Privacy notice.

1. Who we are

C’noté is a school-parent communication service operated from Switzerland. For the purposes of GDPR, C’noté acts as a data processor on behalf of schools (the data controllers). Schools determine the purposes and means of processing personal data; C’noté processes data only on the school's documented instructions.

Contact: get@cestnote.ch

2. Roles and responsibilities

Your school is the data controller. The school decides which data is shared with C’noté, which parents are enrolled, and when the service is terminated.

C’noté is the data processor. We process email metadata and parent contact data only on the school's behalf, only for the purpose of delivering school-parent communication via WhatsApp.

This relationship is formalised in a Data Processing Agreement (DPA) signed between C’noté and each school before any data processing begins. The DPA complies with GDPR (EU 2016/679) and Swiss nDSG (FADP 2023).

3. What data we collect

Data provided by the school

• Parent names and WhatsApp numbers — used to deliver school communications via WhatsApp
• Child first names and year group — used to personalise communications per child
• Parent emails forwarded by the school — the school forwards its parent communications to a private yourschool@cestnote.ch address. No account to set up, no sign-in, and no third-party inbox access is involved; the school can stop forwarding at any time

Data we generate through processing

• Email metadata and summaries — subject, sender, received date, AI-generated summary of content. We process email summaries to the extent needed to generate useful notifications.
• WhatsApp message records — inbound and outbound messages between C’noté and parents (for digest delivery and conversation history)
• Digest and notification delivery records — timestamps of messages sent, for idempotency and audit

Data we collect from this website

• Demo request submissions — name, email, role, school name, and message when you complete the contact form. Used only to respond to your inquiry. Retained for 3 years.
• Server logs — IP addresses and user-agent strings in standard server access logs. Retained for 90 days.

4. What we do not collect — and never train on

• Full email body content (we process summaries only)
• Third-party tracking pixels and advertising identifiers
• Payment card data (billing handled by a third-party provider)
• Data not explicitly needed to deliver the service

We do not use personal data processed through C’noté to train AI models. Parent-facing AI inference runs at Mistral La Plateforme (Paris, France) — a European inference provider. School email content is sent only at the moment of inference and is never used to train AI models. This is contractually guaranteed with our AI vendor and audited annually.

4a. Cookies, tracking, and analytics

We use the minimum tracking needed to operate this site, organised into three categories. You control what runs via the consent banner you saw on first visit. You can change your choice at any time using the Cookie preferences link in the footer.

Essential (always on)

A small localStorage entry called cnote_consent_v1 remembers your cookie choice for 12 months. Without it, the banner would reappear on every page. We also keep standard server access logs (IP + user-agent) for 90 days for security.

Analytics (opt-in)

If you allow analytics, we load GoatCounter — a cookieless, EU-hosted (Ireland) analytics tool. GoatCounter does not set cookies, does not store IP addresses, and does not collect personal data. It counts visits and shows us which pages people read.

Marketing (opt-in)

Reserved for future advertising measurement (for example, ad-platform pixels). Nothing in this category loads today. When we start using ad pixels, they will only run for visitors who have explicitly accepted this category.

Changing your choice

Click Cookie preferences in the footer to re-open the consent panel. You can also clear your browser's site data to fully reset the choice.

5. Legal basis for processing

For school data (parents, children, emails): Processing is carried out on the basis of the school's legitimate interest in communicating with families, and under the DPA where C’noté acts as processor.

For website contact form submissions: Consent (you choose to submit the form).

6. Where we store data — and where AI inference runs

All personal data is stored on servers located in France (EU), operated by OVH Cloud (a European cloud-services provider). Parent-facing AI inference runs at Mistral La Plateforme (Paris, France) — a European inference provider. Operational metadata (telemetry, support, abuse monitoring) may transit non-EU under Standard Contractual Clauses (SCCs); the full caveat is disclosed in the data-processing agreement we sign with each school.

7. How long we keep data

• Parent contact data — retained for the duration of the school contract plus 90 days for backup, then deleted.
• Email data — retained for 3 years from receipt, then deleted.
• WhatsApp message records — retained for 3 years, then deleted.
• Website contact form data — retained for 3 years, then deleted.
• Server logs — retained for 90 days.

8. Your rights

Under GDPR and Swiss nDSG, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data (the "right to be forgotten")
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Restriction — request that processing be restricted while a dispute is resolved

For data held on behalf of a school, please contact your school directly — they are the data controller. For data held directly by C’noté (website contact data), email get@cestnote.ch. We respond within 30 days.

9. Data Processing Agreement

Schools are provided with a GDPR Article 28 / Swiss nDSG Article 9 DPA before any data processing begins. The DPA is available on request — write to get@cestnote.ch.

10. Contact

For privacy-related questions, data access requests, or to request the DPA:

C’noté
Switzerland
Data Protection contact: privacy@cestnote.ch

You have the right to lodge a complaint with your national data protection authority. In Switzerland: FDPIC (Federal Data Protection and Information Commissioner).