Privacy Policy

Last updated: February 24, 2026

1Data controller and contact information

2What personal data we collect

2.1 Data you provide directly

When you create an account or profile, we collect:

• Identity information: Name, first name, gender, date of birth
• Contact information: Email address
• Login credentials: Username, password
• Profile preferences: Language, favorite games, difficulty settings

2.2 Data collected automatically during use

When you use our applications, we automatically collect:

• Game activity data: Game results, scores, completion times, selected difficulty levels
• Usage statistics: Number of games played, favorite games, total and average playtime, progress over time
• Mood tracking data: Self-reported mood indicators (if you use this feature)
• Connection data: Connection timestamps, session duration, device type

2.3 Data generated by our system

Based on your activity, our system calculates:

• Success rate and performance evolution
• Recommended exercises and difficulty adjustments
• Statistical analyses for progress tracking

3Legal basis and purposes of data processing

We process your personal data based on the following legal grounds:

3.1 Performance of the contract (Art. 6.1.b GDPR)

• Account creation and management
• Providing access to cognitive stimulation programs
• Performance tracking and statistics
• Customer support

3.2 Consent (Art. 6.1.a GDPR)

• Receiving newsletters and promotional communications
• Participation in beta testing programs (Coach Assist IA)
• Anonymously using data to improve game quality
• Optional mood tracking features

3.3 Legitimate interest (Art. 6.1.f GDPR)

• Application security and fraud prevention
• Technical improvements and bug fixes
• Aggregated statistical analysis (anonymized)

4Who has access to your data

4.1 Recipients

Your personal data may be accessible by:

DYNSEO Employees:

Only authorized personnel with a legitimate need to access your data for customer support, technical maintenance, or service provision.

Service providers (subcontractors):

• OVH (host): Hosts our servers and databases in France
• Third-party services: Payment processors, email service providers, analytics tools (if applicable)

4.2 Institutions and organizations

For institutional accounts (healthcare facilities, schools, therapy centers):

The institution acts as the data controller for its end users' data, while DYNSEO acts as a subprocessor. The institution is responsible for:

• Obtaining informed consent from end users
• Informing users about data processing
• Ensuring GDPR compliance within their organization

4.3 Research purposes

With explicit consent, anonymized and aggregated statistics may be used for:

• Clinical research studies
• Academic publications
• Improving product quality

4.4 No commercial data sharing

5Data retention period

We retain your personal data for the following periods:

Type of data	Retention period
Account information	Until account deletion request
Game results and statistics	Until account deletion request
Mood tracking data	Until account deletion request
Calculated performance data	Until account deletion request
Newsletter subscription	Until unsubscription request
Beta test logs (Coach Assist AI)	Maximum 6 months after the end of the beta
Coach Assist AI conversations	Deleted immediately upon app closure

6Your rights under the GDPR

You have the following rights regarding your personal data:

6.1 Right of access (Art. 15 GDPR)

Request a copy of all personal data we hold about you.

6.2 Right to rectification (Art. 16 GDPR)

Correct inaccurate or incomplete personal data.

6.3 Right to erasure / "Right to be forgotten" (Art. 17 GDPR)

Request the deletion of your personal data under certain conditions.

6.4 Right to restriction of processing (Art. 18 GDPR)

Request the limitation of how we use your data.

6.5 Right to data portability (Art. 20 GDPR)

Receive your data in a structured, machine-readable format or request transfer to another data controller.

6.6 Right to object (Art. 21 GDPR)

Object to processing based on legitimate interest or for direct marketing purposes.

6.7 Right to withdraw consent

For processing based on consent (newsletters, beta testing, research), you can withdraw your consent at any time.

6.8 Right to lodge a complaint

If you believe your data protection rights have been violated, you can lodge a complaint with:

7Data security measures

We implement technical and organizational measures to protect your personal data:

7.1 Technical measures

• SSL/TLS encryption for all data transmissions
• Encrypted storage of passwords and sensitive data
• Regular security backups with encrypted storage
• Access logs and monitoring to detect unauthorized access
• Firewall protection and intrusion detection systems

7.2 Organizational measures

• Access control: Only authorized personnel can access personal data
• Confidentiality agreements: All employees sign confidentiality commitments
• Data protection training: Regular training for staff handling personal data
• Incident response plan: Data breach notification procedures

7.3 Security of Coach Assist AI

7.4 Limitations

8Data transfers outside the EU

For all other DYNSEO services: Our data remains on French servers (OVH) within the European Union. No routine data transfer outside the EU occurs.

If we need to transfer data outside the EU in the future, we:

• Will inform you in advance
• Will obtain your consent if required
• Will implement appropriate safeguards (Standard Contractual Clauses, adequacy decisions, etc.)

9Cookies and tracking technologies

Our websites (www.dynseo.com and www.stimart.com) may use cookies and similar technologies.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.

10Children's privacy protection

🐣 COCO THINKS and COCO MOVES (ages 5-10)

We are committed to protecting children's privacy and comply with:

• GDPR requirements for children's data
• Google Play Family Policy
• Apple App Store guidelines for children's apps

For school or institutional use, the institution must:

• Obtain parental consent if required by law
• Act as the data controller responsible for compliance
• Inform parents about data processing activities

11Changes to this privacy policy

We may periodically update this Privacy Policy to reflect:

• Changes in our data processing practices
• New features or services (such as moving Coach Assist AI from beta to production)
• Legal or regulatory requirements

We encourage you to regularly review this policy.

12Specific provisions for institutional users

When institutions (healthcare facilities, schools, therapy centers) subscribe to DYNSEO services:

12.1 Data controller relationship

• The institution is the data controller for end-user data
• DYNSEO is the processor providing platform services
• A Data Processing Agreement (DPA) governs our relationship

12.2 Responsibilities of the institution

The institution must:

• Obtain valid informed consent from end users (or legal representatives)
• Provide transparent information on data processing
• Ensure GDPR compliance for its users
• Respond to requests to exercise user rights
• Maintain records of processing activities

12.3 DYNSEO's obligations as a processor

We are committed to:

• Processing data only on documented instructions from the institution
• Maintaining confidentiality and security of data
• Assisting with requests to exercise rights and DPIAs
• Notifying the institution of data breaches within 24 hours
• Returning or deleting data at the end of the contract
• Allowing audits and inspections by the institution

13Contact us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

14Applicable law and jurisdiction

This Privacy Policy is governed by French law and the General Data Protection Regulation (GDPR).

Any dispute arising from this policy will be subject to the jurisdiction of the French courts.