coursewright is a professional tool and is not intended for children under 16. If you teach minors, you remain responsible for the lawfulness of any recording you upload.
8. Complaints
Contact us first at contact@coursewright.online — we would rather fix a problem than have you escalate it. You may nevertheless lodge a complaint with the CNIL, 3 Place de Fontenoy, 75007 Paris, at any time.
These documents are templates provided for transparency, not legal advice. Have a qualified lawyer review them before relying on them for your own compliance.
Coursewright SAS · Paris, France · 2026 · contact@coursewright.online