Who is responsible for your data?
The PROMETHEUS association, whose registered office is at 307 avenue Thiers, 33100 Bordeaux, France, is the controller for the processing described in this policy. It is represented by its co-presidents Esteban Noel-Dufour and Allan Malheiro.
This policy covers prometheus-edu.fr, student and teacher accounts, AI tools, training and enquiries sent to the association, including through Praxis.
Which data is used and why?
- Accounts and access to services
- Name, email address, institution, role, authentication information, student status declaration and acceptance of the terms. This data is used to create accounts, manage access and provide requested services. Legal basis: performance of the terms of use.
- Artificial intelligence and learning
- Messages, responses, submitted documents or excerpts, saved history, service usage, progress, results and learning activities. This information is used to respond to requests and retrieve saved work. Legal basis: performance of the requested service.
- Enquiries and projects
- Contact details and messages sent to the association. Legal basis: the association’s legitimate interest in responding to enquiries and discussing its projects.
- Security and abuse prevention
- Connection data, technical information, quota usage and registration restrictions. Legal basis: legitimate interest in protecting accounts and keeping the service operational.
- Article audience measurement
- With your consent, article pages viewed, reading progress, outbound clicks, infographic views, device type, referring domain and a random session identifier. Legal basis: consent, which can be changed below.
Required information
Fields marked as required are necessary to process the request or provide the relevant feature. Without them, account creation or fulfilment of the request may be impossible. Other fields are optional.
When using AI, limit personal information to what is strictly necessary. Do not submit sensitive data, passwords or confidential documents without the necessary rights and authorisations.
Who receives the data?
Authorised PROMETHEUS personnel access the information needed for their duties. Teachers can access the information made available in their teaching spaces. Technical providers perform the functions described below.
- Netlify and Supabase
- Netlify delivers the website. Supabase provides platform authentication, the database and storage.
- Artificial intelligence providers
- Questions asked to the AI are sent to OpenRouter, which forwards them to the host of an open-weight model (for example DeepSeek, Qwen, Mistral or Gemma). PROMETHEUS asks OpenRouter to use only hosts that state they do not collect data. Scientific research features may query Semantic Scholar.
- Email services
- Email delivery and reception services route verification and account recovery messages and replies to your enquiries.
What is sent to AI models?
The request content, documents attached to the conversation and the conversation context are sent to OpenRouter, then to the host of the model used. This content may contain personal information even if the account holder’s name is not sent separately.
The models used are open-weight. Data retention and usage arrangements depend on the terms of OpenRouter and the selected host. This policy does not constitute general consent to reuse your conversations to train models.
Processing outside the European Union
Some providers and their subprocessors operate outside the European Union, including in the United States and Singapore. A provider’s registered office alone does not establish the location of its servers or the teams accessing data.
Transfers must be covered by a mechanism provided for by the GDPR, such as an applicable adequacy decision or standard contractual clauses with any necessary safeguards. You can ask PROMETHEUS for details of the recipients and safeguards applicable to your use.
How long is data retained?
- Accounts and saved work
- Data remains associated with the account so that it can be used and saved work accessed. You can delete conversations where this feature is available and request deletion of your account or specific data.
- Enquiries sent to the association
- Retention depends on the time needed to handle and follow up the enquiry and, where applicable, legal obligations or the need to defend a legal claim.
- Security, restrictions and backups
- Some data may remain after account deletion to manage a registration restriction, a legal obligation or a dispute. In particular, an email address may be kept on a restriction list. You can request a review of this retention. Provider backups and logs follow their applicable retention cycles.
- Navigation choices and audience measurement
- Your audience measurement choice is stored in this browser for up to 180 days. The measurement identifier stays in the tab session. Events already received are used for editorial statistics; requests relating to this data can be sent to the association.
Your browsing preferences
The browser stores information needed to sign in and your language and display preferences. Clearing this storage may sign you out or reset your preferences.
Optional article audience measurement is disabled by default. It is enabled only with your consent. Your choice applies to this browser and can be changed here at any time. Withdrawal stops new measurements; it does not affect the lawfulness of processing already carried out with your consent.
Disabled. Articles remain available without this measurement.
Exercise your rights
You can request access to your data, rectification, erasure or restriction of processing. Depending on the applicable legal basis, you may also exercise your right to data portability, object to processing or withdraw your consent.
Send your request to contact@prometheus-edu.fr or the association’s registered office, identifying the account or data concerned. Proportionate identity verification may be requested if there is reasonable doubt. A response is normally provided within one month; a reasoned extension is possible under the conditions set out in the GDPR.
You can also lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL).
Changes to this policy
This policy is updated when services or processing change. The update date appears at the top of the page. Changes that substantially affect the use of your data are communicated appropriately.