Kryptosphere Academy

1. The principle, in one sentence

We collect only what it takes to let you follow a course, sit a quiz and receive a verifiable certificate. Nothing else.

Reading the courses, the publications and the Bulletin needs no account. An account is required only to sit a quiz and claim a certificate.

2. Data controller

Controller: Kryptosphere France
Registered office: 59 avenue de l'Observatoire, 75014 Paris, France
Data protection contact: contact@kryptosphere.org

No data protection officer has been appointed: the association falls into none of the cases where the GDPR requires one. Requests are handled by the contact above.

3. What we process, and on what basis

Account: Email address, name, one-way hashed password, creation date. Needed to perform the service you asked for (GDPR art. 6(1)(b)). Without them no account can exist.
Learner profile: Display name, reading language, date of first visit. Same legal basis. The display name is optional: the account name is used otherwise.
Quizzes: Selected answers, score, start and submission times, number of attempts. Needed to mark the quiz and to justify issuing the certificate.
Certificate: Holder name as you enter it, track title, score, issue date, public identifier. These are frozen at issuance: renaming a course never rewrites a certificate already issued.
Technical logs: Our hosts keep connection logs (IP address, timestamp, page requested) for security and diagnosis. Legal basis: our legitimate interest in keeping the service working and detecting abuse.

4. What we do not do

This list matters as much as the previous one, and it can be checked against the site’s source code:

No analytics, no advertising tracker, no social network pixel.
No selling, renting or trading data to third parties.
No marketing email: there is no mailing list.
No profiling, no targeted advertising.
Typefaces are served from our own servers: your browser sends no request to Google Fonts.
Digital asset prices are fetched by our server, never by your browser: your IP address is not passed to the price provider.

5. Cookies

The site sets a single cookie, the one that keeps your session open once you are signed in. It is strictly necessary: without it you would be signed out on every page.

That kind of cookie needs no prior consent, which is why this site shows no banner. You can delete it from your browser at any time; you will simply be signed out.

6. The certificate and its public verification

A certificate is only worth something if a third party — a recruiter, a school, a partner — can verify it. Every certificate therefore carries a public identifier, and a verification page answers anyone holding it.

That page always states whether the certificate is valid, revoked or expired, the track title, any partner, and the issue date.

Your name appears there only if you explicitly asked for it when claiming the certificate. That consent (GDPR art. 6(1)(a)) can be withdrawn at any time from your account: the name then disappears from the verification page without invalidating the certificate.

The public identifier leads neither back to your account nor to your other certificates.

7. Automated quiz marking

Quizzes are marked automatically: the score is computed on the server and determines whether a certificate can be claimed. No person reads the answers.

This automation produces no legal effect and involves no profiling: it compares answers against a key. If you believe a marking is wrong, write to us — a human will check, and a new attempt can be opened.

8. Who can see your data

Internally, only people in the association holding an explicitly granted access to the admin panel can view issued certificates. Following a course grants no such access.

Externally, our only processors are the technical providers that run the service:

Neon Inc.: Database and authentication service. Data hosted in the European Union (Amazon Web Services, région eu-central-1 — Francfort, Allemagne).
Vercel Inc.: Site hosting and image storage. A company established in the United States; any transfer is covered by the European Commission’s standard contractual clauses.

These providers act on our instructions and may not use your data for their own purposes.

9. How long we keep it

Account and learner profile: For as long as the account exists. After three years without a sign-in the account is deleted, following a warning sent to your email address.
Quiz attempts: Deleted with the account. An unfinished attempt is kept for as long as it can be resumed.
Certificates: Kept beyond deletion of the account, because a certificate must stay verifiable by the third parties you showed it to. On erasure the holder’s name is cleared and the certificate survives under its identifier alone.
Technical logs: Kept briefly by our hosts, for a period set by their own policies, and never used for anything but security and diagnosis.

10. Security

Traffic is encrypted in transit (HTTPS). Passwords are never stored in the clear: only an irreversible cryptographic hash is kept, and nobody in the association can read your password.

Correct quiz answers never leave the server before you submit your paper. Admin panel access is granted by name and logged.

Should a breach occur that is likely to risk your rights, the French data protection authority (CNIL) will be notified within 72 hours and you will be told if the risk is high.

11. Your rights

The GDPR gives you the following rights over your data:

Access: obtain a copy of the data we hold about you.
Rectification: correct inaccurate data — your display name can be changed directly from your account.
Erasure: ask for your account and associated data to be deleted, subject to the certificate reservations in section 9.
Restriction: ask for a processing operation to be frozen while a dispute is settled.
Objection: object to processing based on our legitimate interest.
Portability: receive your data in a machine-readable format.
Withdrawal of consent: withdraw, at any time, the permission to show your name on the verification page, without affecting what was done beforehand.

To exercise these rights, write to contact@kryptosphere.org. We answer within one month, extendable by two months for a complex request — we would tell you so. Proof of identity will be asked for only where there is serious doubt about who you are.

If our answer does not satisfy you, you may refer the matter to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or complain online at cnil.fr — or to the supervisory authority of your own EU country of residence.

12. Minors

The service is aimed at students and adults. A minor under fifteen may open an account only with the permission of a parent or guardian.

If you find an account opened in those circumstances without permission, report it: it will be deleted without delay.

13. Changes to this policy

This policy will change as the service does. Any substantial change — a new purpose, a new recipient, a longer retention period — will be flagged on this page and, where it concerns you directly, by a message to your email address.

The date of the last update is shown at the top of the page.