This translation is provided for convenience. The French version is the only legally binding one and prevails in case of discrepancy. Read the French version
Last updated: September 4, 2026
Privacy Policy
Savora turns your courses into learning paths. To do that, we process data about you. This page explains which data, why, with whom, for how long, and what you can do about it. It is written to be read, not to be long.
1. Who is responsible
The data controller is Mathieu Dunand EI, marque Vascent, Entrepreneur individuel (EI), micro-entreprise, SIREN 106 038 516 · SIRET 106 038 516 00014, 200 rue de la Croix Nivert, 75015 Paris, France. For any question about your data: mathdunandpro@gmail.com.
2. The data we process, and why
Your account
| Data | Why | Legal basis |
|---|---|---|
| Email address | Create and secure your account, contact you | Performance of the contract |
| Password (hashed, never readable by us) | Authentication | Performance of the contract |
| Google identity (if you sign in with Google): email address, identifier | Password-free authentication | Performance of the contract |
| Username, avatar, language, daily goal, displayed title | Personalize your experience and your social profile | Performance of the contract |
| Where your sign-up came from: the source named in the link that brought you (for example "reddit" and the campaign name) | Knowing which channels bring people to Savora, without tracking you anywhere else | Legitimate interest |
Your courses
| Data | Why | Legal basis |
|---|---|---|
| The PDF files you import, the text we extract from them, the text or links you paste | Generate your path (units, lessons, exercises), the course chat, your reviews | Performance of the contract |
| The content generated from your courses (lessons, exercises, stories, essays) | Serve it to you and let you replay it | Performance of the contract |
Your files are stored in a private space: they can never be reached through a plain URL, only through the app, after checking that it is really you. When you share a course by code or on the marketplace, the recipient receives the extracted text and a path generated from it, never your original file.
Your progress
Experience points, streaks per subject, review history, badges, cosmetic items, coins and gems, quests, lesson and boss results. This data exists to make the game work and to show you your progress. Legal basis: performance of the contract.
Social features
Your friendships (the email address you enter to add someone is only used to find their account and is never displayed), your league ranking, your marketplace listings and the courses you enroll in. In leagues and friend lists, others see your username or, if you have none, the cleaned-up part of your email address before the @, and never your full address. Legal basis: performance of the contract.
Payment
If you go Pro or buy gems, payment is processed by Stripe. We never see or store your card. We keep a Stripe customer ID and the status of your subscription, so we know what to unlock for you. Legal basis: performance of the contract and accounting obligations.
Technical operation
| Data | Why | Legal basis |
|---|---|---|
| AI usage: which feature, which model, how many tokens, what cost, and not the content of your exchanges | Enforce quotas, control our costs, detect abuse | Legitimate interest |
| Push notification token (if you turn them on) | Send you the reminders you asked for | Consent |
| IP address | Limit the number of requests (anti-abuse). Kept for a few minutes to a few hours, never durably linked to your account. | Legitimate interest |
| Technical error reports | Fix bugs | Legitimate interest |
| Usage analytics (which screens, which actions), hosted in the European Union | Understand what works and improve the app | Legitimate interest |
3. Who we share it with
We do not sell any data. We use service providers, each for a specific task, each bound by contract:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Authentication and database | EU (Paris) |
| Vercel | App hosting and file storage | EU (Paris / Frankfurt) |
| Google (Gemini), OpenAI, Anthropic | Generating paths, exercises and answers. The text of your courses is sent to them to be processed, not to train their models. | United States |
| DeepSeek | Exercise generation, when this model is selected. The text of your courses is sent to it for processing. | China |
| Stripe | Payment | United States / EU |
| Upstash, Inngest | Rate limiting, and background jobs that build your path: the text of your course passes through Inngest. | EU / United States |
| Expo | Delivery of push notifications | United States |
| PostHog, Sentry | Usage analytics, error reports | EU |
Transfers to the United States are covered by the European Commission's standard contractual clauses or by the Data Privacy Framework, depending on the provider. China does not benefit from an adequacy decision of the European Commission: if you don't want your course content processed there, write to us and we will switch your account to a European or American model.
3a. Cookies and trackers
The website sets two kinds of things. What is strictly necessary for the service: your sign-in session, your language, and your choice below. And, only if you accept it, an analytics tracker (PostHog, hosted in the European Union) that tells us which screens actually help. Nothing is set before you choose, refusing is as easy as accepting, and you can change your mind at any time with the "Cookies" link at the bottom of the home page. The app itself sets no trackers.
4. How long
- As long as your account exists for everything above.
- A course or subject moved to the trash can be recovered for 30 days, then it is deleted for good, file included.
- Intermediate results generated by the AI and kept to avoid recomputing the same course are erased after six months without use.
- When you delete your account, everything is erased: your account, your courses, your progress, your files. It is immediate and cannot be undone.
- Technical logs (errors, rate limiting) are kept for a few weeks at most.
- Accounting records related to a payment are kept for the legally required period (10 years).
5. Your rights, and how to exercise them without writing to us
You have the right to access your data, correct it, receive it in a readable format, erase it, object to certain processing and restrict its use. The simplest way:
- Export: in Settings, “Export my data” gives you everything as JSON, instantly.
- Correct: you can edit your profile in the app.
- Erase: in Settings, “Delete my account”. No waiting period, no form.
- Notifications: can be turned off in Settings or in your phone's settings.
For anything else, write to mathdunandpro@gmail.com. If you believe your rights are not being respected, you can file a complaint with the CNIL (cnil.fr), the French data protection authority.
6. Age
Savora is intended for students in higher education. If you are under 15, a parent's consent is required to create an account.
7. Security
Encryption in transit, hashed passwords, files in private storage, data isolated per account, rate limiting, and security audits before every major milestone. No system is infallible: if an incident affects your data, we will inform you.
8. Changes
If this policy changes substantially, you will be informed in the app before the change applies. The date at the top of the page is the one that counts.