Privacy Policy

In brief

This page describes the personal data we collect when you use IOAI Training, what it is used for, how long we keep it, who has access to it, and the rights you have over this data.

Data controller

Artix Technologies, reachable at contact@artix.tech.

Data collected

When creating an account:

• Email: to authenticate you and contact you again if needed
• Password: stored as a bcrypt hash, never in plain text
• Display name: nickname or first name, visible to other users in the leaderboards and recent activity
• Baccalaureate year (optional): used for aggregated educational statistics
• Profile type (student, coach, other) and referral code (optional)
• Communication preferences (platform information and Artix Technologies products, partners: educational institutions, companies, recruiters): can be changed at any time

During use:

• Progress: exercises viewed, exercises solved, number of attempts, scores
• Submitted or run code for the programming exercises, intermediate versions of your code while you write it (at most every two minutes), and evaluation results
• Exercise ratings (ratings from 0 to 5 stars): aggregated for coaches
• Technical event logs (login, navigation between exercises, session duration, device type, and every 30 seconds while the tab is open: active or idle, number of keystrokes and clicks, without their content) to measure engagement, improve the exercises and detect abuse
• Bug reports and messages submitted to proof reviews
• IP address: used to limit abuse (registration, login, code runs) and, in truncated form, for traffic statistics
• Approximate connection country: derived from the IP address, for statistics and fraud prevention

Purposes and legal bases

Retention period

• Account data: kept as long as the account exists. When the account is deleted, everything that identifies you (email, username, password, school) is erased.
• Usage data (exercises, submitted or run code, attempts, page views): kept to improve learning recommendations. When the account is deleted, it is detached from your identity.

Data recipients

Your data is accessible to:

• The Artix Technologies team (data controller)
• OFIA coaches, for the educational follow-up of the students they supervise
• Our technical hosts (Scaleway for the servers, Cloudflare for DNS and anti-DDoS protection): processors within the meaning of the GDPR
• Google Workspace, for sending transactional emails (welcome, password reset) from the artix.tech domain: a processor within the meaning of the GDPR, certified under the EU-US Data Privacy Framework

Transfers outside the EU

Cloudflare is a US company. DNS and the protection layer go through their global network, which may involve a transfer of IP addresses outside the EU. Cloudflare is certified under the Data Privacy Framework EU-US and offers the European Commission's standard contractual clauses.

The main servers (database, code, exercise execution) remain hosted in France at Scaleway.

Cookies and local storage

The JWT authentication token is stored in the browser's localStorage, a use strictly necessary for authentication, exempt from prior consent according to the CNIL.

If in the future we add audience measurement, analytics or other trackers that are not strictly necessary, this policy will be updated and a consent banner will be shown to you before any placement.

Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

• Access: obtain a copy of all your data
• Rectification: correct inaccurate data
• Erasure: delete your account; data that identifies you is erased, usage measurements are kept with no link to your identity
• Restriction: freeze a processing operation during a dispute
• Portability: retrieve your data in a reusable format
• Objection: object to processing based on legitimate interest
• Withdrawal of consent for platform information and Artix Technologies products or for partners, at any time from your settings or the link in each email

To exercise any of these rights, write to us at contact@artix.tech. We reply within 30 days at most (and most often within 48 hours).

If you feel your rights are not being respected, you can refer the matter to the CNIL.

Minors

The platform is aimed primarily at high-school students. If you are under 15, your registration must be authorized by a parent or legal guardian. Upon written request, a legal representative can access the minor's data, request its correction or its deletion.

Changes

This policy may change. Substantial changes will be announced by email to active users at least 15 days before they take effect.