Personal data contact
OnLevelUp is run by an informal collective of experts in certification domains, without an incorporated legal structure. The publication director and contact for personal data enquiries is Mustapha Nakous, reachable at 11 avenue du 11 novembre 1918, 94400, France. For privacy enquiries, email contact@onlevelup.com or use the contact form.
Data and purposes
| Data | Purpose | Basis for processing |
|---|---|---|
| Email, name and information shared by your chosen sign-in provider | Create the account, verify the address, provide sign-in and requested features | Performance of the requested service |
| Lessons followed, progress, answers, results and badges | Save your learning progress and display results | Performance of the requested service |
| Purchases, Stripe identifiers, amounts and payment status | Manage paid access, subscriptions, refunds and records | Contract performance and applicable legal obligations |
| Name, email, message and support correspondence | Respond to enquiries and handle complaints | Precontractual steps or contract performance; legitimate interest in responding to other enquiries |
| Email and newsletter preferences | Send service messages and an optional newsletter | Service performance for necessary messages; consent for the newsletter |
| Technical connection data, errors and anti-abuse signals | Protect the service, diagnose incidents and prevent misuse | Legitimate interest in protecting accounts and the service |
| Cookie preference and audience measurement data when enabled | Remember choices and measure visits with permission | Legitimate interest in remembering choices; consent for audience measurement |
Information needed for an account, order or enquiry is indicated in the relevant process. Without it, the corresponding feature may not be provided. Newsletter subscription is optional and declining it does not prevent learning.
Recipients and service providers
Authorised people operating the site access data needed for their responsibilities. Services used include OVHcloud for hosting, Brevo for email and Stripe for payments. Full card details are entered with Stripe and are not stored in the OnLevelUp application database.
If you choose external sign-in, the provider shown on the sign-in screen also processes data under its own policy. Google is involved when reCAPTCHA protects a form and, where enabled and accepted, through Google Analytics. Authorities may receive information where disclosure is legally required.
Hosting and international transfers
The site server is hosted by OVHcloud in Canada. Some providers may process data in other countries. We therefore do not describe data as hosted exclusively within the European Union.
You can request information about processing locations and applicable transfer safeguards at contact@onlevelup.com. Provider notices also explain their processing: OVHcloud (opens in a new tab), Brevo (opens in a new tab), Stripe (opens in a new tab) and Google (opens in a new tab).
Retention and deletion
Account and learning data are retained while the account exists to provide the service. You can delete your account in your profile, after cancelling any subscription that is not already cancelled. This removes progress, results, badges and account access rights.
After deletion, the email address, any Stripe customer identifier, and the deletion date and origin are retained for six months for support and payment follow-up. Application error logs have an intended retention period of 30 days. Records needed for a legal obligation or dispute follow the retention periods applicable to that obligation or the defence of rights.
Contact correspondence is retained to handle and follow up on the request and, where necessary, establish or defend a right until the relevant time limit expires. Backups and hosting logs follow their own retention cycle; deleting an account does not mean immediate erasure from every backup. Contact us for information about your situation.
Cookie and local storage lifetimes are described on the cookies page.
Your choices and rights
Change newsletter preferences in your profile or use an email unsubscribe link. Manage cookie consent from the cookies page. Withdrawing consent does not affect earlier processing based on that consent.
Subject to GDPR conditions, you can request access, rectification, erasure, restriction or portability, and object to processing based on legitimate interests. Email contact@onlevelup.com with your request and account email. Proportionate identity verification may be requested where needed; do not send identity documents unsolicited.
You may also lodge a complaint with the CNIL (opens in a new tab). For information about privacy transparency requirements, see the CNIL guidance (opens in a new tab).
Last updated: 13 October 2026.