Draft V0, copy not yet validated. All figures come from simulation on open data, not from flight tests or operational data.
AITHREN FR

Privacy notice

Draft, to be reviewed by a lawyer. Version of 27 October 2026. The bracketed items are to be completed or confirmed by the founder before anything goes online. The French version prevails.

This notice explains which personal data AITHREN processes on its showcase website and in its online demonstration service (Knarr, Eira, Lodestone), why, for how long, and how to exercise your rights. We collect as little as possible.

Controller

[À COMPLÉTER PAR LE FONDATEUR : identity of the publisher, as in the legal notice], [À COMPLÉTER PAR LE FONDATEUR : postal address], reachable at [À COMPLÉTER PAR LE FONDATEUR : contact e-mail address for personal data].

Showcase website

The showcase website sets no cookie, uses no audience-measurement tool and has no form. It loads nothing from third parties (fonts and images are served by our own server).

The server keeps a technical log of requests (page requested, response code, duration) without IP addresses. [À COMPLÉTER PAR LE FONDATEUR : confirm that the site is served by the same server as the service; otherwise state what the site’s host keeps]

Account requests and e-mails

Accounts on the service are created by hand by an administrator, on request by e-mail. If you write to us, we process your e-mail address, your name if it appears, and the content of your message, only to answer you and, where relevant, to create your account.

  • Legal basis: steps taken at your request before entering into an agreement (GDPR Art. 6(1)(b)).
  • Retention: 12 months after our last exchange, then deletion.

Online demonstration service

What is kept

Data Why Retention
Login and display name Create and run your account; your display name appears in exercises and feedback As long as the account exists; an account with no login for 12 months may be closed
Password hash (PBKDF2, never the password itself), roles and rights per exercise, “must change password” and “account disabled” flags, creation time, time of last login, last active day (date only), reference of your personal exercise Authentication, access rights, anonymous count of active accounts As long as the account exists
Your personal copy of the demonstration exercise and what you enter in it Run the service As long as the account exists, then archived when the account is deleted and erased after 3 months; exercises may be reset at any time
Feedback sent with the “Feedback” button: text, type, context shown before sending (product, screen, version, language, account and role, exercise, window size, time) Improve the applications 24 months
Audit log: time, account, action (login, refused login, password change, exercise created, feedback sent, administration actions on accounts with the administrator’s and the target’s login, never a password); for logins, refusals and password changes, the IP address Security of the service, abuse detection, evidence in case of incident 12 months
Anonymous daily counters: number of logins, active accounts, screens opened, key actions Measure use of the service No limit; they hold no name, login or IP address and are not personal data

The server’s technical request log (page requested, response code, duration) holds no IP address and no account name.

  • Account, exercises, authentication: performance of the terms of use you accept (GDPR Art. 6(1)(b)).
  • Audit log and login IP addresses: the publisher’s legitimate interest in protecting the service against fraudulent access (Art. 6(1)(f)).
  • Feedback: the publisher’s legitimate interest in improving its applications (Art. 6(1)(f)). Sending feedback is always voluntary.

What you must not enter

The service is a demonstration on synthetic data. Do not enter any personal data of another person, any real health data, or any real or classified military data (see the terms of use). Your display name may be a pseudonym.

Cookies and browser storage

The service uses no advertising or audience-measurement cookie. It sets only:

  • a session cookie, needed to stay signed in (8 hours at most, not readable by page scripts);
  • a cookie that remembers the open exercise (30 days at most, cleared at sign-out).

It also keeps your display preferences in your browser (local storage): language, theme, clock offset, map settings. These preferences do not leave your browser.

These are strictly necessary for the service you ask for: they need no consent and no banner is shown.

Recipients and place of processing

The data is accessible only to the publisher and its administrators. It is not sold, transferred or used for advertising. It is stored on a server rented from [À COMPLÉTER PAR LE FONDATEUR : host], located in [À COMPLÉTER PAR LE FONDATEUR : country of the data centre, in the European Union], acting as processor. Backups are encrypted. No transfer outside the European Union is planned. No automated decision with legal effects is taken.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. To exercise them, or to have your account closed, write to [À COMPLÉTER PAR LE FONDATEUR : contact e-mail address for personal data]. We answer within one month.

The audit log is chained to be tamper-evident: a single line cannot be removed on its own; it disappears when its retention period ends.

If you consider that your rights are not respected, you may lodge a complaint with the CNIL (www.cnil.fr), the French data-protection authority.

Changes

This notice may change with the service. The version date is at the top of the page.