Privacy policy

We collect what it takes to run your study workshop, nothing more. We do not sell your information, we show no advertising, and you can export or delete everything. The French version binds.

Lacunova is responsible for the personal information the application processes. To exercise your rights or ask a question, write to the person in charge of the protection of personal information: the Lacunova team, from the Help page of the application.

Directly from you, and only for the purposes below:

• your account: first name or nickname, email address, password (stored only as a hash), passkeys (the public part only);
• the confirmation that you are 14 or older — your date of birth is never kept — or, under 14, your parent’s consent and their email address;
• your study material: imported documents, extracted text, quizzes, answers, glossary, recaps, conversations and spoken sessions with the tutor;
• your settings, your plan, your AI usage and, if you pay, the payment references Stripe provides;
• a security log: successful and failed sign-ins, password, email and passkey changes, with the device (for example “iPhone · Safari”) and an encrypted fingerprint of the IP address, never the address itself;
• your acceptances of these documents and, if you gave it, your consent to news emails.

We use this information to:

• provide the application: write your quizzes, track your mastery, save your work;
• secure your account and prevent abuse (for example, several free accounts opened from one network);
• bill a paid plan and meet our tax obligations;
• write to you about your account (address confirmation, password reset, security alerts) and, only if you agreed, send you news about Lacunova.

When you start an AI action, the passages of your material it needs are sent to the model’s provider (OpenAI, or ElevenLabs for the spoken tutor) to produce the answer. Under the terms of their APIs, this content is not used to train their models. No decision about you is made automatically on the sole basis of this processing.

We entrust some processing to providers bound by contract, who use your information only to provide their service to us. They are located outside Québec, mainly in the United States; we assessed these transfers before making them, as Law 25 requires.

• Vercel — hosting the application;
• Neon — database;
• Cloudflare — storage of imported files, and the anti-bot check at signup;
• OpenAI and ElevenLabs — AI models and the tutor’s voice;
• Stripe — payments;
• Resend — sending emails;
• Sentry — tracking technical errors.

Only the team members who need it for their work access your account, and every access is logged. The support team sees your study material only if you allow it yourself, for a limited time, from the settings.

Your information is kept as long as your account exists. When you delete your account, it is first disabled for 30 days (you can change your mind), then your material and files are erased. Financial and cost facts are kept in de-identified form as long as tax law requires; backup copies disappear as they rotate.

Links sent by email expire quickly: 15 to 30 minutes for a sign-in link, 1 hour for a password reset, 24 hours for an address confirmation.

You can ask to access your information, have it corrected, get a copy in a structured format, withdraw a consent or have it deleted. Many of these you can do yourself in the settings (export, delete, unsubscribe). For the rest, write to us: the Lacunova team, from the Help page of the application. We answer within 30 days. You can also file a complaint with Québec’s Commission d’accès à l’information.

We collect no information from a person under 14 without the consent of their parent or guardian: the parent creates the account. These accounts never receive news emails.

The application only uses the cookies it needs to work: your sign-in session and your display preferences. Vercel’s audience measurement sets no cookie. No advertising cookie.

The box to receive our news is unchecked by default. Each of these emails carries an unsubscribe link that works in one click, and you can also change your mind in Settings › Notifications. Emails about your account (security, billing) are not affected.

Your passwords are hashed, connections encrypted, and tokens sent by email single-use. If a confidentiality incident created a risk of serious injury, we would notify you and the Commission d’accès à l’information.

If this policy changes in a significant way, the application tells you and asks you to accept it again. The date of the version in force is shown at the top of this page.