Privacy policy

1. Who are we?

Neuroptis is visual and cognitive training software for support professionals, published by Robin Kawka EI (Neuroptis), 9 rue de Zurich, 67000 Strasbourg, France, SIRET 10570578400012. Contact: hello@neuroptis.fr.

2. Two roles depending on the data

• Your data (account, subscription, billing): Robin Kawka EI is the data controller.
• Your beneficiaries’ data, which you enter in the application: you are the data controller and Neuroptis acts as a processor (Article 28 GDPR), under the conditions set out in Article 12 of the terms and conditions. Your beneficiaries exercise their rights with you.

3. Data collected

• Waiting list: email address, first name (optional), type of interest.
• Account: last name, first name, email address, hashed password, profile picture (optional).
• Google sign-in: Google ID, email, name and profile picture provided by Google.
• Billing: account type (individual or business), billing address (optional for an individual) and, for a business, company name, SIRET and VAT number (optional).
• Payment: handled by Stripe; we only keep the card type and its last 4 digits, never the full number.
• Beneficiaries’ data: first name, last name, date of birth, sex, laterality, visual skills to work on first, exercise results and free notes. This information may constitute sensitive data (including, depending on its content, health data): only enter what is necessary for the support you provide.
• Technical data: IP address, browser, access logs, for security and debugging purposes.

4. Signing in with Google

You can create your account and sign in to Neuroptis (website and desktop software) with your Google account, instead of an email and password. This is optional.

• Data we access: only the basic information of your Google profile (openid, email and profile scopes): Google ID, email address, first name, last name and profile picture. We do not access your emails, contacts, files, calendar or any other data in your Google account.
• Use: the Google ID and email address are only used to authenticate you and find your account; the first name, last name and picture pre-fill your profile. This data is not used for any other purpose: no advertising, no profiling, no training of artificial intelligence models.
• Storage: this data is stored in your Neuroptis account, on our servers (see “Recipients and processors”), and kept for as long as your account exists. We do not keep any access token to your Google account.
• Sharing: data obtained from Google is never sold or passed on to third parties, apart from our hosting provider for storage.
• Deletion and revocation: deleting your account erases this data. You can also ask for it to be deleted at hello@neuroptis.fr and revoke Neuroptis’s access at any time from your Google account settings.

The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Purposes and legal bases

• Performance of the contract: account management, provision of the Service, beneficiary follow-up, subscription, payment and invoicing.
• Legal obligation: issuing and keeping invoices and accounting records.
• Legitimate interest: security, fraud prevention, stability and improvement of the Service.
• Consent: waiting list and communications about product updates.

6. Recipients and processors

Your data is never sold. It is only shared with the following providers, for the needs of the Service:

• Railway (hosting, United States) — servers and databases, including beneficiaries’ data.
• Stripe (payment, United States / Ireland) — payments, subscriptions and invoices (name or company name, email, address, SIRET, VAT number).
• Resend (transactional email, United States) — sending emails.
• Sentry (monitoring, United States) — tracking technical errors.
• Google — only if you use Google sign-in.
• API Recherche d’entreprises (French public service) — only receives the SIRET number entered, to pre-fill the company name and address.

Transfers outside the European Union are governed by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework. A migration of hosting to OVHcloud, a provider located in France and certified HDS (French certification for hosting health data), is planned.

7. Retention period

• Waiting list: until you unsubscribe or the product is launched.
• Account and beneficiaries’ data: for as long as the account exists; deleted when the account is deleted.
• Invoices and accounting records: 10 years (legal obligation), including after the account is deleted.
• Technical logs: 7 days.

8. Your rights (GDPR)

You have the following rights over your data:

• Access and portability: obtain a copy of your data, including an export of your beneficiaries’ data.
• Rectification: correct inaccurate data, in particular from your account.
• Erasure: ask for your data to be erased or delete your account.
• Objection and restriction: object to processing or ask for it to be restricted.
• Withdrawal of consent: at any time for processing based on consent.

To exercise these rights or request an export: hello@neuroptis.fr. You can also lodge a complaint with the CNIL (French data protection authority) or with the supervisory authority of your country.

9. Cookies and audience measurement

We only use cookies that are strictly necessary for the Service to work (session, CSRF security, language preference). No advertising cookies or third-party trackers are used.

To understand how the website is used (pages viewed, referring site, device type, clicks on the main buttons), we carry out our own anonymous, cookie-free audience measurement: your IP address is not kept, and the technical identifier used to count visitors changes every day, which prevents us from following you from one day to the next or identifying you. These statistics are neither shared nor combined with other data, and are deleted after 13 months. They therefore do not require your consent.

10. Security

Communications are encrypted (HTTPS/TLS), passwords are hashed (bcrypt) and access to data is restricted to the account that entered it and to the practitioners with whom it shares that data. In the event of a data breach, the people concerned and, where applicable, the CNIL are informed under the conditions laid down by the GDPR.

11. Changes

This policy may be updated. In the event of a significant change, you will be informed by email. The date of the last update is shown at the top of this page.