Privacy Policy

Last updated: February 11, 2026

This Privacy Policy explains the conditions under which personal data are collected, processed, and protected in connection with the use of the Bernstein.io platform (the "Platform").

The Platform is operated by IP LEVERAGED SAS, a simplified joint-stock company incorporated under French law, with registered office in Strasbourg, France (hereinafter "Bernstein" or the "Data Controller").

This Policy is governed by French law and Regulation (EU) 2016/679 (GDPR). In the event of any discrepancy, the French version shall prevail.

General Principles

Bernstein processes personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

Appropriate technical and organisational measures are implemented to ensure a level of security appropriate to the risks.

Categories of Data Collected

The following categories of personal data may be collected:

Identification data: name, surname, email address, organisational information.

Account and contractual data: login credentials, certification history, certification units ("credits").

Billing data: payment-related information and transaction history.

Technical data: IP address, connection logs, browser and device data.

Support data: content of communications addressed to customer support.

Due to the encryption architecture implemented, Bernstein does not access uploaded content in unencrypted form and does not have knowledge of data contained in protected files.

Purposes and Legal Bases

Personal data are processed for the purposes of:

• account management;
• certification management;
• performance of contractual obligations;
• billing and payment processing;
• fraud prevention;
• platform security;
• compliance with legal obligations;
• customer support.

Processing is based on contract performance, legal obligations, legitimate interest, or consent where required.

Recipients

Personal data may be shared with:

• technical service providers involved in hosting, infrastructure, payment processing, or maintenance;
• White-Label partners where the Platform is used through a co-branded instance, to the extent necessary;
• public authorities where legally required.

Service providers act as processors within the meaning of the GDPR.

Subprocessors

To operate the Platform, Bernstein relies on a limited number of third-party providers ("subprocessors") that process personal data on its behalf, under data-processing agreements and, where relevant, the safeguards described under "International Transfers". The principal subprocessors are set out below.

Certification is anchored using third-party blockchain and timestamping infrastructure, including Bitcoin network services and an RFC 3161 timestamping authority. These providers receive only the cryptographic fingerprint of the content, never personal data or the content itself.

This list may change as the Platform evolves; the version published on the Platform is the one in force.

White-Label Services

When the Platform is accessed through a White-Label instance, certain identification and account data may be accessible to the relevant partner for contractual management purposes.

The technical infrastructure remains operated and hosted by Bernstein.

The allocation of data protection responsibilities may be governed by a specific agreement between Bernstein and the White-Label partner.

International Transfers

Some of the subprocessors listed above are established outside the European Economic Area, in particular in the United States. Where personal data are transferred outside the European Union, appropriate safeguards are implemented, including an adequacy decision of the European Commission or the standard contractual clauses it has adopted, together with additional technical and organisational measures where required.

Retention Period

Personal data are retained only for as long as necessary for the purposes described and in accordance with applicable legal obligations.

Account and contractual data are kept for the duration of the contractual relationship and then archived to meet legal obligations; billing data are kept in accordance with applicable accounting and tax requirements.

Certified content is retained in encrypted form for as long as the account exists, because the stored copy is what allows a certificate to be verified later. Connection data are retained for the period stated in the "Connection Data" section.

Data Subject Rights

Individuals have the right to access, rectify, erase, restrict processing, obtain data portability, object to processing, and withdraw consent where applicable.

Requests may be addressed to: [email protected]

Complaints may be lodged with the CNIL or the competent supervisory authority.

Data Protection Contact

Any question or request concerning the processing of personal data may be addressed to Bernstein's data protection contact:

• by email: [email protected];
• by post: IP LEVERAGED SAS - Data Protection - 10 rue Beethoven, 67380 Lingolsheim, France.

Requests are answered within one month of receipt. That period may be extended by two further months where a request is complex or where several requests have been made, in which case the person is informed of the extension and its reasons.

Security

Bernstein implements appropriate technical and organisational measures to protect personal data.

However, no system can guarantee absolute security.

Connection Data

Bernstein records technical metadata relating to the use of the Platform, including the IP address, the browser user-agent, and a functional identifier held in a cookie.

These data are processed for platform security, fraud prevention, analytics and customer support, and may be used to associate activity with the corresponding user account.

They are retained for 90 days and are then anonymised: IP addresses are irreversibly truncated and the user-agent is deleted.

AI Assistant

Bernstein provides an AI assistant. Conversations with it, including the messages you send, are logged and stored on Bernstein's servers as support data.

They may be reviewed by the Bernstein team and used to improve the assistant and the service. An anonymous conversation is keyed to the cookie identifier described above; if you sign in or provide an email address from the same browser, it is associated with your account, including messages sent beforehand.

Unlike certified content, an assistant conversation is not encrypted and is readable by Bernstein, so please do not submit confidential information through the chat. Conversations are handled in accordance with this Policy, and the data-subject rights described below apply to them.

Automated Decision-Making

Bernstein does not take decisions producing legal effects, or similarly significant effects, on the basis of solely automated processing. The AI assistant is an informational tool: it does not decide on account access, pricing, or the outcome of any request, and anything requiring a decision is handled by a person.

Cookies

The Platform uses strictly necessary cookies for its operation, including the functional identifier described above.

Subject to your prior consent, the Platform also uses Google Analytics to measure audience and improve the service. These non-essential cookies can be accepted or refused at any time through the cookie banner.

Modification of this Policy

This Policy may be amended at any time.

The applicable version is the one published on the Platform at the time of access.