Privacy Policy

Last updated: 28 June 2026

FrenchWithAmine (“we”, “us”) is operated by Amine Hennous, a sole proprietor based in Malta. We take your privacy and your children's privacy seriously. This policy explains what data we collect, why, and what your rights are under the EU General Data Protection Regulation (GDPR).

Who is responsible

The data controller is Amine Hennous, sole proprietor based in Malta. For any privacy-related question or to exercise your rights, write to hello@frenchwithamine.com.

What we collect, and why

From parents (account holders)

Name and email — to identify you and send service-related emails (confirmations, reminders, password resets). Basis: contract.
Hashed password — to authenticate you. We never see your plaintext password. Basis: contract.
Phone (optional) — only if you provide it during a trial or booking request. Basis: consent.
Billing email — passed to Stripe for invoicing. We do NOT see or store your card details. Basis: contract.

About children

First name and age — to personalise the dashboard and lesson tracking.
French level + optional notes — only if you provide them on the trial/booking form.
Lesson progress — which of the 40 lessons your child has completed.

We do not collect a child's last name, photo, address, school, medical info, or any special-category data. A parent or legal guardian must create the account; we do not allow children to register independently.

Automatic (technical) data

Session cookie (essential) — keeps you logged in.
CSRF token cookie (essential) — prevents cross-site request forgery during sign-in.
Server logs — IP, timestamp, route, error. Kept 30 days for security and debugging.

We do not use third-party analytics, advertising, or tracking cookies.

Who we share data with

Stripe Payments Europe Ltd. (Ireland) — handles all payments. You enter your card on Stripe's page, not ours. See Stripe's Privacy Policy.
OVH (France/EU) — hosts our servers and database. Data stays in the EU.
8x8 / JaaS (Jitsi) — provides the video-call infrastructure. Calls are not recorded by us. See 8x8's Privacy Policy.
SMTP mail provider (cPanel-hosted, EU) — sends transactional emails. No marketing third party has access to your email.

We never sell or rent your data. We don't share it for advertising.

How long we keep data

Active account data — for as long as you have an account.
After cancellation — account + lesson-progress data kept for 12 months in case you return, then deleted.
Billing records — kept for 7 years as required by Maltese tax law.
Server logs — 30 days.

Your rights

Under GDPR you can at any time:

Access a copy of the data we hold about you.
Correct inaccurate data.
Delete your account and personal data (the “right to be forgotten”).
Export your data in a portable format.
Object to processing for legitimate-interest purposes.
Lodge a complaint with the Information and Data Protection Commissioner (IDPC) of Malta (idpc.org.mt).

To act on any of these rights, email hello@frenchwithamine.com. We aim to reply within 30 days.

Security

Passwords are hashed with bcrypt. All traffic is encrypted (HTTPS / TLS 1.2+). Payment data is handled by Stripe, who is PCI-DSS Level 1 certified. We don't store card numbers or CVCs on our servers.

Changes to this policy

We may update this policy when we add new features. The “last updated” date at the top of this page will change, and material changes will be announced by email.

Contact

Questions, requests, or complaints: hello@frenchwithamine.com.