Privacy policy

Nocodable (see the legal notice) is the controller for the website, for customer accounts, billing and the contact form.

For the training data of the people an organization invites (progress, answers, scores), that organization is the controller and Nocodable acts as its processor, under a data processing agreement (DPA, GDPR article 28). If you take courses through your employer, you can also contact them directly.

• Account: first and last name, work email, password (stored hashed), language, role.
• Organization: name, email domains, size, sector, settings.
• Training: courses started and completed, answers to questions, scores, dates, channel (web or Slack).
• Slack, if your organization connects it: Slack user and workspace identifiers.
• Billing: plan, number of seats and invoices. Card details are handled by Stripe and never reach our servers.
• Contact form: name, email, company, team size and your message.
• Technical: IP address, browser and error logs, for security and troubleshooting.

• Providing the service, sending courses and reminders, producing progress and compliance reports: performance of the contract.
• Billing and accounting: legal obligation.
• Security, fraud prevention and service quality: legitimate interest.
• Answering contact requests and demo bookings: legitimate interest, or steps prior to a contract.
• Improving courses with aggregated, anonymized statistics: legitimate interest.

We do not use your data to train AI models, and no decision with legal effect is made automatically. Course content is written and checked by people.

• Account and training data: as long as the organization's subscription lasts. When a person is deleted, their personal data is erased and their course events are anonymized.
• Deleted organizations: purged 30 days after deletion.
• Invoices and accounting records: 10 years (French Commercial Code).
• Contact requests: 3 years after the last exchange.
• Technical logs: up to 12 months.

Within your organization, admins see the progress of the people they invited. On our side, only the team members who need it for support or security. We rely on a few providers to run the service, listed on the subprocessors page.

The application and the database are hosted in the European Union (Paris (AWS eu-west-3)). When a provider may access data from outside the EU, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. You can also leave instructions for what happens to your data after your death. Write to privacy@tokkohq.com: we answer within one month.

If you think your rights are not respected, you can complain to the CNIL.

We only use the cookies the service needs to work, so no consent banner is shown:

The course player also keeps your place in a course in your browser's local storage, so you can resume where you stopped. We use no advertising or tracking cookies. If we add audience measurement one day, we will ask for your consent first.

Data is encrypted in transit (TLS) and at rest. Access is restricted and logged, and Slack tokens are encrypted by the application.

We will update this page if our practices change, and tell customers by email before any significant change.