Privacy, Cookies and Data Protection Policy

This Policy provides you with important information about how MEXT (the company owning and running the Mexty.ai platform) collects and processes your personal data when you use our services, and meets personal data protection requirements, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, "GDPR"). It applies to the data processed when using Mexty.ai, which enables users to build and share AI-assisted digital content, such as training modules, applications, or websites.

The protection of the data of our customers and of their users, as defined in the General Conditions of Use, is at the heart of MEXT's concerns. MEXT intends to be fully transparent regarding the nature of the data collected, the possibilities given to have it deleted or corrected if it is erroneous, the duration of archiving (for personal data), and with whom it can be shared, especially when it comes to personal data.

This Privacy, Cookies and Data Protection Policy applies as soon as a user uses the services provided by the Mexty.ai platform. Any user who wants to access the platform and its services must therefore accept it, as well as any modification of it. Registered users share some content. This content and data from some of our services are available to non-registered users.

MEXT may amend this Policy and, if the changes are significant, will notify you to give you the opportunity to review and approve the changes before they are effective. If you object to any of the changes, you may close your account. If you continue to use our services after the publication of changes, the collection, use and sharing of your personal data is subject to the updated version of the Policy as of its effective date.

A. Personal Data Collected

We may collect the following data:

• Account info (name, organization information, address as needed for billing, email): to create and secure a user account, provide access to Mexty.ai platform services, and produce invoices. Legal basis: performance of our contract with you and our customer, and informed consent.
• AI prompts / generated content: to provide AI generation services. Legal basis: informed consent and contract necessity.
• Technical data (time, IP address, internet access provider, proxies, URL of origin/referrer, device type & OS, resolution): to improve Mexty.ai services and ensure traceability to respond to requests from administrative and legal authorities. Legal basis: legal obligation and informed consent.
• Usage data (features usage, click paths): for availability and improvement of Mexty.ai services. Legal basis: our legitimate interest in analyzing our services to offer you the best possible user experience.
• Payment data (via Stripe): for subscription, payment processing, and billing. Legal basis: contract necessity and legal obligation. Mexty.ai does not store credit card details.

B. How data is collected

Data is collected:

• Directly when you register or interact with the service;
• Automatically through cookies and server logs;
• Indirectly via third-party integrations (e.g., AI models or payment processors).

We do not collect special category (sensitive) data.

C. With Whom Do We Share Data

We may share your personal data with the following recipients to fulfill the purposes outlined above:

• Processors: service providers who assist us with IT and system administration services.
• Cloud Service Providers: we use cloud services from providers like OVH and AWS to store and manage data securely.
• Stripe: for payment transaction management. See their privacy practices at https://stripe.com/gb/privacy.
• Third-party partners, integration providers, and affiliates with whom you interact, in order to facilitate the provision of our services.
• Regulators and public authorities: when required by law or policy, including law enforcement agencies.

The person responsible for processing the data collected on the Mexty.ai platform is: MEXT, a simplified joint-stock company (SAS) whose registered office is located at 2, allée Antoine Lemaistre, 78460 Chevreuse, France, registered in the commercial and company register of Versailles under reference 928 317 874, represented by its president, Mr Hubert Maupas.

To exercise any of the rights covered by Article 6, or for any related request or question, users can contact:

By post: MEXT SAS, 2 allée Antoine Lemaistre, 78460 Chevreuse, France Email: dpo@mext.app

Under the GDPR and other applicable data protection legislation, a user of the site has the following rights:

• Right to access: obtain confirmation that personal data is processed, a copy of it, and certain information related to its processing;
• Right to rectify: request that inaccurate personal data be corrected and completed. You can also change most of your personal information from your user profile at any time;
• Right to delete ("right to be forgotten"): in cases defined in Article 17 of the GDPR, obtain deletion of your personal data, in particular when it is no longer necessary for the purposes for which it was collected;
• Right to limit the processing: in special circumstances listed in Article 18 of the GDPR;
• Right to object to the processing: in certain circumstances relating to your particular situation, as defined in Article 21 of the GDPR;
• Right to portability: in cases defined in Article 20 of the GDPR, receive the personal data about you in a structured, commonly used and machine-readable format, or have MEXT pass it directly to another data controller where possible;
• Right to withdraw consent: for processing requiring your consent, at any time. This does not impair the lawfulness of processing based on the consent given before its withdrawal.

To exercise any of these rights, you may contact MEXT as indicated in Articles 3 and 5. Requests must include sufficient information to verify the identity of the person concerned. In the case of patently unfounded or excessive claims (in particular due to their repetitive nature), MEXT reserves the right to require reasonable fees or to refuse to respond. You also have the right to file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), accessible at www.cnil.fr.

The data collected on the Mexty.ai platform is stored in a secure environment. To ensure security and maintain the privacy of data, MEXT has implemented a wide range of controls including:

• Access management for MEXT authorized staff;
• Access management for users;
• Strength of passwords associated with each identifier;
• Secured communications;
• Sensitive server data at-rest protection;
• Use of monitoring software for the network and work computers;
• Regular deployment of security patches on operating systems;
• Automated data backups;
• Data packet filtering.

People working for MEXT SAS are required to respect the privacy of your data. We regularly monitor our systems for possible vulnerabilities and attacks. However, no mechanism can offer absolute security, and a certain risk always remains as long as the internet is used to transmit data. In accordance with the GDPR, MEXT will notify the CNIL and the person concerned of any personal data infringement as referred to by the GDPR.

MEXT SAS uses cookies on the Mexty.ai platform only:

• for functional purposes, including to recognize you when you use our platform;
• and to track traffic on its site using Matomo technology (https://matomo.org/), with the server of traffic data embedded in Mexty.ai's secured infrastructure.

What is a cookie?

A cookie is a small information file saved on the user's computer/device while browsing the site, which keeps information for the duration of the visit and sometimes for a later connection. A cookie cannot be read by any website other than the one that created it. Technical cookies allow us to authenticate and identify you and speed up your browsing. No cookie contains information allowing the user to be contacted by phone, email, or mail.

Types of cookies used

• Functional cookies: strictly necessary to allow your navigation; their use does not require prior consent. You can object to them by changing your browser settings, but some features may then become unavailable.
• Audience measurement cookie (Matomo): allows us to measure the audience of our site (number of visits, page views, visitor activity and frequency of return) in an anonymized and statistical way. Matomo is configured so that collecting your consent via a banner is not required; you are informed through this section.

Duration of storage of cookies

Cookies stored on your device, or any other items used to identify you for audience measurement, have a lifetime of up to 13 months and will not be automatically extended on your next visits.

Your rights

The cookies we use are exempted from user consent. If you don't want any cookies on your computer, you can block them through your browser settings and/or delete cookies that have already been placed. Note that blocking cookies may make some features unavailable.