Privacy Policy

DRAFT — to be reviewed by a legal professional before going live

Last updated: 25 September 2026 (draft v0.2, not published). This English version is a translation provided for convenience; the French version prevails.

This policy explains which personal data InfraPrep processes, why, for how long, who it is shared with and how to exercise your rights (articles 12 and 13 of Regulation (EU) 2016/679, the "GDPR").

1. Controller

Sacha Ochmiansky, sole trader (entrepreneur individuel, EI), trading as InfraPrep, 33300 Bordeaux, France, contact@infraprep.fr.

No data protection officer has been appointed. [TO BE VALIDATED BY THE REVIEWER.]

2. Data processed, purposes and legal bases

Visiting the website, without an account

  • Data: IP address and technical connection data (server logs), language choice (cookie), basket data.
  • Purposes: displaying and securing the website, remembering your language and basket.
  • Legal basis: legitimate interest in running and securing the website (article 6(1)(f) GDPR). Cookies are described in the Cookie Policy.
  • The 25 free questions can be used without an account; your answers in study mode without an account are not stored on our servers. [TO BE CHECKED: confirmed from the code on 25/09/2026 — recheck before going live.]

Account

  • Data: email address, username, password (stored by WordPress in hashed form, never in plain text), surname and first name if you provide them.
  • Purposes: creating and managing your account, authenticating you.
  • Legal basis: performance of the contract (Terms of Use) (article 6(1)(b)).

Practice and results

  • Data: exam attempts, answers chosen, scores, dates.
  • Purposes: showing your progress and history.
  • Legal basis: performance of the contract (article 6(1)(b)).

Answer contests

  • Data: the question concerned, the documentation link and comment you enter, the status of the contest.
  • Purposes: reviewing and correcting questions.
  • Legal basis: performance of the contract and legitimate interest in improving the content (article 6(1)(b) and (f)).

Subscription, payment and invoicing

  • Data: name, email address, billing address [TO BE CHECKED: fields actually requested at checkout], order and subscription history, payment identifier provided by Stripe. InfraPrep does not receive your full card number or security code: they are entered in a Stripe form.
  • Purposes: concluding and performing the subscription, collecting payments, managing renewals, cancellation and withdrawal, issuing invoices.
  • Legal bases: performance of the contract (article 6(1)(b)); legal obligation to keep invoices and accounting records (article 6(1)(c)).

Customer relations

  • Data: email exchanges, complaints, requests to exercise your rights.
  • Purposes: answering your requests, handling complaints and mediation.
  • Legal basis: performance of the contract, legal obligation, legitimate interest (article 6(1)(b), (c) and (f)).

Service emails

  • We send the emails needed for the account and the subscription: order confirmation, invoices, renewal, price changes, cancellation, replies to contests.
  • No marketing emails are sent. If a newsletter is ever planned, this policy will be updated first and your consent requested where the law requires it.

No automated decision producing legal effects concerning you is made. The data requested for the account and the order is necessary to conclude the contract: without it, the subscription cannot be taken out.

3. Recipients and processors

Your data is processed by Sacha Ochmiansky. It is neither sold nor rented. It is disclosed only to:

  • the website host: OVH SAS (France), as a processor;
  • the email sending service: [TO BE COMPLETED BY SACHA: name, country], as a processor;
  • Stripe [TO BE COMPLETED BY SACHA: contracting Stripe entity shown in the Stripe account] for payments. According to its own privacy policy, Stripe acts as a processor when it processes payments on our behalf, and as a controller for its own purposes, in particular fraud detection and compliance with its legal obligations. For the latter, see Stripe's policy: stripe.com/privacy;
  • the accountant [TO BE COMPLETED BY SACHA, if any], for bookkeeping;
  • public authorities, only where the law requires it.

The website uses WordPress, WooCommerce and the "Subscriptions for WooCommerce" extension (WP Swings), installed on our hosting. Their features that send usage statistics to their publishers are disabled, and the artificial intelligence assistant feature of the subscription extension is not used. [TO BE MAINTAINED: these settings must stay disabled; otherwise, update this policy.]

4. Transfers outside the European Union

Stripe states that data may be transferred outside the European Economic Area, including to the United States. For this, Stripe relies on the European Commission's standard contractual clauses, and Stripe, Inc. states that it participates in the EU-U.S. Data Privacy Framework.

For the host and the email service: [TO BE COMPLETED at deployment: place of processing and safeguards, or "no transfer outside the European Union" if verified].

5. Retention periods

  • Account, results and contests: as long as the account exists. After [TO BE CHOSEN BY SACHA: for example 3 years] without login, the account may be deleted after a warning email. Data from a cancelled subscription remains attached to the account as long as it exists.
  • Contract data (subscription): for the duration of the contract, then in intermediate archiving for as long as needed for evidence and limitation periods. [TO BE VALIDATED BY THE REVIEWER: archiving period. Verified reference: an electronic contract with a consumer of EUR 120 or more is kept for 10 years (service-public F10029); it remains to be decided whether this threshold applies per month or cumulatively for a monthly subscription.]
  • Invoices and accounting records: 10 years from the close of the financial year.
  • Tax documents: 6 years. [TO BE CONFIRMED BY THE ACCOUNTANT: starting point of the period.]
  • Card data: not kept by InfraPrep. Stripe processes and keeps it under its own policy.
  • Server technical logs: [TO BE COMPLETED at deployment: period set by the host or the configuration].
  • Rights requests and complaints: for as long as needed to handle them, then for the limitation periods. [TO BE VALIDATED BY THE REVIEWER.]
  • Cookies: see the Cookie Policy.

6. Security

The website uses an encrypted connection (HTTPS) [TO BE CHECKED at go-live]. Passwords are never stored in plain text. Payments are entered in a Stripe form. Access to the administration area is restricted to the publisher.

7. Your rights

You have the following rights over your data:

  • right of access;
  • right to rectification;
  • right to erasure;
  • right to restriction of processing;
  • right to data portability, for data you provided that is processed on the basis of the contract or your consent;
  • right to object to processing based on our legitimate interest;
  • right to withdraw your consent at any time, where processing is based on it, without affecting processing already carried out.

Some data cannot be erased while the law requires us to keep it (for example invoices).

How to exercise them: write to contact@infraprep.fr. If we have reasonable doubts, we may ask you to prove your identity. We reply within one month of receiving the request. This period may be extended by two months depending on the complexity or number of requests; we would then tell you within the first month.

Complaints: you may lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.

8. Changes to this policy

This policy may change, for example if a new provider is used. The update date is shown at the top of the page. Account holders are told by email of any significant change.