Privacy policy
In accordance with the General Data Protection Regulation (GDPR — EU 2016/679) and the French Data Protection Act. Version in force since 1 September 2026.
This English translation is provided for convenience only. In the event of any discrepancy, the French version prevails and is the only binding text.
1. Data controller
- Entity: Kernel Ops SASU
- Address: 60 rue François 1er, 75008 Paris, France
- Data protection contact: privacy@beltup.fr
2. Data collected and purposes
2.1 Account data
At registration: email address, password (stored in hashed form, never in clear text — we therefore never have access to your password). Legal basis: performance of the contract.
2.2 Usage data
Quiz results: scores, durations, tracks completed, and for each question asked, whether your answer was right or wrong. This detail lets us place you by topic and by skill, rather than on an overall mark.
We do not record what you answered: neither the option ticked, nor the text entered, nor the order you composed. Only the result is kept, with the topic of the question.
This data is linked to your account. It can be read only by you and by the technical administration of the service; if you are following a course within an organisation, your trainer has no access to it — they see only your scores. It is deleted with your account, and is included in the export of your data. Legal basis: performance of the contract.
2.3 Quiz in progress (resuming from one device to another)
When you interrupt a quiz, it is saved so that you can resume it. This record contains the questions drawn, the answers already given, those you set aside and the entries you were in the middle of writing.
It is first kept in your browser, which lets you carry on without a network connection. If you are logged in to your account, a copy is also saved on our servers: it is that copy that lets you find a quiz started on another device. Without an account, no copy leaves your browser.
That copy is deleted automatically after 7 days, as well as at the end of the quiz or if you choose to start again. It can be read only by you: our own administrative access is excluded from it at database level. It is not used for usage analysis, assessment or any automated processing. Legal basis: performance of the contract.
2.4 Payment and activation data
Payments are processed entirely by Stripe, Inc. We receive only a confirmation of the subscription status (active / inactive) and a Stripe customer identifier. No banking data is stored on our servers.
For “Partner” access activated by code: we record only the activation status and the plan type in our database. The partner codes themselves are not stored in the database; they are kept securely in the application’s server environment.
2.5 Technical data
Connection logs (IP address, timestamp, browser) processed by our hosting providers for security and debugging purposes. Legal basis: legitimate interest.
2.6 Partnership requests
If you submit a request from our partnership pages, we record the company name, the type of organisation, your name and position, your professional email, the number of learners stated, your Qualiopi status, your message, the page the request was sent from and the date of your consent. This information is used solely to handle your request and to get back to you about it. It is not passed on to any third party. Legal basis: pre-contractual measures taken at your request.
2.7 Monitoring data (optional)
If the monitoring features are enabled, we collect aggregated and anonymised usage data (Sentry for technical errors, PostHog for usage analysis). This data contains no personally identifiable information. You can disable this tracking through your browser settings.
2.8 Internal log of the Kernel Ops ecosystem
At the end of a quiz, we write in an internal log that a session has ended and, where applicable, the skills you struggled with on that quiz — fewer than half of the answers right, on at least three questions. Below three questions, nothing is written: two answers say nothing about a skill.
This log contains only identifiers and numbers. Neither your name, nor your address, nor any text you have entered. You appear in it under an irreversible fingerprint computed from your email address, never under the address itself.
Its purpose is to allow, in time, the other tools published by Kernel Ops to offer you content suited to your difficulties without asking you to sit an assessment again. No transfer takes place to date: this log stays in the beltup.fr database. Legal basis: legitimate interest — you may object by writing to us at contact@beltup.fr.
3. Processors and data transfers
We use the following processors, each bound by contractual guarantees compliant with the GDPR:
| Provider | Role | Location |
|---|---|---|
| Clever Cloud SAS | Hosting, database | France (Paris) |
| Scaleway SAS | Transactional emails | France (Paris) |
| Stripe Payments Europe Ltd | Payment processing | Ireland |
| PostHog | Usage analysis (optional) | EU (Germany) |
Signing in with Google or Microsoft
If you choose to sign in with Google or Microsoft, those companies act as identity providers, in the capacity of independent data controllers — not as our processors. Two concrete consequences: the provider learns that you are signing in to beltup, and we receive from it your email address, your name and a technical identifier. We receive neither your password, nor the content of your mailbox, nor any other data from your account.
That choice is entirely yours: registration and sign-in by email and password remain available, and involve no third party.
Hosting, the database and email sending are provided by French companies, on servers located in France. Usage analysis is hosted in the European Union.
Only payment processing may give rise to transfers outside the European Union: Stripe Payments Europe Ltd is established in Ireland, but belongs to an American group. Those transfers are governed by Standard Contractual Clauses approved by the European Commission.
4. Retention period
- Account data: kept for as long as the account is active, then deleted within 3 years of the last login or on request.
- Quiz results: kept for as long as the account is active.
- Quiz in progress: 7 days at most, and deleted as soon as the quiz ends or if you start it again. See 2.3.
- Payment data: kept by Stripe in accordance with the applicable regulations (generally 5 to 10 years).
- Partnership requests: three years after our last exchange. See 2.6.
- Technical logs: 90 days.
5. Cookies and trackers
beltup uses a minimal number of cookies:
- Session cookie (better-auth.session_token): needed to keep you signed in. Essential cookie, no consent required.
- Fonts: the Space Grotesk typeface is served directly by beltup.fr. No connection to a third-party service is made to display it.
- Local storage (quiz in progress): your browser keeps the quiz you are in the middle of, so that you can resume it. This storage is strictly necessary to that feature and is not used for any tracking. It is cleared at the end of the quiz, after 7 days, and when you sign out. See 2.3.
- Your choice about trackers (beltup:consentement): keeps your answer to the banner — consent or refusal — together with its date. Without it, the question would be asked again on every page. This storage is strictly necessary, depends on no consent and remains if you refuse. It is kept for 6 months, after which the question is asked again.
Usage measurement — subject to your consent
beltup may measure the use of the site in order to understand which pages are useful and which are missing. This measurement is not necessary for the site to work: everything remains accessible if you refuse it, with no degradation.
- Purpose: measure the pages viewed and the path through the site, to decide what to write next. No advertising, no profiling, no resale.
- Recipient: PostHog, hosted in the European Union.
- What is stored: an identifier in your browser’s local storage, under a name beginning with
ph_. Nothing is stored until you have accepted. - Duration: your choice is valid for 6 months, then the question is asked again. The identifier is removed at that point if it is not renewed, and immediately if you withdraw your consent.
- Withdrawing your consent: the “Manage my trackers” link at the bottom of every page reopens the banner. Withdrawing is as easy as consenting and takes effect immediately, including on what had already been stored.
As of the date this page was updated, this measurement is not enabled: no usage-measurement tracker is stored on beltup.fr. This paragraph describes what will happen if it is, and the banner will then ask for your consent beforehand.
No third-party advertising or profiling cookie is used.
6. Your rights (GDPR)
Under the GDPR, you have the following rights:
- Access: obtain a copy of your personal data
- Rectification: correct inaccurate data
- Erasure: request the deletion of your account and your data
- Portability: receive your data in a structured format
- Objection: object to certain processing activities
- Restriction: request that a processing activity be restricted
To exercise any of these rights: privacy@beltup.fr — we reply within one month. Deleting your account and exporting your data can also be done directly from your account, without writing to us.
You may also lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, the French data protection authority): cnil.fr
7. Security
We implement appropriate technical and organisational measures to protect your data: encrypted communications (HTTPS/TLS), passwords stored in hashed form, restricted access to production data, and per-user isolation enforced by the database itself (PostgreSQL Row Level Security) — so that an application error alone would not be enough to expose another user’s data.
8. Changes
This policy may be updated. In the event of a substantial change, the effective date shown at the top of the page is updated on the day of the change — that date is authoritative. The applicable version is the one published on this page at the time you use the service; we invite you to consult it periodically.
Last updated: September 2026 — courtesy translation of the French text of the same date.