Privacy policy

MAJALISS, a registered association (RNA W581004256, SIRET 93898795500011) whose registered office is at 6 route d'Autun, 58120 Château-Chinon (Ville), France, is the controller for the processing described here, carried out through the Majaliss platform.

We collect only what the platform actually uses:

• Account: e-mail address, first and last name, title, date of birth and password. Your password never reaches us in the clear: it is held and encrypted by our authentication provider.
• Profile: your picture, if you add one.
• Usage: your favourite institutes, the reviews and ratings you publish, your notification preferences and whether you agreed to hear from us.
• Institute page audience: how many times each page is displayed, appears in search results and is clicked through to its website, e-mail or phone. No identifier is recorded — no account, session, IP address or browser — and the institute only sees totals.
• Messaging: the messages exchanged with institutes and with the Majaliss team, with their date and read status.
• Push notifications: the technical identifier of the subscribed device and its browser — or, in the mobile app, the device token issued by Firebase Cloud Messaging — only if you turn them on.
• Institute accounts: first and last name, e-mail, phone number, role in the establishment, and the name, logo and website of the institute declared.
• Contact form: name, e-mail and the content of the message.
• Location: your device's position, only when you ask for a "near me" search and allow it in your browser. It is used to sort results and is not kept.
• Technical data: IP address, device, browser, pages visited and errors encountered.

This data is used to:

• Create and manage your account, and sign you in
• Search institutes, courses and events, and sort them by how close they are
• Carry messages between students, institutes and the Majaliss team
• Publish and moderate reviews, and let institutes answer them
• Provide institutes with the visibility statistics of their page: displays, appearances in results and outbound clicks, counted with no identifier, plus the favourites and reviews already collected, as numbers only
• Tell you what concerns you — in the app, by e-mail and by push — according to the preferences you set
• Handle the requests sent through the contact form
• Understand failures and slowness so they can be fixed, and measure the site's traffic — IP address anonymised, and only if you agree to it
• Keep the service secure and prevent abuse

Each processing rests on one of these grounds:

• Performance of the contract: your account, search, messaging, reviews and the notifications tied to your activity
• Your consent: push notifications, our e-mail news, error-monitoring and audience-measurement trackers, and sign-in with Google or Apple — each withdrawable at any time
• Our legitimate interest: securing the service, preventing abuse and improving the platform
• A legal obligation: keeping certain data where the law requires it

We sell nothing, and share your data only with the providers that run the service, each for what it does:

• Supabase: database, authentication and picture storage (hosted in the European Union)
• Vercel: hosting of the website and the apps, page delivery and technical logs (United States) — this transfer outside the European Union is covered by the safeguards of Chapter V of the GDPR
• Google Analytics: audience measurement for the website only (not the mobile apps), loaded only if you accept it, with an anonymised IP address and no cross-referencing with your account
• Algolia: the search engine. Only the public listings of institutes, courses and events are indexed there — never a profile, a named review or a message
• Google: city and address autocompletion when you use the location filter, and Google sign-in if you chose it — Google then passes us your e-mail, your name and your profile picture
• Apple: sign in with Apple, if you choose it — Apple passes us your identifier and, if you agree, your e-mail (or a relay address) and your name on the first sign-in
• Resend: sending the service's e-mails (confirmation, password reset, notifications)
• Sentry: reporting technical errors, only if you agreed to it
• Firebase Cloud Messaging and your browser's push service: delivering the notifications you turned on, from the device token or the browser subscription
• Discord: requests sent through the contact form are relayed to the team's private channel so they can be picked up

Some of these providers are established outside the European Union. Those transfers are covered by the European Commission's standard contractual clauses. We never sell your personal data.

Nothing beyond the strict essentials loads before you agree: no error monitoring, no audience measurement, no Google or Apple identity service. What is stored, by whom and for how long — along with the settings to change your mind at any time — is on the cookie settings page.

Each piece of data is kept for as long as what it serves:

• Your account and profile: for as long as the account exists
• When you delete your account: your profile is anonymised at once, and your favourites, notification subscriptions and not-yet-published reviews are erased
• Reviews already published and messages stay where they were posted — they count towards an institute's rating and belong to a conversation — but with nothing left that identifies you
• Contact requests: three years after the last exchange
• Technical data and error logs: twelve months at most

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: ask for your data to be deleted
• Right to portability: receive your data in a structured format
• Right to object: object to the processing of your data
• Right to restriction: restrict the processing of your data

Your details are corrected straight from "My profile", and your account is deleted there without going through us. For anything else, write to contact@majaliss.io. If our answer does not satisfy you, you may lodge a complaint with the CNIL (www.cnil.fr).

We apply appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction: encrypted passwords, HTTPS communications, restricted and partitioned database access, and administration reserved for authorised members of the team.

Your session relies on authentication tokens kept by your browser. They keep you signed in from page to page, are renewed automatically and disappear when you sign out. They are essential to the service and serve nothing else. If you sign in with Google or Apple, that service is what confirms your identity: Majaliss never receives your Google or Apple password.

Creating an account is reserved for people aged 16 and over. A course may be aimed at children, but the account browsing it and talking to the institute remains that of an adult or legal guardian. If you are a parent or guardian and believe your child has given us personal data, write to us and we will delete it.

This policy follows the platform as it evolves. Any change is published on this page with its update date, and significant changes are announced to you by e-mail or by notification in the app.

For any question about this policy or about how your data is processed, write to us:

E-mail: contact@majaliss.io