Where can I read Martialnote's privacy policy?

The policy is published at martialnote.com/en/privacy.html (French: martialnote.com/confidentialite.html), with the Privacy link at the bottom of every landing page and the Read the privacy policy link on the account creation screen. The version in effect dates from October 28, 2026. It applies in every country; depending on the country, the law may give additional rights, which Martialnote respects.

In short:

• Roles: the school is responsible for the information about its students and their parents; Martialnote hosts and processes it on the school's behalf and on its instructions (under the GDPR: the school is the controller, Martialnote the processor). Martialnote is responsible for accounts. Contact: the founder, at bonjour@martialnote.com.
• Data: accounts (name, email, language and style, role, date the terms were accepted), data entered by the school, history of changes, copy of sent emails, server technical logs, and the fingerprint of IP addresses linked to account creation and to the security log (computed with HMAC, never the plain address). No date of birth, no card number, no password.
• Cookies: just one, for sign-in (up to 90 days). No measurement cookie. Martialnote measures its use anonymously (screens and features used, by role and by school size and age), with no name, identifier, amount or content of a record or message; this measurement is hosted on its own server and can be refused with Do Not Track or Global Privacy Control (see "What does Martialnote measure?").
• Use and legal basis: providing the service only (contract), protecting and improving it (legitimate interest). No advertising, sale, profiling or AI training. For student data, the legal basis is the school's.
• Minors: accounts are for adults who run or teach at a school; the school makes sure it has the permission of parents or guardians before entering a minor.
• Providers: Hostinger (hosting), Backblaze (encrypted backups), Resend (emails), Stripe (subscription payment; Martialnote never sees the card and only keeps Stripe identifiers, amounts and dates), Cloudflare (Turnstile anti-robot check at account creation, which sees the IP address during the check); OpenRouter only if the owner turns on reading names from a photo. No other sharing, except when required by law or in a sale of Martialnote (the buyer remains bound by the policy).
• Internal access: to review a message held by security, a Martialnote operator may read the subject and the text of that held message, and nothing else (no addresses, no names).
• Hosting: in the United States, with recognized safeguards for transfers (standard contractual clauses). See the FAQ "Where is my data hosted?".
• Retention: as long as the school uses Martialnote; trash 30 days, then erased with its history; copy of emails 90 days; server logs 30 days; IP address fingerprints 30 days; security log 12 months; backups erased within 12 months after a school closes or an account is deleted (on request at bonjour@martialnote.com).
• Rights: see, correct, delete, get a copy, restrict or object to use, withdraw consent; answer within 30 days; complaints can go to the data protection authority of one's country or province (for example the Commission d'accès à l'information in Québec, the CNIL in France).
• Incident: prompt notice to the schools and people concerned, and to the authorities where the law requires it.
• Changes: email notice at least 30 days before a significant change.

Support does not interpret the policy beyond what it says: for a specific legal question, write to bonjour@martialnote.com.