Privacy Policy

Last updated

This policy sets out what data Buvard handles, why, who it is shared with, and how to take back control of it. It describes how the application really works, including its most sensitive point: the material you upload is sent to third-party providers outside the European Union in order to produce your cards.

Who is responsible

The data controller is Vincent Pruvost, a French sole trader, SIRET 941 612 962 00022, exempt from RCS and RM registration.

No data protection officer has been appointed: it is not required here, as the activity involves neither large-scale monitoring nor sensitive data.

What we hold

Buvard collects only what the service needs in order to work. In practice:

  • Account: your email address, a display name if you set one, your plan (free or Pro), your usage counters for the month, the date you last signed in, and your preferences (language, daily goal, default generation settings).
  • Sign-in: for each magic-link request, a hash of the token, a hash of the challenge left in the browser that asked for the link, the email address it was sent to, the IP address the request came from, the page you were trying to reach after signing in, the date the link was used, and an expiry date. These records validate the link and help us spot abuse.
  • Uploaded material: pasted text and text extracted from your files are processed in memory to produce the cards. The file itself is never stored on our servers. Of the source text, only a 500-character excerpt is kept alongside the deck, so you can tell where it came from. Before you sign in, however, that text is saved on YOUR device, in the browser's local storage, so it survives the trip to your inbox: see the “Cookies and local storage” section.
  • Decks and cards: title, description, folder, settings, and the front and back of every card — which is, in practice, part of your material rewritten.
  • Progress: for each card you review, its state (new, learning, known), how many times you have reviewed it, and when you last did.
  • Generation history: date, title, mode, model used, number of characters sent, number of cards produced, duration and, where relevant, the error message. The text you sent is not kept there.
  • Payment: Buvard processes and stores no payment data. Passes are sold by Polar, which alone collects and keeps the payment and billing details. All Buvard receives back is your customer identifier, your email address, the pass purchased and its validity dates — the minimum needed to activate your account.

Why, and on what legal basis

Each use of your data serves a defined purpose and rests on a legal basis under the GDPR:

  • Running the service — account, generation, review, export: performance of the contract (Article 6(1)(b)).
  • Sending sign-in links and account-related messages: performance of the contract.
  • Enforcing quotas and preventing abuse: our legitimate interest in protecting the service (Article 6(1)(f)).
  • Keeping the service secure and diagnosing technical errors: legitimate interest.
  • Meeting accounting and legal obligations: legal obligation (Article 6(1)(c)).

No marketing outreach, no advertising profiling, no sale of data. Should a newsletter ever launch, it will rest on separate, explicit consent.

Your material is sent to OpenAI, outside the EU

This is the point to understand before you upload anything. To generate your cards, the material you supply is sent to OpenAI, the company behind the models in use, through its API. This is a disclosure of your material to a third-party company whose processing takes place in the United States.

What is sent: the text you paste into the generator and the text extracted from your PDFs, Word documents and text files. Images you upload go to the same provider, whose vision model reads the characters in them. Extracting text from PDFs and Word documents, by contrast, happens on our own servers, with no third party involved.

That transfer leaves the European Union. It is covered by the European Commission’s standard contractual clauses, which OpenAI adheres to in its data processing terms.

The practical consequence: do not send health data, other people's personal data, trade secrets or confidential documents to Buvard. Lecture notes, yes; a patient file, no.

Other recipients and processors

Besides OpenAI, the following providers take part in running the service:

  • Polar Software, Inc. — sells the passes as merchant of record and handles payments. It collects the payment and billing details itself, and they never pass through Buvard. For that processing Polar acts as an INDEPENDENT controller, not as a processor: it is the seller, it sets its own purposes and answers for its own tax obligations. Its own privacy policy therefore applies in its own right.
  • Resend — delivery of sign-in emails. Receives your email address and the contents of the message.
  • No fallback SMTP provider is configured: if Resend fails to deliver, no other provider receives your address.
  • OVH SAS (France) — hosts the site, runs the code and stores accounts, decks, cards, history and progress. The data remains in France.
  • Cloudflare, Inc. (United States) — delivers the site and protects it against attacks. Sees IP addresses and request headers, without accessing account content. Also provides audience measurement (Cloudflare Web Analytics): visit counts, pages viewed, referring page, country and device type, with no cookie and no persistent identifier, and no profile built from one visit to the next. Transfers covered by the European Commission’s standard contractual clauses.

No other recipients. No ad network, no sale of data, and no audience measurement beyond the one described above.

How long we keep it

The retention periods are as follows:

  • Account, decks, cards, progress, folders and history: kept for as long as the account exists, then erased immediately when it is deleted.
  • Sign-in tokens (hash, email address, IP address): valid for fifteen minutes, purged automatically once they expire.
  • Session cookie: thirty days, renewed each time you sign in.
  • Technical logs: kept for a maximum of 30 days on the server, then deleted automatically. They contain the IP address, the date and the page requested, and are used solely for security and fault diagnosis. They are never cross-referenced with your account.
  • Accounting records relating to passes: ten years from the close of the financial year, under article L123-22 of the French Commercial Code. They cover the payouts received from Polar, not customer invoices — those are issued and kept by Polar, as the seller of the pass.

Cookies and local storage

Buvard sets no advertising trackers. Site analytics are handled by Cloudflare Web Analytics, which writes no cookie and no other data to your device and does not follow you from one site to another. That is why you see no consent banner: nothing is stored on your device beyond the cookies listed below, which are strictly necessary to the service you asked for and exempt from prior consent.

  • buvard_session — keeps you signed in. Signed, unreadable by page JavaScript, thirty days.
  • buvard_challenge — ties a magic link to the browser that requested it, so an intercepted link cannot be used elsewhere. Fifteen minutes.
  • NEXT_LOCALE — remembers the display language you chose. One year.
  • buvard_sidebar — remembers whether the app's sidebar is collapsed. One year.
  • buvard:draft — local storage, not a cookie: your generation draft, meaning the text you pasted or that was extracted from your files (up to 300,000 characters), the suggested title and the document names. It stays on your device, is only picked up for one hour, and is erased as soon as the generation completes, on your next visit if it has expired, or through your browser's “clear site data” function.
  • buvard:decks-view — local storage: remembers whether your decks show as a grid or a list.

The last two entries are not cookies: they live in the browser's local storage, are never sent to our servers, and never leave the device that wrote them. The draft is the only place your material is kept outside your account; if you would rather it were not, clear the site data once your deck is generated.

None of these cookies follows you around outside Buvard.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to leave instructions on what becomes of it after your death.

Exercising these rights is free, and deleting your account requires no justification.

Exercising them inside the app

Two of those rights are built straight into Buvard, with no need to write to anyone: in the app, open the Settings screen and go to the Data tab.

  • Access and portability: "Export as JSON" produces a file containing your account, your decks, your cards and your generation history. Each deck can also be exported as an .apkg file that Anki reads.
  • Erasure: "Delete my account" cascades through your account, your decks, your cards, your progress, your folders, your history and the sign-in tokens tied to your address. It is immediate and permanent — export first.
  • Rectification: your display name, your language and your preferences can be changed on the same screen.

For other rights, or if you no longer have access to your account, write to [email protected]. We reply within one month, as required by the GDPR.

Security

There are no passwords, so there is no password database to compromise. Sign-in tokens are stored only as hashes, the session cookie is cryptographically signed and cannot be read by page JavaScript, and all traffic goes over HTTPS.

No system is infallible all the same. Should a breach be likely to result in a high risk to your rights, you will be informed as required by Article 34 of the GDPR.

Minors

Buvard is aimed at secondary-school pupils, students and professionals. The service is restricted to people aged 15 or over: in France, a minor under fifteen cannot consent alone to the processing of their data for an online service. Age is declared at sign-up and is not verified against any document; if we learn that an account belongs to someone under 15, it is deleted.

Changes to this policy

This policy may change, in particular if a processor changes. The date of the latest revision appears at the top of this page, and any significant change is flagged to account holders.

Contact and complaints

For any question, or to exercise a right: [email protected].

If our answer does not satisfy you, you can complain to the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or to the supervisory authority of your own country of residence.