Privacy Policy

Hélène B Academy places great importance on the protection of your personal data and respect for your privacy.

This privacy policy informs you about how we collect, use, store and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. DATA CONTROLLER

The data controller for your personal data is:

For any questions regarding your personal data or this privacy policy, you can contact us at the email address above.

2. PERSONAL DATA COLLECTED

We only collect personal data necessary for the operation of our services and compliance with our legal obligations.

2.1. Identification data

• First and last name
• Email address
• Phone number
• Postal address (for in-person training)

2.2. Connection data

• IP address
• Connection logs
• Cookies (see section 10)
• Information about your browser and device

2.3. Payment data

• Billing information
• Transaction history

2.4. Training data

• Course progress
• Course purchase history
• Grades and results (where applicable)
• Interactions with educational content

3. PURPOSES OF PROCESSING

Your personal data is collected and processed for the following purposes:

3.1. Account management

• Creation and management of your user account
• Authentication and access security
• Profile management

3.2. Provision of training

• Processing your orders
• Access to training content
• Pedagogical monitoring and progress tracking
• Organisation of in-person training
• Issuance of training certificates

3.3. Payment management

• Transaction processing
• Invoicing
• Refund management (where applicable)

3.4. Communication

• Responding to your enquiries and questions
• Customer service and technical support
• Important notifications regarding your account or training
• Sending news and information (with your consent)

3.5. Legal obligations

• Compliance with accounting and tax obligations
• Retention of legal documents (invoices, contracts)
• Responding to requests from competent authorities

3.6. Improvement of our services

• Analysis of Site usage (with your consent)
• Anonymised statistics
• Improvement of user experience

4. LEGAL BASIS FOR PROCESSING

The processing of your personal data is based on the following legal grounds:

• Performance of a contract: For the provision of training and management of your account (Article 6.1.b of the GDPR)
• Legal obligation: For compliance with our accounting, tax and regulatory obligations (Article 6.1.c of the GDPR)
• Consent: For sending newsletters and marketing communications (Article 6.1.a of the GDPR)
• Legitimate interest: For Site security and fraud prevention (Article 6.1.f of the GDPR)

5. RETENTION PERIOD

Your personal data is retained for the periods necessary to fulfil the purposes for which it was collected:

• User account data: Until deletion of your account + 3 years
• Billing data: 10 years (legal accounting obligation)
• Training data: Duration of contract + 3 years
• Connection logs: 12 months maximum
• Cookies: 13 months maximum
• Marketing data: 3 years from the last contact

6. DATA RECIPIENTS

Your personal data is accessible only by:

• Hélène B Academy (access strictly limited to what is necessary)
• Competent authorities in case of legal obligation

Sub-processors and technical service providers

In accordance with Article 13(1)(e) of the GDPR, here is the complete list of our sub-processors:

• Firebase / Google Cloud Platform (Google LLC, United States): authentication, database, application hosting, server functions. Data transmitted: your account, your progress and your training content. Transfers outside the European Union are covered by standard contractual clauses. Privacy Policy
• Google Analytics 4 (Google LLC, United States) :Traffic and user behaviour analysis (ID: G-6CFE0TK8X0), activated only with your consent. Privacy Policy
• Google Gemini (Google LLC, United States, with a progressive switch to Google Cloud Vertex AI hosted in europe-west4, Netherlands, European Union): educational assistance through artificial intelligence, filtering of community messages, assessment of practice photos, message translation. Data transmitted: the content of your messages, your nickname, how long you have been registered, your subscription type, your training progress and, when you request an assessment, the photos of your work. Transfers outside the European Union are covered by standard contractual clauses. Terms of use
• OpenAI (OpenAI, L.L.C., United States): generation of course sheet images, brand visuals and live session covers. Data transmitted: only the textual description of the requested image, with no data that could identify you. Transfers outside the European Union are covered by standard contractual clauses. Privacy Policy
• Google Places API (Google LLC, United States): search for nearby salons and professional venues. Data transmitted: the coordinates of the searched area and the search terms. Transfers outside the European Union are covered by standard contractual clauses. Privacy Policy
• DeepL (DeepL SE, Germany, European Union) and LibreTranslate (public service libretranslate.com): backup translation, called upon only when the main service is unavailable. Data transmitted: the text to be translated, and nothing else.
• Stripe (Stripe, Inc., United States): secure payment and Stripe Connect for payments to technicians. Data transmitted: your billing details and the amount. Your bank details are never stored on our servers. Transfers outside the European Union are covered by standard contractual clauses. Privacy Policy
• SendGrid (Twilio Inc., United States): sending of transactional e-mails and, with your consent, information e-mails. Data transmitted: your e-mail address, your first name and the content of the message. Transfers outside the European Union are covered by standard contractual clauses. Privacy Policy
• reCAPTCHA Enterprise (Google LLC, United States): protection against bots and automated abuse. Data transmitted: technical browsing signals. Transfers outside the European Union are covered by standard contractual clauses. Privacy Policy
• Finsweet Cookie Consent (Finsweet, United States) :Cookie consent management (opt-in cookie banner). Privacy Policy
• Google Firebase Hosting (Google Ireland Limited, Ireland, European Union): hosting of the heleneb.fr site. Data transmitted: technical connection logs. No transfer outside the European Union for this service. Privacy Policy
• PayPal (PayPal Holdings, Inc., United States): alternative secure payment. Data transmitted: your billing details and the amount. Transfers outside the European Union are covered by standard contractual clauses. Privacy Policy

6bis. ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISIONS

Hélène B Académie uses artificial intelligence for some functions, and ordinary software, with no artificial intelligence at all, for others. In accordance with Article 50 of the European regulation on artificial intelligence (Regulation (EU) 2024/1689), applicable since 2 August 2026, and with Articles 13, 14 and 22 of the GDPR, here is exactly who does what.

What is done by artificial intelligence

An artificial intelligence is a program that produces answers, texts or images from what it is given. It can be wrong. What it produces is indicative.

• The virtual teachers (Hélène B in AI version, Papy, Dr White and Alice, Carla and Hugo). When you write to them, you are writing to an artificial intelligence, not to a person. For Papy in particular, the URSSAF, tax and levy calculations are indicative and do not replace a certified accountant.
• The images of course sheets, brand visuals and live session covers. They are generated from a description. They are not real photographs.
• The marketing texts produced in the studio: captions, post ideas, brand story, rewording, correction.
• The assessment of your practice photos, which produces a score out of 100 and comments. This score has no consequence whatsoever on your training, on your certificate or on your access. It is educational feedback, nothing more.
• The translation of a message, when you click the translation button.
• The mapping recommendation, which suggests a style based on the shape of the eye and the natural lashes. It is a suggestion, the decision remains yours.
• The filtering of community messages. Public and group messages are analysed by an artificial intelligence that detects hateful, violent or sexual content. This filtering is decided by the model, with no prior human review.

What is done by ordinary software, with no artificial intelligence at all

These operations are simple calculations. They follow fixed rules, written in advance, always the same. There is no model, no learning and no interpretation.

• The marking of your quizzes. The software compares the answer given with the correct answer. That is all.
• The issuing of the certificate. It is issued if all chapters are completed and if the score reaches at least 70 per cent correct answers. These are two numerical conditions, checked by a calculation. No artificial intelligence takes part in this decision.
• The tracking of video viewing. We measure your playback speed, the time the tab remains visible and your fast forwards. This tracking is not artificial intelligence: it is a weighted average compared with thresholds set in advance in the code. It is used to check that chapters are genuinely followed, which protects the value of your certificate, and to identify the passages where students drop off. If the measurements fall outside the usual values, an alert containing your nickname and your e-mail address is sent to Hélène B, who handles it herself. Nothing is blocked automatically.
• The account health score and the training recommendation. Despite their names, these are additions of factors with fixed weightings. There is no predictive model.
• The e-mails sent according to your activity, only if you have agreed to receive them. You can unsubscribe at any time.

What is done by a human being

• Your progress is followed by Hélène B, in person. No artificial intelligence trains you or supports you autonomously today. The artificial intelligences are used to gather information and to provide occasional help.
• The training content is written, filmed and validated by Hélène B and her team.
• The decisions that affect your training are taken by a human being: access, a refund, a reply to a complaint, the follow up given to an alert.

What is currently under development

Work in progress aims to give artificial intelligence a genuine ability to support the student. It will not be activated without three guarantees:

• You will always know that you are addressing artificial intelligence models. It will be written on screen, at the moment you use them.
• The knowledge content these models rely on is verified and selected by human beings.
• An artificial intelligence will be able to prepare and to suggest. A human being will decide.

This page will be updated before activation, not afterwards.

Processing of your data by the models

• Providers: Google Gemini (Google LLC, United States), with a progressive switch to Google Cloud Vertex AI hosted in europe-west4 (Netherlands, European Union), and OpenAI (OpenAI, L.L.C., United States) for image generation.
• What is transmitted: the content of your messages, your nickname, how long you have been registered, your subscription type and your training progress. When you request an assessment of your practice, the photos of your work are also transmitted. We transmit neither your surname, nor your postal address, nor your telephone number.
• Transmission: through a secure Cloud Functions proxy, with authentication, App Check and encryption in transit. Transfers outside the European Union are covered by standard contractual clauses.
• Storage: your conversations with the virtual teachers are recorded in your Firebase space, they may be consulted by Hélène B in order to improve the training courses, and you can delete them at any time.
• Technical monitoring: token consumption is counted for cost management purposes (gemini_usage collection).

Automated decisions (Article 22 of the GDPR)

We must be accurate on this point. Automated processing does indeed exist, and you have the right to know which.

• The filtering of community messages is decided by an artificial intelligence model, with no prior human intervention. A message judged inappropriate is not published.
• The issuing or refusal of the certificate results from an automatic calculation, above or below 70 per cent correct answers. No artificial intelligence takes part in it, but the decision is indeed automatic. It is explained to you and expressed in figures.
• The score out of 100 for the assessment of your practice photos is produced by an artificial intelligence. It has no consequence on your training, your certificate or your access.
• The sending of follow up e-mails according to an automatically calculated score band, only if you have consented to receive them.
• The creation of a viewing alert when the measurements fall outside the usual values. This alert is passed to Hélène B, who handles it herself. No access is blocked automatically.

For this processing, you have the following safeguards:

• To be informed of the existence of the processing, of the logic behind it and of its consequences. That is the purpose of this section.
• To obtain human intervention. On simple request, a human being takes the case back in hand.
• To express your point of view on the decision taken.
• To contest the decision by writing to contact@heleneb.fr. We reply within 30 days at the most.

Your other rights concerning AI

• You can delete all your conversations with the virtual teachers, as well as your AI knowledge base (GDPR, Article 17).
• You can export your conversations through the data export function (GDPR, Article 20).
• You can switch off personalisation by artificial intelligence from your profile, section My AI data. The virtual teachers continue to work, simply without taking your profile into account.

7. YOUR RIGHTS (GDPR)

In accordance with the GDPR, you have the following rights:

• Right of access: Obtain a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request the deletion of your data (subject to legal obligations)
• Right to restriction: Restrict the processing of your data
• Right to data portability: Retrieve your data in a structured format
• Right to object: Object to the processing of your data
• Right to withdraw consent: For processing based on consent

How to exercise your rights?

To exercise these rights, contact us:

• By email: contact@heleneb.fr
• By post: 321 avenue de la Pergola, 06390 Bendejun, FRANCE

8. COMPLAINT TO THE CNIL

If you believe your rights are not being respected, you can file a complaint with the Commission Nationale de l'Informatique et des Libertes (CNIL):

• Website: www.cnil.fr
• Address: CNIL - 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

9. DATA SECURITY

Hélène B Academy implements appropriate technical and organisational measures to ensure the security and confidentiality of your personal data:

• SSL/TLS encryption of connections
• Secure hosting with certified providers
• Restricted access to data
• Regular backups of data
• Monitoring of access and intrusion attempts

10. COOKIES

What is a cookie?

A cookie is a small text file placed on your device when you visit the Site, allowing information about your browsing to be stored.

Types of cookies used

1. Strictly necessary cookies (mandatory)
   • Essential for the operation of the Site
   • Authentication, cart, security
   • No consent required
2. Performance cookies (with consent)
   • Collection of anonymous information about Site usage
   • Traffic analysis (Google Analytics, etc.)
3. Functional cookies (with consent)
   • Remembering user preferences

Cookie management

You can manage your cookie preferences at any time:

• Chrome: Settings > Privacy and security > Cookies
• Firefox: Options > Privacy and security > Cookies
• Safari: Preferences > Privacy > Cookies
• Edge: Settings > Privacy > Cookies

10bis. LOCATION SHARING

The Site offers you the option of sharing your precise location. This sharing never happens without your agreement: a dedicated banner explains it and lets you choose, and only once you have accepted does your browser ask you for permission to access your location.

• Purpose: understanding where our visitors come from and improving our services, in the form of internal statistics that only the Hélène B team can consult.
• Data recorded: the latitude, the longitude, the accuracy of the measurement, the page where the sharing took place and the date. Nothing else. No name, no account, no visit identifier, no IP address and no description of your device is kept alongside your location.
• Legal basis: your consent (Article 6.1.a of the GDPR), collected before any request to access your location.
• Retention period: 12 months. Beyond that, each location is deleted automatically by a scheduled purge.
• Recipients: the Hélène B team only. Locations are hosted on Firebase (europe-west1 region, European Union). They appear on a map reserved for our internal administration tool, which offers a link to Google Maps and Street View: opening that link then passes the coordinates to Google, as any use of that service does.
• Your rights: you can decline with no consequence whatsoever for your browsing, and withdraw your agreement at any time. Declining once is enough: the offer is not shown to you again.

11. DATA TRANSFERS OUTSIDE THE EU

Some of our service providers (notably Stripe and SendGrid for payment and email delivery) are located in the United States. These transfers are governed by standard contractual clauses approved by the European Commission and comply with GDPR safeguards.

12. CHANGES TO THE POLICY

This privacy policy may be updated. We invite you to consult this page regularly to stay informed of any changes.

Date of last update: 6 August 2026

In the event of a substantial change, we will inform you by email or notification on the Site.

Annex : Condensed version (articles 14 & 15)