Lessuns
Privacy Policy
In force - 21 August 2026
CONF-2026-08-21-v6
This is a courtesy translation. Only the French version is legally binding.
1. Data controller
The data controller is VAO Agency, a SARL registered with the Paris Trade and Companies Register under SIREN 921 521 811, registered office at 229 rue Saint-Honoré, 75001 Paris, France. Contact: eric@lessuns.app.
VAO Agency has not appointed a data protection officer at this stage. Requests relating to personal data may be addressed to the contact above.
2. Data collected
- Account data: e-mail, hashed password, display name, public identifier, photo, bio, level, goals, interests, school/group, social networks.
- Data relating to minors: date of birth, legal guardian's e-mail, parental validation, account link and supervision elements where necessary.
- Teacher data: identity, country, billing address, status, VAT or tax number, Stripe Connect, publication and compliance information.
- Transaction data: purchases, bookings, subscriptions, amounts, dates, receipts/invoices, refunds, payment statuses, payouts.
- User content and interactions: teacher video materials, student videos, private messages, groups, reviews, photos, comments, reports.
- Usage data: video progress, access history, notification preferences, technical logs, device, IP address, push tokens.
3. Purposes and legal bases
| Purpose | Examples | Legal basis |
|---|---|---|
| Provision of the service | account, access to workshops, materials and services, booking, messaging, groups | contract |
| Payments and billing | Stripe, Apple, RevenueCat, receipts, taxes | contract / legal obligation |
| Security and fraud prevention | logs, KYC, abuse detection, watermark | legitimate interest / legal obligation |
| Moderation | reports, removal, suspension, evidence | legitimate interest / legal obligation |
| Minors and parental control | age, parent e-mail, parental validation | contract / legal obligation / legitimate interest |
| Direct marketing | newsletters, offers, non-essential notifications | consent or legitimate interest as the case may be |
| Cookies and analytics | audience measurement, pixels, improvement | consent where required |
4. Processors and recipients
- Vercel: website hosting.
- Supabase: database, authentication, storage, eu-west-1 region Ireland, European Union.
- Mux: video hosting, encoding and delivery.
- Stripe: web payments, Stripe Connect, Stripe Billing and Stripe Tax.
- Apple / App Store: iOS in-app purchases and iOS subscriptions.
- RevenueCat: technical management of in-app purchases and subscriptions.
- Resend: transactional and marketing e-mails.
- Expo / EAS: build, distribution, notifications and services related to the mobile application.
- PostHog, provided by PostHog Inc., a company established in the United States: audience measurement, only after consent. We use its European offering, with data stored with Amazon Web Services in Germany. That European hosting does not rule out every transfer, see article 5. Google Analytics 4, provided by Google Ireland Limited and Google LLC: audience measurement and traffic source analysis, active on the website since 21 August 2026, only after consent, with processing in the United States, see article 5. Meta Pixel, provided by Meta Platforms Ireland Limited and Meta Platforms, Inc.: advertising measurement and campaign optimisation, active on the website since 21 August 2026, only after consent to the advertising category, with processing in the United States, see article 5.
5. Transfers outside the European Union
Some providers may process data outside the European Union, in particular in the United States. VAO Agency ensures the use of appropriate safeguards where these are necessary: standard contractual clauses, adequacy decisions, additional measures or available localisation settings.
PostHog case, clarified on 18 August 2026 after reading its data processing agreement and its sub-processor list: we have chosen its European offering, and audience measurement data is stored with Amazon Web Services in Germany. That European hosting does not remove every transfer outside the European Union. First, the provider is PostHog Inc., a company established in the United States. Second, its data processing agreement expressly provides for processing outside the protected area, including in the United States, and its sub-processor list includes Cloudflare, Inc. for the routing and protection of data in transit, through worldwide points of presence whose location is determined by that sub-processor. These transfers rely on the European Union standard contractual clauses. No audience measurement data is transmitted before the user's consent.
Google Analytics case, clarified on 21 August 2026: the service is provided by Google Ireland Limited, a company established in Ireland, and relies on Google LLC, a company established in the United States, where data may be processed. These transfers rely on the European Union standard contractual clauses and on Google LLC's certification under the EU-US Data Privacy Framework. No audience measurement data is transmitted before the user's consent, and refusing the banner prevents the tool from loading.
Meta Pixel case, clarified on 21 August 2026: the tool is provided by Meta Platforms Ireland Limited, established in Ireland, and relies on Meta Platforms, Inc., a company established in the United States, where data may be processed. These transfers rely on the European Union standard contractual clauses and on Meta Platforms, Inc.'s certification under the EU-US Data Privacy Framework. This tool belongs to the advertising category of the banner, separate from audience measurement: refusing advertising while accepting measurement prevents it from loading.
6. Private content and access by LESSUNS
Feedback videos sent by Students are private and accessible only to the Student, the Teacher concerned and VAO Agency where access is necessary for support, security, reporting, moderation, dispute, fraud or a legal obligation. Private messages are not subject to routine reading.
7. Retention periods
| Category | Indicative period |
|---|---|
| User account | duration of the account then scheduled deletion within 30 days after request, save for exceptions |
| User content and interactions | duration of the account, the feed or the availability of the material or offer; deletion within 30 days after account deletion save for dispute, security or legal obligation |
| Student feedback videos | period necessary to provide the feedback and evidence of the service, then deletion according to the rules of the account or content concerned |
| Transactions and billing | applicable legal accounting, tax and evidential periods |
| Reports and moderation | period necessary for processing, evidence, security and abuse prevention |
| Technical logs | limited period necessary for security and diagnostics |
| Marketing | until withdrawal of consent or objection |
| Cookie consent | period indicated in the consent module, in principle limited and renewed periodically |
8. Data subjects' rights
Data subjects have, under the legal conditions, rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Requests may be addressed to eric@lessuns.app. Supporting documentation may be requested in the event of reasonable doubt as to identity.
9. Minors
Minor users are accepted as Students from the age of 12 under parental control. VAO Agency may collect a parent's e-mail, request parental validation and allow the legal guardian to access or supervise the child's account. Videos or content involving minors must be handled with particular attention and may be subject to additional restrictions.
10. Notifications and marketing
Messages strictly necessary for the service may be sent without marketing consent. Marketing communications by e-mail, push notifications or other non-essential channels are sent with consent where required or on the basis of legitimate interest where the law permits. The user may unsubscribe or change their preferences at any time.
11. Security
VAO Agency implements reasonable security measures: authentication, restricted access, RLS rules, signed video links, watermark, tracking of reports, specialised providers and technical logging. No measure, however, guarantees zero risk.
12. Cookies
The use of cookies and trackers is described in the Cookie Policy. Trackers subject to consent must be activated only after the user's agreement.
13. Complaints
Users may contact VAO Agency at eric@lessuns.app. They may also lodge a complaint with the competent supervisory authority, in particular the CNIL in France.