Privacy Policy

Foxar designs educational applications to explore and understand differently: 3D visualization, augmented reality, guides, and interactive content. To operate these services, we process some of your data. This page explains which data, why, and the choices available to you.

It applies in accordance with the General Data Protection Regulation (GDPR), the French Data Protection Act, and the data protection laws applicable in your country of residence (for example the UK GDPR in the United Kingdom, U.S. state laws, the LGPD in Brazil, PIPEDA and Law 25 in Canada). Where several laws apply to your situation, we apply the most protective standard.

This policy covers: the Foxar application for iPhone, iPad, and Apple Vision Pro (iOS, iPadOS, visionOS), as well as the Foxar website and web application.

Who is responsible for your data?

The data controller is:

Foxar SAS, a simplified joint-stock company with share capital of €50,000
Registered with the Dijon Trade and Companies Register under number 885 007 674
Registered office: 30 rue de Metz, 21000 Dijon, France
Contact (and exercising your rights): contact@foxar.org

Depending on the country, local representatives and a data protection officer may be appointed (see the section “Your rights depending on your country”).

What data do we collect, and why?

We only collect data that is useful for the service. The legal basis for each processing activity is indicated by a footnote.

Your Foxar account

To create and manage your account: your email address, your username, your login credentials (passwords stored in encrypted/hashed form, or “passkey” access keys), as well as technical login information (date of last login, email address change history).¹

Technical and browsing data

To ensure the proper functioning, security, and improvement of our services: the model of your device, its processor, its memory and its graphics memory, the operating system version, the application version, the browser (on the web), the IP address and an approximate location (on the web).²

Usage statistics

To understand how our content is used and improve it, we measure usage at two levels :

Anonymous audience measurement. Aggregated statistics, without a persistent identifier or individual tracking; necessary for managing the service.²
Detailed statistics linked to your account. For example: opening the application, starting and progressing through a guide, quiz answers, searches carried out. Collected only with your consent, which you may withdraw at any time in Settings → Privacy.³

Your content and your progress

To provide you with the features: your favorites and lists, your quiz results, your progress and gamification elements (experience points, trophies). On iPhone and iPad, your favorites can be synchronized via iCloud in addition to your Foxar account.¹

Foxar+ subscriptions

If you take out a subscription: on the application, the purchase is managed by Apple (App Store) ; on the web, by Stripe. Foxar does not store any banking data. We only receive a subscription identifier and a status (active / inactive) necessary to unlock your benefits.¹⁴

Communications and newsletter

For emails related to your account (confirmation, security, account management¹) and, if you consent, our newsletter³ : your email address, your language and your preferences for communication.

Your consents and preferences

To respect and demonstrate your choices, we keep a history of your consents and privacy preferences (accepted version, date, platform, and associated technical data such as the IP address).²⁴

Camera and augmented reality

The native application (iPhone, iPad, Apple Vision Pro only) may use your device’s camera to display 3D models in augmented reality. The camera feed is processed locally, on your device, and is never transmitted to or stored by Foxar. This access is only requested when using an AR feature; you may refuse or revoke it in your device settings. This feature does not exist on the web.³

Notifications

If you enable them, we may send you notifications (reminders, new features). You can disable them at any time in your device settings.³

With whom do we share your data?

We never sell your data and do not “share” it for behavioral advertising purposes; we do not engage in any targeted advertising. Your data is only shared with technical service providers (“processors”), strictly for operating the service and contractually governed:

Scaleway : hosting and storage of our servers and your data (data centers in Paris, France).
GAR (Gestionnaire d'Accès aux Ressources) : authentication by the French Ministry of Education for school use (see the dedicated section below).
Apple : App Store and subscription management; iCloud synchronization of your favorites (if enabled).
Stripe : payment processing on the web.
Amazon SES : delivery of our emails (service emails and, where applicable, newsletter).

We may also disclose data if required by law (request from a competent authority).

International data transfers

Your data is primarily hosted in the European Union (France). However, some service providers (for example Apple, Stripe, or Amazon) may process data outside your country, in particular in the United States. Where applicable, these transfers are governed by appropriate safeguards (in particular the European Commission’s standard contractual clauses, and equivalent mechanisms for other jurisdictions).

How long do we keep your data?

Active account: for as long as your account exists.
Prolonged inactivity: an account inactive for 3 years is deleted, after a warning sent 30 days in advance (CNIL recommendation no. 2016-264).
Unconfirmed registrations: deleted after 30 days.
School accounts (GAR): kept for the duration of the school year, then purged.
Billing data: kept for 10 years from the close of the relevant financial year (legal obligation, Article L123-22 of the French Commercial Code).
Data concerning children: kept only for the time strictly necessary for the purpose, then deleted.
Proof of consent: kept for the time necessary to comply with our obligations.

How do we protect your data?

We protect your data against destruction, loss, alteration, disclosure, or unauthorized access, in particular through:

the encryption of sensitive data (in transit and at rest) and the hashing of passwords;
secure servers and firewalls ;
the logging of access and a principle of restricted access to authorized persons only;
an information security program and hosting in the European Union.

Children, students, and the school context

Foxar is an educational service, which may be used by minors. We apply enhanced protections in this regard.

School context - connection via GAR (France)

When Foxar is used in a school context in France, connection is made via the GAR (Gestionnaire d'Accès aux Ressources) of the Ministry of Education. This context is designed to protect students’ identity.

Students: pseudonymous accounts. Foxar does not receive the student’s last name, first name, or real email address. We only receive an opaque identifier (IDO key provided by GAR), the school code, the level / class and a username.
Teachers. Identity (display name and professional email address) is provided by GAR and reserved for educational uses.
Segregation. Data from school accounts is strictly separated from consumer accounts, and linked to the school year (then purged).

Outside the school context

An account concerning a minor must be created and used under the responsibility of a parent or legal guardian. The minimum age required depends on your country (for example 15 in France, 13 in several countries). We do not knowingly collect excessive data concerning minors.

United States - COPPA (children under 13)

For children under 13 residing in the United States, we collect verifiable parental consent (or authorization from the school in an educational context) before any collection, in accordance with the Children's Online Privacy Protection Act (COPPA). The parent may review, correct, or delete their child’s data and withdraw their consent at any time by writing to us at contact@foxar.org.

Schools (United States)

When we contract with U.S. schools or districts, we act under FERPA and state student data laws : student data is used only for educational purposes, never sold, and deleted at the institution’s request.

No profiling of minors

We do not apply any advertising or commercial profiling to minors, and we adapt design and transparency to their age, in the spirit of age-appropriate design codes (e.g. UK Children's Code, California Age-Appropriate Design Code).

Your rights

In accordance with the GDPR and applicable laws, you have the following rights regarding your personal data:

Right of access : to know what data we process and why.
Right to rectification : to correct inaccurate data.
Right to erasure (“right to be forgotten”) : to have your data permanently deleted.
Right to restriction of processing.
Right to portability : to retrieve your data in a reusable format.
Right to object to processing.
Right to withdraw your consent at any time, without affecting processing already carried out.

To exercise them: write to us at contact@foxar.org (we may verify your identity). You may also, directly from the application, export your data or request deletion of your account. We exercise no discrimination against persons who assert their rights.

You also have the right to lodge a complaint with a supervisory authority : in France, the CNIL (www.cnil.fr) ; in other countries, the competent authority in your place of residence.

Your rights depending on your country

Beyond the GDPR baseline above, some national laws provide for specific rights or disclosures.

Residents of the United States

Several states (California [CCPA/CPRA], Virginia, Colorado, Connecticut, Texas, and others) grant comparable rights: to know / access, delete, correct, retrieve your data, and object to sale, “sharing” for behavioral advertising purposes, targeted advertising, and certain profiling, as well as limit the use of sensitive data.

Foxar does not sell or “share” your data and does not engage in targeted advertising. No “ Do Not Sell or Share My Personal Information ” mechanism is therefore necessary. You may nevertheless exercise the rights above at contact@foxar.org. If we refuse a request, you may request a review at the same address. (California residents: you may also exercise your rights under the “Shine the Light” law; we do not offer any financial incentive in exchange for data.)

United Kingdom and Switzerland

In the United Kingdom, processing is governed by the UK GDPR and the Data Protection Act 2018 ; the competent authority is the ICO. In Switzerland, it is governed by the nLPD.

Other countries

Depending on your country of residence, other laws may apply and grant you additional rights. For example the LGPD (Brazil), PIPEDA and Law 25 (Canada/Quebec), the DPDP Act (India, which notably requires parental consent and prohibits tracking and targeted advertising aimed at children), the PIPA (South Korea), the APPI (Japan), the POPIA (South Africa), or the PDPL (Saudi Arabia).

In all cases: depending on your country, you may have additional rights. To exercise them, or to learn the local representative and competent authority relevant to you, write to us at contact@foxar.org.

Mobile applications

The information we collect via app stores (Apple’s App Store, and where applicable Google Play) is described in each store’s privacy labels, consistent with this policy. On iOS, no cross-app tracking functionality (App Tracking Transparency) is used for advertising purposes.

Changes to this policy

We may update this policy to reflect changes to our services or to regulations. In the event of a significant change, we will inform you by appropriate means. The last updated date appears at the top of this page.

Contact us

A question about your data or this policy?

Foxar SAS - 30 rue de Metz, 21000 Dijon, France - contact@foxar.org

Processing based on the performance of the contract (and, where applicable, pre-contractual measures).
Processing based on our legitimate interest (operation, security, fraud prevention, anonymous audience measurement).
Processing based on your consent, which you may withdraw at any time.
Processing based on a legal obligation (in particular accounting and tax obligations).