Privacy Policy

1. Data controller

The controller for personal data collected through the Platon Lab platform (platon-lab.com) is Altitude Investment Services, Geneva, Switzerland. Contact: contact@platon-lab.com.

Processing is governed by the Swiss Federal Act on Data Protection (FADP) and, where applicable, by the European Union's General Data Protection Regulation (GDPR).

2. Data we collect

Account data (only if you create an account):

• email address;
• password — stored exclusively in hashed form, never in plain text;
• accepted version of the terms of service and account creation date.

Learning data (linked to your account):

• progress through modules and sections;
• quiz results and attempts.

Technical data:

• standard server logs (IP address, timestamp, requested pages), kept for security and diagnostic purposes;
• audience measurement data — anonymous and cookieless by default, complete only with your consent (see section 4).

3. Purposes

Data is processed in order to:

• provide the service: authentication, progress saving and quiz validation;
• ensure the security and proper operation of the platform;
• measure and improve how the course is used (anonymous cookieless measurement, or complete measurement with your consent);
• contact you about your account (email verification, password reset).

No data is sold. No advertising is displayed on the platform and no advertising profiling is carried out.

4. Audience measurement — Google Analytics 4

We use Google Analytics 4 (GA4), a service provided by Google LLC (United States) and Google Ireland Ltd, to understand how the course is used (pages viewed, journeys, session duration) and to improve it. GA4 runs in consent mode (“Google Consent Mode”):

• by default, measurement is anonymous and cookieless: no persistent identifier is set, and there is no tracking across your visits or devices. This purely statistical, aggregated measurement does not require your consent;
• with your consent, measurement becomes complete: cookies (see section 5) are set and, if you are signed in, your journey may be linked to your account;
• IP addresses are anonymised; they are never used for advertising;
• data is used exclusively for statistical purposes, with no advertising or resale; no advertising signals are enabled;
• data may be transferred to the United States; Google is certified under the Swiss–U.S. Data Privacy Framework;
• for more details: Google's privacy policy.

You can change your choice at any time:

Declining has no impact on your access to the course: all features remain available.

5. Cookies and local storage

The platform uses:

• Session cookie (httpOnly) — strictly necessary for authentication; does not require consent;
• Browser local storage — remembers your consent choice and preferences (including language); never leaves your device;
• Google Analytics cookies (_ga, _ga_*) — set only if you have accepted audience measurement; maximum lifetime of 13 months.

6. Retention periods

• Account and learning data — kept as long as the account is active; deleted upon account deletion request;
• Server logs — kept for a maximum of 12 months;
• GA4 data — retention configured to 14 months at Google.

7. Recipients and processors

Data is hosted in Switzerland. It is not shared with any third party, except for:

• Google (GA4 audience measurement) — anonymous cookieless measurement by default, complete measurement only if you have consented;
• our technical providers (hosting, transactional email delivery), who act on instruction and are bound by confidentiality obligations.

8. Your rights

Under the FADP (and the GDPR where applicable), you have the following rights:

• right of access to data concerning you;
• right to rectification of inaccurate data;
• right to erasure (deletion of the account and associated data);
• right to object to processing or request its restriction;
• right to receive your data in a commonly used format (portability).

To exercise these rights, write to contact@platon-lab.com. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).

9. Security

Exchanges with the platform are encrypted (TLS). Passwords are hashed with a modern algorithm and never stored in plain text. Access to data is restricted to the people who need it to operate the service.

10. Changes

This policy may be updated, in particular if the service or the regulations evolve. The version in force, identified by its date, is published on this page.