PRIVACY NOTICE
How JEVA handles learner information.
This draft explains the information needed to run the website, subscription, audio player, learner progress and customer support.
Seller and contact
JEVA is operated and sold by AntiboTech Incorporated, Newfoundland and Labrador corporation 92857.
395 Lakeshore Drive
Hammonds Plains, NS B4B 1Z7
CanadaRegistered and mailing office
55 Fort Amherst Rd
St. John's, NL A1C 5H2
Canada
Support and privacy: support@thefrenchyouknow.com. Public phone: +1 (902) 401-5966.
Information collected
- Account email, authentication identifiers and challenge state, hashed session tokens, expiry records, and security or rate-limit events.
- Stripe customer, checkout, subscription, price, invoice, payment, refund, dispute and event identifiers, plus the selected plan, amount, currency, paid-through date and reconciliation status.
- Lesson, position, completion, replay count, instructor preference, progress revision and timestamps.
- Random device or installation identity, device label, last-seen time, short playback leases, authorized-media identity and access audit events.
- Messages sent to support, IP address, request metadata, bounded service events, errors, and release or configuration identifiers.
Stripe processes payment methods, full card details, billing address and tax information entered at checkout. JEVA does not store full card numbers or card security codes. JEVA does not request microphone access or record spoken practice. No behavioural-advertising or session-replay software is evidenced in the reviewed product.
Purposes
JEVA uses this information to create and protect accounts, provide the course, bind verified payments to the right learner, save progress and preferences, prevent unauthorized audio access, process cancellation, refunds, disputes, deletion and support, maintain releases, recover failures, and meet accounting, tax, consumer and security duties. Optional marketing requires separate consent where the law requires it. Authentication, receipts, security notices and requested support replies remain transactional.
Providers and storage
JEVA uses Supabase for authentication and learner data, Resend for authentication email, Stripe for billing, Render for application hosting, and Cloudflare R2 for private audio. Production regions, provider contracts, subprocessors, transfer terms and support-mail processing remain launch checks.
After sign-in, JEVA uses a secure, HTTP-only, same-site session cookie. A server session can last up to 30 days. Functional browser storage keeps playback, progress, device identity, retry state and application caches. Clearing site data can remove progress that has not synced.
Proposed retention schedule
Pending launch approval and production verification. These periods are targets, not a claim that every purge job is already running.
| Record | Proposed maximum or rule |
|---|---|
| Expired one-time-code challenges, sessions and playback leases | Remove from JEVA-controlled tables within 1 day after expiry; a live session can last up to 30 days. |
| Progress mutation receipts | 7 days after creation. |
| Routine analytics and operational events | 14 days, except documented incident evidence. |
| Feedback outside an open support case | 30 days; deletion removes the learner link. |
| Account, progress, preferences and devices | While active; then remove or de-identify after verified deletion and billing safeguards. |
| Support cases | 24 months after closure, then delete or de-identify unless a dispute or law requires longer. |
| Billing, tax, refund, dispute and financial audit records | Proposed 7 years after the relevant fiscal period, adjusted to the seller's verified legal duty. |
| Security and operator audit evidence | 24 months by default; longer only for an active incident, claim, fraud inquiry or integrity receipt. |
| Canadian privacy-breach records | At least 2 years where PIPEDA applies. |
| Encrypted backups | Proposed rolling maximum of 35 days after backup and restore behaviour is verified. |
| Automatic-renewal consent and exact policy version | At least 3 years, or 1 year after termination if later, where an approved territory requires it. |
Your choices
A learner may ask for access, correction, export, deletion, consent withdrawal, restriction, objection or portability where applicable, request device removal, and stop renewal through Manage subscription. Signed-in Account links to a JSON export of the profile, progress, devices and feedback; additional records can be requested through support. Account also explains how to request device removal or deletion. These requests require ownership verification and do not automatically delete data or cancel billing. Active paid-through access and open checkout must be resolved before deletion. Support staffing, complete export coverage and the paid-through deletion workflow remain launch-verification gates.
Server deletion cannot clear browser storage or application caches on every device. The final deletion flow must provide device-cleanup instructions.
Security, children and changes
Reviewed staging evidence covers HTTPS, hashed sessions, signed webhooks, account-bound access, private media, immutable release hashes and specific denial probes. Production least privilege, monitoring, restore and incident response remain launch gates. Checkout is intended for an adult able to enter the subscription contract; the initial sale must not target children under 13 without a reviewed parental-consent and child-privacy flow.
The effective notice will show its version and date. Material new purposes, disclosures or reduced choices receive notice and renewed consent when required.