Privacy Policy

Last updated: 21 June 2026.

1. Who we are (Data Controller)

AceBar is operated by Safa'a Ounis, sole proprietor (entreprise individuelle), SIREN 904 133 774, 60 rue François 1er, 75008 Paris, France. We are the data controller for personal data processed through acebar.app. Contact: https://acebar.app/contact

2. Data we collect

Account data: your email address and any name you provide. Authentication is handled by Supabase; passwords are hashed and we never see them.
Learning data: your practice answers, scores, essay submissions, and progress.
Contact data: the name, email, and message you send via our contact form.
Payment data: processed by our payment provider (see Sub-processors). We do not store your card details.
Technical data: IP address, device/browser type, and log data, used to operate and secure the service.

3. Why we process it & legal bases (GDPR Art. 6)

To provide the service and your account — performance of a contract.
To process purchases and grant access/credits — performance of a contract / legal obligation.
To grade your essays with AI — performance of a contract (see section 4).
To respond to your contact requests — legitimate interest / consent.
To ensure security and prevent fraud or abuse — legitimate interest.
To comply with legal and tax obligations — legal obligation.

4. AI essay grading — important

When you submit an essay for grading, the essay text is transmitted to Anthropic (our AI provider) solely to generate your score and feedback. It is processed under Anthropic's commercial terms and is not used to serve you advertising. Please do not include sensitive personal information in your essay answers.

5. Sub-processors (third parties processing data on our behalf)

Lovable Labs Incorporated (United States) — application hosting / platform.
Supabase — database and authentication (data storage).
Anthropic, PBC (United States) — AI grading of essays.
Paddle.com Market Ltd (United Kingdom) — payment processing and Merchant of Record.

6. International transfers

Some sub-processors are located outside the EEA (e.g. United States, United Kingdom). Where this happens, transfers are protected by appropriate safeguards, such as Standard Contractual Clauses or an adequacy decision (the UK benefits from an EU adequacy decision).

7. How long we keep data

We keep your account and learning data for as long as your account is active, and for a reasonable period afterwards, then delete or anonymise it. Contact messages are kept only as long as needed to handle your request. Some data may be kept longer where required by law (e.g. tax records). You can request deletion at any time.

8. Your rights (GDPR)

You have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. To exercise any of these, contact us via https://acebar.app/contact. You also have the right to lodge a complaint with the French data protection authority (CNIL — www.cnil.fr).

9. Cookies

We use only strictly necessary cookies (e.g. to keep you signed in). We do not use advertising cookies. If we add analytics in the future, we will request your consent where required.

10. Security

We protect your data with encryption in transit, hashed passwords, row-level access controls, and restricted administrative access.

11. Children

AceBar is intended for adults preparing for a professional exam and is not directed to children. We do not knowingly collect data from anyone under 16.

12. Changes

We may update this policy; material changes will be shown on this page with a new "Last updated" date.