Last updated: 28 June 2026 This policy explains how MentivisOS Open (hereinafter “Open”) collects, uses and protects your personal data when you use the service. Open is a free web platform, open to everyone, which offers training content generated by artificial intelligence. We attach importance to the protection of your privacy and are committed to processing your data fairly and transparently. 1. Data controller and contact The controller of your personal data is Mentivis, a simplified joint-stock company (SAS) with share capital of 10,000 euros, registered with the Paris Trade and Companies Register under number SIREN 941 914 814, whose registered office is located at 60 rue François Ier, 75008 Paris, France. For any questions relating to your personal data or to exercise your rights, you can write to us at the dedicated contact address: dpo@mentivis.com. This address is a contact address for your personal data. To date, Mentivis has not appointed a data protection officer. 2. Data we collect We collect the following categories of data. Mandatory data at registration - Your email address - Your password (stored in a hashed and non-reversible form, never kept in plain text) - Your first name and last name - Your postal code and your country - Your training objective Optional data - Your phone number - The documents you choose to upload (for example a CV) Data received when logging in via Google or Microsoft (SSO) When you choose to log in via Google or Microsoft (SSO), we receive from your provider the information necessary to create your account, namely your email address, your name and a unique account identifier. Data collected automatically - Your IP address - Technical connection data (activity logs: date and time of connection, type of device and browser) Your IP address and your connection data are used for security purposes as well as for the prevention and detection of abuse and fraud. We do not collect your date of birth and do not carry out any age verification, as the service does not contain sensitive content. 3. Why we use your data and on what legal basis We use your data for the following purposes. - To create and manage your account, including when you log in via Google or Microsoft (SSO), this login method being a choice you make to access your account. Legal basis: performance of the contract constituted by our general terms of use. - To provide the training service and personalize your learning paths according to your objective and the content you provide. Legal basis: performance of the contract. - To adapt the service to your geographic context and to compile usage statistics by region based on your postal code and country. Legal basis: performance of the contract and our legitimate interest in understanding and improving use of the service. - To manage usage limits linked to the free model (for example the number of sections per day or the number of learning paths). Legal basis: performance of the contract. - To ensure the security of the service, and to prevent and detect abuse and fraud, in particular using your IP address and your connection data. Legal basis: our legitimate interest in protecting the service and its users. - To respond to your support requests. Legal basis: our legitimate interest in providing you with support. - To comply with our legal and regulatory obligations. Legal basis: compliance with a legal obligation. - To send you, where applicable, information emails or presentations of our offers (newsletter, presentation of the Pro offer). Legal basis: your consent, which you can withdraw at any time using an unsubscribe link included in each email. 4. Special case of minors The service is open to minors. Minors aged 15 or over can create an account on their own. Minors under 15 must first obtain the consent of a holder of parental authority. By registering, you declare that you have this consent if you are under 15. A parent or holder of parental authority may at any time request the deletion of their child’s account by writing to dpo@mentivis.com. 5. AI-generated content and your data The educational content (learning paths, modules, lessons, exercises) is generated by artificial intelligence. To produce your training, we may transmit to artificial intelligence providers the information necessary, including, where applicable, the content of the documents you upload. The documents and content you upload are not used to train or improve artificial intelligence models. They are used solely to provide you with the training service. We use artificial intelligence providers within a contractual framework that excludes the reuse of your content for training their models and that does not provide for the retention of this content beyond the processing necessary for your training. 6. With whom your data is shared Your data is never sold. It may be shared with the following recipients and processors, only to the extent necessary for the operation of the service. - o2switch, our hosting provider, located in France (European Union), which provides hosting of the service and delivery of emails we send you. - Cloudflare, which provides technical management of domain names (DNS) and redirection. - Google and Microsoft, when you use login via their services (SSO), which may involve data transfers outside the European Union. - Generative artificial intelligence providers, including OpenAI, Anthropic, Google, Microsoft, Perplexity and Mistral, as well as other providers depending on use and its evolution. Some of these providers are located outside the European Union. When data is transferred outside the European Union, such transfers are governed by appropriate safeguards, in particular standard contractual clauses approved by the European Commission or, where applicable, an adequacy decision of the European Commission covering the destination country. The list of artificial intelligence providers actually used is kept up to date, and you are informed by an appropriate means if a new provider located outside the European Union is added. 7. How long we keep your data - Account and profile: kept as long as your account is active. In the event of inactivity, your account is deleted or anonymized 12 months after your last login. You may also request immediate deletion at any time. - Uploaded documents (for example a CV): deleted at the latest when your account is closed. You can also delete them manually at any time. Content transmitted to artificial intelligence providers is not retained by them beyond the processing necessary to generate your training. - Technical connection logs: kept for 12 months. - Data relating to security and the fight against abuse, including your IP address: kept for up to 12 months, unless it is necessary to keep them longer for the establishment, exercise or defense of legal claims. - Data relating to your support requests: kept for the duration of processing your request and then archived for up to 3 years for relationship follow-up and evidentiary purposes. - Data related to information emails: kept until you withdraw your consent. Proof of your consent is kept for 3 years from its withdrawal or from your last contact, in accordance with CNIL recommendations. 8. Your rights In accordance with regulations, you have the following rights over your personal data: - Right of access to your data - Right to rectification of your data - Right to erasure of your data - Right to object to processing - Right to restriction of processing - Right to portability of your data - Right to withdraw your consent at any time, where processing is based on consent You can exercise these rights by writing to dpo@mentivis.com. You can also delete your account yourself directly from your “My account” area, or by requesting deletion from us at dpo@mentivis.com. If you consider that your rights are not being respected, you may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), www.cnil.fr. 9. Cookies and trackers At present, the service uses only cookies that are strictly necessary for its operation, which do not require your consent. These include session and login cookies, security cookies, the cookie storing your choice regarding cookies, and the cookie storing your display theme preference. In the future, we may implement other categories of trackers, for example audience measurement tools or third-party trackers. These trackers will only be activated after obtaining your consent, which you can give or refuse via the cookie management banner. 10. Data security We implement appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure or alteration. In particular, your password is stored in hashed form and is never kept in plain text. Access to your data is limited to the persons and providers who need it for the operation of the service. 11. Changes to the policy We may update this privacy policy, in particular to take account of changes to the service, new tools or developments in regulations. In the event of a significant change, you will be informed by an appropriate means. The “last updated” date at the top of this page allows you to know which version applies.