Privacy

The short version

• We collect what the platform needs to work, and nothing to sell or advertise with.
• No one is scored or ranked by a machine. Each team gets written feedback, written or checked by a person.
• Your prompt log is used for your team's feedback only. Neither your school nor the company sees it.
• Our database is in the European Union (Frankfurt).
• You can download everything we hold about you, or delete your account, yourself, from Account and data in your space.

What we collect, and why

Your account. Your name, your school or work email address, your school (worked out from the address), your role, and a password that only Supabase, our authentication provider, stores, in hashed form; we never see it. We use these to open and run your account, because you asked for one (GDPR art. 6(1)(b), performance of a contract).

Your GitHub account, if you connect it. Your GitHub username and identifier, so that we can give you access to your team's repository. Same legal basis.

Your work in a team. The teams you join, what your team hands in (an address and a note), and the written feedback ATELIA gives the team. This is the service itself (art. 6(1)(b)).

The prompt log and pushes. When your team works in its repository, the prompts written to AI tools are kept in a file in that repository, and each push is recorded (branch, number of commits, first message, who pushed). We read them to write the team's feedback, because how a team worked with the model is what we give feedback on. They are never turned into an individual score or ranking, and they are not shown to your school or to the company (art. 6(1)(b)).

Your progress in Learn. The units you complete and your answers to the exercises, so you can pick up where you left off (art. 6(1)(b)).

Company contacts. The name, work email address and company of the people a partner company asks us to invite, to give them access to their company space (art. 6(1)(b) for the company's agreement, and our legitimate interest in running it, art. 6(1)(f)).

Emails we send. Only emails about your own account and work: a sign-in code, a welcome, a teammate joining, your feedback being published, an invitation. No newsletter and no marketing.

Technical data. The platform sets session cookies that keep you signed in. They are strictly necessary, so they need no consent and there is no cookie banner. Page views are counted with Vercel Web Analytics, which stores nothing on your device and builds no identifier. Our host keeps technical connection logs (IP address, time, address requested, browser) to deliver and secure the service, for a short period.

No automated decisions

ATELIA produces no grade, no score and no ranking of students. Feedback is written to a team, in sentences, and a person at ATELIA writes or checks every one before it is published. An AI tool may help draft it; it never publishes on its own. If your school grades the work, that grade is your school's decision, under its own rules.

Who sees what

• Your teammates see your name, your team's hand-in, its feedback and its prompt log.
• The company behind a case sees the teams working on it and their members' names, the hand-ins once ATELIA has checked them, and ATELIA's synthesis at the end. It does not see prompt logs or the feedback given to teams.
• Your school has no access to the platform. Anything ATELIA reports to it is set out in the agreement with your school, and never includes your prompt log.
• The ATELIA team sees what it needs to run the cases and write feedback.

Who handles the data for us

These providers process data on our instructions, under data processing agreements:

• Supabase: the database and sign-in. The database is hosted in Frankfurt (EU).
• Vercel: hosting. The platform's server functions run in Frankfurt (EU); pages are delivered through a worldwide network.
• GitHub: team repositories, if you connect your GitHub account.
• Resend: delivery of the emails listed above.

Vercel, GitHub and Resend are US companies. Where data leaves the European Union, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses, as set out in their own data processing terms. Nothing is sold, rented, or passed to advertisers.

How long we keep it

• Your account and profile: until you delete your account, which you can do at any time.
• Prompt logs and pushes: six months after your team's feedback is published, then deleted.
• Hand-ins and feedback: with the team's record, for as long as the case is kept, and at most three years after the case closes.
• Progress in Learn: until you delete your account.
• Messages written to us: for as long as the exchange is live, and up to three years after the last contact.

When you delete your account, your profile, your progress, your place on your teams and your access to the team repositories go at once. Your teams keep their work: your GitHub username is removed from their records, and nothing in them points to your account any more.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Two of these you can use yourself, at once, from Account and data in your space: download my data (access and portability) and close my account (erasure). For anything else, write to contact@ateliaworkshop.ai; we answer within one month.

If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French supervisory authority.

Security

Data travels encrypted. In the database, every table is closed by default and each person can only read what their role allows: a student their own teams, a company its own cases. Secrets never reach the browser. If a breach put your data at risk, we would notify the CNIL within 72 hours and tell you when the law requires it.

Student work shown on the public website

The screenshots and quotations shown on the website are the work of student teams, published by team number, with no name, no student identifier and no repository address. A team may ask for its work or its quotation to be taken down at any time, by writing to the address below; we act on it without asking why.

Contact and changes

Data controller: ATELIA, [registered office address]. Data protection contact: [named contact], reachable at contact@ateliaworkshop.ai.

If this policy changes in a way that matters, account holders are told by email before it applies. The terms of use of the platform are here.