Privacy policy

This privacy policy explains how NOEO collects, uses, retains and protects the personal data processed in connection with its public website and its online private tutoring platform.

It applies to website visitors, students, parents, tutors, tutor applicants, people who contact NOEO and, more generally, anyone who uses NOEO’s services.

It supplements the terms of use and the legal notice available on the website.

The controller of the processing described in this policy is NOEO. Its registration details, legal form and registered office are set out in the legal notice.

Privacy contact point: for any question or request about your personal data, you can write to contact@noeo.io.

A data protection officer (DPO) is appointed where the regulations so require; their contact details are then published on this page.

NOEO only collects information that is useful for creating an account, organising tutoring sessions, educational follow-up, the relationship between users, security and the operation of the service.

The categories of data may vary depending on the user’s role and the features used.

• Identification data: surname, first name, form of address (title), email address, role, account identifiers and login information.
• Profile data: school level, subjects, goals, learning preferences, availability and information useful for follow-up.
• Tutoring session data: scheduled sessions, history, documents, homework, session plans, replays, messages and session reports.
• Tutor data: background, subjects offered, levels taught, application details, availability and information needed to validate the profile.
• Payment and billing data: information needed for booking, payment, billing or payouts, depending on the services enabled.
• Technical data: IP address, connection logs, browser type, security events, cookies and information needed for the website to work properly.
• Data provided by Google when you sign in through Google: when you choose ‘Continue with Google’, Google sends NOEO the email address, name and profile picture of the account used, in order to create or open your NOEO account. NOEO never receives your Google password and does not access any other content of your Google account.

NOEO does not ask you to provide medical data, identity documents that are not needed for the service, or information unrelated to educational follow-up.

Some school information may be sensitive in its context, for example the difficulties encountered, session reports or progress goals. It must remain limited to what is useful to support the student.

Users undertake not to upload to NOEO any sensitive data that is not necessary, in particular medical, administrative or personal information that serves no purpose for the private tutoring.

Personal data is processed in order to provide, secure and improve the NOEO experience.

The main purposes are as follows.

• Creating, managing and securing user accounts.
• Organising online private tutoring sessions and the interactions between students, parents and tutors.
• Enabling educational follow-up: session plans, tutoring sessions, documents, replays, homework and session reports.
• Adapting access according to role: student, parent, tutor or administrator.
• Using the correct grammatical gender in the messages addressed to you, based on the form of address you provide.
• Handling requests sent through the contact, sign-up or application pages.
• Managing bookings, payments, invoices, refunds or payouts where these services are enabled.
• Improving the clarity of the user journey, educational quality, and the security and reliability of the platform.
• Complying with applicable legal, accounting, tax and retention obligations.

Depending on the processing concerned, NOEO relies on one or more of the legal bases provided for by the GDPR.

• Performance of a contract or of pre-contractual measures, to create an account, organise a tutoring session or provide the service requested.
• Legitimate interest, to secure the platform, prevent abuse, improve the experience and respond to users’ requests.
• Consent where it is required, in particular for certain cookies, communications or uses that are not strictly necessary for the service.
• Compliance with a legal obligation, for certain billing, accounting, security or retention data.

NOEO may be used in a school context involving students who are minors. In that case, the information processed must remain proportionate to educational follow-up.

When a student’s account is managed by a parent, certain data relating to tutoring sessions, documents, homework, replays and session reports may be visible from the parent space.

NOEO applies role-based access so that a parent only sees the students linked to them and a tutor only accesses the information needed to support their own students.

Personal data is accessible only to the people and services that need it in order to provide, administer, secure or improve NOEO.

Depending on the case, recipients may include the user themselves, the parents linked to a student, the tutors concerned, authorised NOEO staff, technical service providers or the competent authorities where required by law.

NOEO does not sell its users’ personal data.

NOEO uses technical service providers that act as processors within the meaning of the GDPR, solely on its instructions and subject to confidentiality commitments.

The relevant processors are listed below, and this list is kept up to date on this page.

• Supabase · database hosting, authentication and storage. Data hosted in the European Union (Ireland).
• Secure payment provider · processing of payments, billing and payouts to tutors.
• Resend · sending of transactional emails.
• Pencil Spaces (Pencil Learning Technologies, Inc.) · video-conferencing provider: virtual classroom, recording of sessions and automatic transcription of each recording. Replay videos are streamed by Vimeo, a sub-processor of Pencil Spaces.
• GreenPT · Noé, the AI study assistant, generation of educational content and internal assistance. A provider established in the European Union (Netherlands); processing takes place in France and Finland, at Scaleway and Inceptron, its own sub-processors, which are also established in the European Union. This provider undertakes not to use the data to train its models, and it does not retain the requests sent to it: it processes them in memory, only for as long as it takes to produce the response.
• Mistral AI · automatic moderation of exchanges with the assistant, intended to protect minors. A provider established in the European Union (France).
• Google · delegated authentication when you choose ‘Continue with Google’ (see Article 3); separately, an alternative option for running the assistant, which is not used for minors’ data without specific safeguards.
• Railway · hosting of the web application.
• Sentry · technical monitoring of application errors. Only errors are reported: no session recording, no navigation tracking and no profiling. The IP address, identifying headers and request content are not transmitted, and links containing a token are masked before sending. The information attached to an error is limited to technical elements (nature of the point of failure, role, technical identifier, error code). Events are sent to the service’s European region (Germany).
• Trustpilot · collection of customer reviews. When a session report or a payout notice is sent to you, your email address is sent in blind copy (Bcc) to Trustpilot, which then sends you an invitation to leave a review. A provider established in the European Union (Denmark). Students who are minors are never asked, and an unsubscribe link is included in every invitation.

Where payments are offered, certain data may be needed to confirm a tutoring session, issue an invoice, handle a refund or make a payout.

Full bank details are not intended to be stored directly by NOEO when payment is processed by a specialist payment provider.

Billing data may be retained for the periods required by applicable legal, accounting and tax obligations.

The website uses cookies that are strictly necessary for the operation of the service, for security and for browsing within managed accounts. These cookies are exempt from consent. Details are available on the Cookies page.

The website also uses an audience measurement cookie (Google Analytics), which is set only with your prior consent, obtained through a banner that lets you refuse as easily as you accept. No advertising trackers are used.

NOEO also uses a self-hosted audience measurement tool (Umami), installed on its own European hosting. This tool sets no cookies, uses no advertising identifier, does not follow visitors from one website to another and does not record any browsing session. It produces aggregated figures · number of visits, pages viewed, referral source · and not individual profiles; on that basis it falls under legitimate interest and does not require consent.

This measurement covers the public website and, where it is enabled, the personal spaces of parents and tutors. It does not cover the student space: student accounts may belong to minors, and no audience measurement is enabled there. Any change on this point would first be described here.

NOEO retains personal data for as long as necessary for the purposes for which it was collected, and then for the periods required or permitted by law.

The retention periods applied are as follows.

• Account: kept while it is active, then anonymised three years after the last activity.
• Accounting and billing data: ten years (legal obligation).
• Educational data of minors (tutoring sessions, homework, marks, session reports): until the end of the relationship, then anonymised within twelve months.
• Messages: content anonymised after one year.
• Video replays of sessions and their transcription, where recording has been authorised: accessible for three months from the tutoring session, then retained for up to twelve months from the session, for security and for handling disputes, before the media is deleted, both at NOEO and at the video-conferencing provider. Deleting the student’s account deletes them without waiting for that deadline.
• Exchanges with the ‘Noé’ assistant: kept in your space like other educational data. The provider that runs the assistant does not retain them.

NOEO implements technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure.

Access is organised by role in order to limit visibility to the information each user needs.

Each user must keep their login details confidential and inform NOEO if they suspect unauthorised access.

The main data hosting (database, authentication, storage) is located in the European Union (Ireland).

Technical error monitoring is configured on its provider’s European region (Germany): error events are ingested and stored there.

Some processors are located in the United States: the payment provider and Resend participate in the EU–US Data Privacy Framework. Other transfers are governed by the European Commission’s standard contractual clauses; the mechanism applicable to the video-conferencing provider is being formalised.

You can obtain further information about the safeguards governing these transfers by writing to contact@noeo.io.

In accordance with the applicable regulations, data subjects may exercise their rights of access, rectification, erasure, objection, restriction and, where applicable, data portability.

They may also withdraw their consent where the processing is based on it, without affecting the lawfulness of processing carried out before the withdrawal. Withdrawing your consent and exporting your data can be done directly from your privacy settings.

For students who are minors, these rights are exercised by the holder of parental authority. To exercise your rights, you can write to contact@noeo.io, stating your request and the information needed to identify you; NOEO responds within one month, which may be extended by two months for a complex request.

If you believe that your rights have not been respected, you can contact NOEO so that your request can be answered.

You also have the right to lodge a complaint with the CNIL, the French data protection authority.

NOEO may amend this policy to reflect changes to the service, legal obligations, technical service providers or user journeys.

The applicable version is the one published on this page. In the event of a substantial change, NOEO may inform users by any appropriate means.