FortyFivePrivacy Policy
Last updated: 10 November 2026
- Without an account, everything you enter stays in your own browser. We don't receive it.
- With an account, we store your email address, your plan and your study progress, so it works on every device. You sign in with an email link or Google: we never have a password for you.
- Payments are handled by Paddle. We never see your card details.
- No advertising, no selling of data, no tracking cookies.
- You can ask us to delete your account and its data at any time.
1. Who is responsible
The data controller is [Full name], sole trader, [postal address], who runs FortyFive (fortyfiveib.com). For any privacy question or request, contact [contact email].
2. What we collect and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Account details: email address, sign-up date, and, if you sign in with Google, the basic profile Google shares (name and email) | To create your account and let you sign in | Contract (art. 6(1)(b)) |
| Study data you choose to save: your profile (name or nickname, exam session, target and predicted scores, subjects, revision hours, study interests), planner deadlines, university shortlist, grades, quiz and paper results, streak, and IA/EE drafts you type into the self-check tool | To save your progress and show it on all your devices | Contract (art. 6(1)(b)) |
| Plan and purchase details: which plan you have, its end date and the subjects included, gift codes you redeem; from Paddle, your order reference, amount, currency, email and country | To give you the access you paid for, and handle refunds and support | Contract; legal obligations (accounting) |
| Usage counts: how many free lessons, questions and papers you used each day, and AI checks used each month | To apply the free-plan limits and plan quotas | Contract |
| Text you send for AI feedback (for example part of an IA or EE) | To generate the feedback you asked for. We don't keep the text after the feedback is returned | Contract |
| Security data: your sign-in session, and technical logs (such as IP address) kept by our providers | To keep accounts secure and stop abuse | Legitimate interest (art. 6(1)(f)) |
| Messages you send us | To answer you | Legitimate interest |
Please don't put sensitive information (health, religion and so on) in free-text fields. We don't need it.
3. If you don't create an account
Everything you enter (profile, progress, planner, results, drafts) is saved only in your browser's local storage on your device. It is never sent to us. You can erase it at any time in Profile → Reset everything or by clearing your browser data.
4. Children and teenagers
In France, you can agree to the processing of your own data from age 15. If you're under 15, a parent or legal guardian must give permission before you create an account. Anyone under 18 needs a parent's or guardian's permission to buy a plan. If you're a parent and think your child signed up without permission, contact us and we'll delete the account.
5. Who else processes your data
We don't sell your data or share it for advertising. We only use these service providers, who process data on our behalf:
- Supabase, Inc.: sign-in and the database that stores accounts, plans and progress. Our database is hosted in the EU [region, e.g. Paris / Frankfurt].
- Cloudflare, Inc. (USA): website hosting and the server functions that check your plan.
- Anthropic, PBC (USA): generates AI feedback from the text you submit. Under its commercial terms, Anthropic doesn't use this text to train its models.
- [Email provider, e.g. Brevo or Resend]: sends sign-in emails.
- Google: only if you choose “Sign in with Google”.
- Paddle.com Market Ltd (UK): payment processing as Merchant of Record. Paddle is an independent controller for the payment data it collects. See Paddle's privacy notice. The UK has an EU adequacy decision.
- Google Fonts and jsDelivr: deliver the fonts and code libraries used by the pages. Your browser connects to them directly, which shares your IP address with them.
Providers in the USA are covered by the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.
6. How long we keep data
- Account and study data: as long as your account exists, or until you ask us to delete it.
- When we delete your account, your plan, progress and usage records are erased with it. Backup copies are overwritten within 30 days.
- AI feedback text: not stored after the feedback is returned.
- Purchase records: 10 years, as required by French accounting law (kept by Paddle and us).
7. Cookies and local storage
When you sign in, your session is kept in your browser's local storage so you stay signed in. We also use local storage to save your progress on your device. Both are strictly necessary for features you ask for, so no consent banner is required. We don't use advertising or tracking cookies. During checkout, Paddle may use its own cookies to process the payment safely.
8. Security
Connections use HTTPS. There are no FortyFive passwords to steal: you sign in with a one-time email link or Google. Your plan is checked by our server on every request, and database rules stop accounts from reading each other's data. No system is perfectly secure; if a breach affected your data, we would tell you and the CNIL as the law requires.
9. Your rights
Under the GDPR and French law you have the right to:
- access your data and get a copy of it (you can also copy it any time with Profile → Transfer your progress);
- correct it;
- delete it;
- restrict or object to processing based on our legitimate interest;
- receive it in a portable format;
- give instructions about what happens to your data after your death.
Write to [contact email]. We reply within one month. If you're not satisfied, you can complain to the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.
10. Changes
If we change this policy, we'll update the date at the top and tell account holders about important changes.