Terms of use

Article 1 — Purpose

BySince is an online skills mapping platform published by [to be completed] (hereinafter “Since & Co” or “the publisher”). It enables an organisation to describe its activities and know-how, to build learning paths, to track the progress of its learners, to keep a skills booklet and to issue digital badges.

These terms of use (the “Terms”) lay down the rules for accessing and using the BySince platform and the “Cartographe” mobile application. They apply to every person who has an account.

The commercial terms (price, duration, service levels) are governed by the contract entered into between Since & Co and the client organisation. In the event of a contradiction, that contract prevails over the Terms as regards relations between Since & Co and that organisation.

Article 2 — Definitions

• Platform: the BySince service accessible through a browser, its administration interfaces and the Cartographe mobile application.
• Publisher: [to be completed], identified in the legal notice.
• Client organisation: the legal entity (company, institution, association, public authority, etc.) that has subscribed to the platform for its own needs, including its subsidiaries or attached entities where it has created any.
• User: any natural person who holds an account, whatever their role. In the Terms, “you” means the user.
• Administrator: the user designated by the client organisation to manage its space: accounts, rights, content, settings, AI API keys.
• Cartographer: the user who describes the organisation's activities; by extension, the mobile application of the same name (“Cartographe”), which is used to gather that information in the field.
• Tutor: the user who supports one or more learners, tracks their progress, validates their learning outcomes and may issue badges.
• Learner: the user enrolled in a learning path or whose skills are tracked on the platform.
• Skills Information System (SIC): the structured set of themes, activity sheets, sub-activities, operating modes and contexts that describe the work of an organisation.
• Content: any information uploaded, entered, imported or produced on the platform by a client organisation or a user: texts, sheets, learning paths, assessments, reviews, documents, images, sound recordings, photographs, videos, badges.
• Artificial intelligence (AI): any feature that automatically produces a result (text, transcription, image, ranking, proposal) using a machine learning model, whether it is run on the platform's servers or by a third-party provider.
• AI provider: the third party that runs an AI model on its own servers (see Article 13).
• API key: the secret issued by an AI provider to its customer, which makes it possible to use its service and to be invoiced for it.
• Generated content: any result produced or modified by an AI feature.

Article 3 — Acceptance and enforceability

Use of the platform requires acceptance of the Terms.

1. At your first login, and then with each new version of the Terms, the platform presents you with an acceptance screen. It shows the document to be accepted, its version and its effective date, with a link to the full text; earlier versions, where there are any, can be consulted from that text. You accept by ticking a box and then confirming. Until you have accepted, you cannot access the web application. Logging out, the legal pages and the account security steps remain accessible. The Cartographe mobile application does not display this screen, but it does not work until you have accepted the version in force on the website (see Article 9).
2. Your acceptance is recorded: your account, the document accepted, its version, the date and time, and the language in which the text was presented to you. This evidence (document, version, date and language) is kept for the lifetime of your account, then for 5 years after its deletion, in pseudonymised form: a keyed hash of your login identifier, with no name or email address. The administrator of your organisation can view and export the acceptance status of the users of their organisation.
3. An administrator who temporarily logs in in place of a user for support purposes cannot accept the Terms on that user's behalf.
4. The Terms are available in several languages. Only the French version is authoritative. The other versions are courtesy translations.
5. Acceptance of the Terms is separate from consent to the use of AI, described in Article 16.

The legal notice, the privacy policy, the cookies page and the data processing agreement can be consulted freely. Only the Terms are subject to a recorded acceptance.

Article 4 — Changes to the Terms

Since & Co may change the Terms, in particular to take account of a new feature, a new provider or a change in the law.

1. Each version bears a number and an effective date.
2. Earlier versions remain available for consultation online.
3. The initial version of the Terms is presented to you as soon as acceptance is brought into service on the platform, even if its effective date is later. Any subsequent version is presented to you from its effective date, on the first page you open thereafter. In both cases, it must be accepted in order to continue using the platform.
4. If you refuse a new version, you can no longer use the platform. In that case, contact the administrator of your organisation.

Article 5 — Accounts

5.1. Creation

The platform does not offer open registration. Your account is created by your organisation (its administrator) or, at its request, by Since & Co. The organisation decides who has access to its space and with which rights.

5.2. Roles and rights

Your rights depend on the role or roles assigned to you by your organisation: user or learner, consultation, tutor, manager, administrator, as well as specific rights, for example in the area of human resources. Some members of Since & Co's staff hold operations and support roles that allow them to act across all organisations, within the limits laid down in Article 6.

Each organisation's data is segregated: a user has access only to the data of the organisations to which they are attached.

5.3. Account security

• Password. It must contain at least 8 characters, including an upper-case letter, a lower-case letter, a digit and a special character. It is stored in hashed form: neither the publisher nor your organisation can read it.
• Renewal. You must change your password at your first login, and then every two months. When it falls due, the platform asks you to do so before any other access.
• Two-factor authentication. You can enable a second login step: a code produced by an authenticator application, or a six-digit code received by email. We recommend that you enable it. You can declare a device as “trusted” so that you no longer have to enter this code on that device for 30 days.
• History. The platform records the date of your logins, and the IP address and browser used, for security purposes.

You keep your credentials secret. You inform the administrator of your organisation without delay of any loss, theft or abnormal use of your account.

5.4. Personal use

Your account is strictly personal. You do not share it and you do not transfer it. Any action carried out from your account is deemed to have been carried out by you.

The administrator of your organisation may, for support purposes, temporarily log in “as” a user of their organisation. This facility is the responsibility of the organisation, which informs its users of it.

5.5. Suspension and deletion

Your organisation may deactivate or delete your account at any time. Since & Co may suspend an account, without notice in an emergency, where that account compromises the security of the platform, seriously breaches the Terms or is used for unlawful purposes. It informs the client organisation.

The effects of the deletion of an account on the data are described in the privacy policy.

Article 6 — Respective roles of Since & Co and the client organisation

1. The client organisation is the controller of the personal data of its users and of the persons mentioned or recorded in its content. It decides on the purposes and means: who has an account, which skills are tracked, which assessments are carried out, which badges are issued, which AI features are used.
2. Since & Co is the publisher of the platform and a processor within the meaning of Article 28 of the General Data Protection Regulation (GDPR). It processes that data on behalf of the client organisation and on its instructions, under the conditions of the data processing agreement.
3. Since & Co is the controller only for the data it processes for its own purposes: management of the contractual relationship, security of the platform, proof of acceptance of the Terms, AI usage log. See the privacy policy.
4. The client organisation informs its users, and more broadly the data subjects, of the processing it carries out on the platform. It complies with its own obligations, in particular under employment law: information and, where applicable, consultation of employee representatives; prior information of employees about assessment systems.
5. To exercise your rights over your data, contact your organisation first. Since & Co assists it in responding to you.

Article 7 — Permitted uses and prohibited uses

7.1. Permitted uses

You use the platform for the professional or training needs of your organisation, within the limits of your rights and in accordance with the Terms and the applicable laws.

7.2. Prohibited uses

You are prohibited from:

• accessing or attempting to access data or spaces to which you are not entitled, in particular those of another organisation;
• circumventing or testing the security measures without authorisation, disrupting the service, or introducing malicious software into it;
• extracting data on a large scale, by a robot or any other automated process, other than through the export functions provided;
• decompiling or copying the platform, or using it to develop a competing service;
• uploading content that is unlawful, defamatory, insulting or discriminatory, or that infringes the privacy, image rights, trade secrets or intellectual property rights of a third party;
• impersonating a third party or using another user's account;
• using the platform to monitor people without their knowledge, or for any purpose unrelated to the management of activities, skills and training;
• reselling your access or making it available to third parties, without the written agreement of Since & Co.

The prohibited uses specific to AI are set out in Article 24.

Article 8 — Uploaded content

8.1. Ownership and licence of use

The client organisation and its users remain the holders of their rights in their content. The client organisation grants Since & Co, for the term of the contract and worldwide, a non-exclusive, royalty-free licence limited solely to the needs of the service: to host, reproduce, back up, display to authorised users, convert (image formats, PDF, interface translation), and transmit to the strictly necessary processors, including AI providers where those features are used.

Since & Co does not use an organisation's content for any other purpose. In particular, it does not disclose it to another organisation and does not use it to train AI models (see Article 20).

8.2. Warranties of the user and of the organisation

You warrant that you hold the necessary rights and authorisations in respect of the content you upload: copyright, the rights of individuals in their image and voice, authorisation from your employer or from the site visited, respect for trade secrets. You upload only content that is relevant to the purpose of the platform.

8.3. Moderation

Since & Co does not carry out any prior checking of content. The client organisation moderates the content of its space. Since & Co may remove or disable access to manifestly unlawful content of which it is aware, in particular following a report. It informs the client organisation.

8.4. Images from image libraries

When you import an image from a third-party image library, you comply with the licence and terms of that library. The search transmits the keywords entered to the image library. See the credits.

8.5. Sharing outside the organisation

Certain functions open content up to outside persons: review of a sheet by an expert by means of a secure link, sharing of a learning path with a subsidiary, public page of a badge. The client organisation decides on such sharing and is answerable for it.

Article 9 — Cartographe mobile application

9.1. Purpose

The Cartographe application is used to gather in the field the material for activity sheets: sound recordings of interviews and explanations, photographs, videos. These captures are then synchronised with the organisation's space on the platform. Access to the application is granted by the client organisation; it may be revoked at any time. Until you have accepted the version of the Terms in force on the website, the application does not work: the platform refuses its requests with a message directing you to the website; only logging in, logging out and checking your acceptance status remain possible.

9.2. Information and agreement of the persons recorded

A capture almost always contains personal data: the voice, image and words of identifiable individuals. Before any capture, you must:

1. clearly inform each person concerned of the recording, of its purpose (describing an activity for skills mapping), of the persons who will have access to it, of its retention period and of their rights;
2. inform them, where this is the case, that the recording may be transcribed and analysed by an AI, including by a third-party provider (see Article 13);
3. obtain their agreement in accordance with the rules laid down by your organisation, and respect their refusal;
4. never record a person without their knowledge.

The client organisation, as controller, defines the legal basis for these captures, the arrangements for providing information and, where applicable, the authorisation forms.

9.3. Rights in one's image and voice

You photograph, film and record a person only with their authorisation. You frame your shots on the work being performed and avoid capturing persons unconnected with the activity described, minors, screens, documents or name badges.

9.4. Sites, industrial secrets and safety

You make captures on a site only with the authorisation of its operator. You respect the areas where photography and filming are prohibited, the safety instructions, trade secrets, manufacturing secrets and the applicable confidentiality or classification obligations. You do not capture information unrelated to the activity described.

9.5. Encryption of captures

Where the client organisation has enabled the encryption of captures:

• each capture is encrypted on the device with a random key specific to that capture (AES-256-GCM);
• that key is itself encrypted with the organisation's public key (RSA-OAEP); only the corresponding private key makes it possible to recover it;
• the organisation's private key is never transmitted to the application. It is stored on the platform's servers, encrypted at rest (AES-256-GCM);
• the captures therefore remain encrypted on the device and in transit. They are decrypted by the platform's server at the time of synchronisation, so that they can be listened to, displayed, transcribed and turned into sheets.

This mechanism protects the captures against loss or theft of the device and against interception in transit. It is not a form of encryption in which the publisher does not hold the keys: once synchronised, the captures are readable by the platform and by the organisation's authorised users. Where encryption is not enabled, the captures are protected in transit by the encryption of the connection (HTTPS).

9.6. Device

You protect the device on which the application is installed (lock code, updates). In the event of loss or theft, you notify the administrator without delay, who can revoke the device's access.

Article 10 — Open Badges

1. Purpose. A tutor may issue to a learner who has completed a learning path a digital badge in the Open Badges open standard. The badge certifies successful completion of the learning path in the name of the issuing organisation.
2. Public and lasting nature. Each badge has a page and verification data that are publicly accessible on the internet, without logging in, at a permanent and non-guessable address. This information is designed to last: it remains online after the end of the learning path and after the learner's account is deleted, so that the badge remains verifiable by a third party (employer, training body).
3. Data published. The public page shows the badge and its image, the skills it certifies, the issuing organisation and the date of issue. The learner's email address never appears there in clear text: only a salted hash of that address is published. It enables a person who already knows the address to check that the badge corresponds to it. The learner is free to share their badge, and therefore to reveal that they are its holder.
4. Agreement of the learner. A badge is issued only after the learner's agreement to this publication has been obtained. The tutor attests to that agreement at the time of issue; its date is recorded. The tutor does not tick this box without having actually informed the learner and obtained their agreement.
5. Revocation. The tutor may revoke a badge, stating a reason, on their own initiative or at the learner's request. The public verification data then indicates that the badge is revoked and no longer presents it as valid. The reason entered is displayed on the public page of the badge: the tutor words it neutrally, with no personal data and no judgement on the learner. Revocation is the means by which the learner obtains the withdrawal of their badge. It has no effect on any copies that third parties may already have made.

Article 11 — Framework for the use of AI: principles

Articles 11 to 24 form the framework for the use of AI on the platform. They apply to any AI feature, present or future. Four principles sum them up:

1. Transparency. You know which features rely on an AI, which provider is called upon and which data is transmitted to it.
2. Control. AI is optional. Your organisation can disable it. You freely give or withdraw your consent. Apart from operations carried out by the publisher, no call to a third-party provider is made without an API key supplied by you or by your organisation.
3. Human oversight. An AI output is a proposal. A human decides.
4. Minimisation. Only what is necessary is submitted to the AI, and certain categories of data never are.

The inventory below is kept up to date with each version of the Terms. Any new AI feature or any new provider gives rise to a new version.

Article 12 — Inventory of AI features

What does not rely on generative AI

• Translation of content. The platform does not automatically translate organisations' content. The translations of the demonstration content supplied by the publisher were prepared in advance and reviewed; no organisation content is sent to a translation service.
• Titles of imported images. The title of an image imported from an image library may be translated into French by the MyMemory machine translation service. Only that title, which comes from the image library, is transmitted.
• Avatars. Default avatars are graphic patterns, produced without AI. Where they are generated by the DiceBear service, only a hashed random value is transmitted to it: neither name nor email address.
• Reviews, versatility, progress. These screens rely on set calculations and rules, not on an AI.

Article 13 — AI providers and data transmitted

These features transmit neither your name, nor your email address, nor your identifier. However, the content itself may contain personal data: the words and voice of a person recorded, the name of a colleague mentioned in an operating mode. That is why Article 19 regulates what may be submitted.

Location and transfers outside the European Union

These providers are companies established outside the European Union, most of them in the United States, or that may process data outside the Union. Use of a feature that calls upon them may therefore entail a transfer of data outside the European Union.

The location of the processing, the transfer safeguards (adequacy decision, standard contractual clauses), the retention periods and any use made of the data depend on the provider's terms and on the plan subscribed to by the holder of the API key. Since & Co does not control them and gives no undertaking in the provider's place. Consult those terms before using a feature. The client organisation, as controller, checks that those terms are compatible with its obligations before registering a key or authorising AI.

Article 14 — What is processed locally and what goes to a third party

14.1. Processing carried out on the platform's servers

• skill suggestion, including its semantic part: the vectors are computed by a program belonging to the publisher, with an open model run on the server;
• lexical keyword extraction;
• audio transcription by Whisper or WhisperX, where they are installed on the server, including speaker separation.

For this processing, no data leaves the platform. The models are merely downloaded from Hugging Face when they are installed.

14.2. Processing carried out by a third-party provider

All the other features in Article 12 transmit data to a third-party provider. Audio transcription goes to OpenAI only if the local tool is unavailable or fails, and if an OpenAI key is available; otherwise, it is simply unavailable.

14.3. Publisher's tools run on the server but connected to a provider

In the course of operations, Since & Co may use the “Claude Code” (Anthropic) and “Codex” (OpenAI) tools. These programs are installed on the server, but they process nothing locally: they transmit the data to the corresponding provider, on Since & Co's account. They therefore constitute processing by a third party. They are never used with a client's key: with a client's key, the call always goes through the provider's application programming interface.

All operational processing launched by Since & Co with its own resources (these tools or the platform's configuration) is recorded in the usage log described in Article 22.1, with “platform” as the key used, without a user, and with the organisation processed. It complies with the “AI for the organisation” setting in Article 23: processing aimed at an organisation that has disabled AI is refused before anything is sent. It is not subject to individual consent, except where it is carried out on behalf of a user, with that user's keys: it then requires their consent. A limit to be aware of: global processing covering all organisations is not subject to each organisation's setting; it is launched only under the conditions of Article 23.

The content produced by such processing (glossary, organisation description and business instruction, keywords) is saved directly, without prior validation, and bears the “AI-generated” mark described in Article 17. The organisation reviews and corrects it in the administration area; the first change removes the mark.

14.4. The screen tells you what is going to happen

The session player indicates, before anything is launched, whether the transcription will be local or which key will be used (yours, the organisation's), and whether none exists.

Article 15 — API keys supplied by the user or by their organisation

15.1. Principle

The AI features that call upon a third-party provider work with your API key or with that of your organisation. You register your keys in “My AI keys” (profile); the administrator registers the organisation's keys in “Organisation AI keys”. Four providers are supported: Anthropic, OpenAI, Google Gemini and Stability AI. One key only per provider and per holder: registering a new one replaces the previous one.

15.2. Order in which keys are used

1. your personal key, if it exists, is active and the organisation in which you are working has not prohibited personal keys (Article 23);
2. failing that, the active key of the organisation in which you are working;
3. failing that, the feature is unavailable and no call is sent to the provider. The platform never falls back on Since & Co's keys for a user or a client organisation.

A disabled key is ignored, as if it did not exist. For processing carried out without a user on behalf of an organisation, only that organisation's key is used. Where the organisation prohibits personal keys, your personal key is never used in that organisation: only the organisation's key is used and, without an organisation key, the feature is unavailable. Your personal keys remain registered and usable in your other organisations.

Exception: operations by the publisher. Processing launched by Since & Co in the course of operations, and the actions of members of its staff holding an operations role, use Since & Co's resources (its own keys or the tools described in Article 14.3), at its expense. The personal keys of those persons are then not used. In that case the providers concerned act as sub-processors of Since & Co; they are listed in the annex to the data processing agreement.

15.3. Requests executed on the key holder's account

• The requests are sent on the account that the key holder has with the provider. The holder bears the cost. The platform tracks neither costs nor quotas: invoicing is that of the provider.
• By registering a key, the holder declares that they have accepted the provider's terms and undertakes to comply with them, including its usage policies.
• The administrator who registers an organisation key accepts that all the organisation's users without a personal key will use it, at the organisation's expense.
• If you use a personal key to process your organisation's data, you make sure that your organisation authorises it, through its internal rules and through the setting in Article 23: that data will be processed on your personal account with the provider.
• The holder is answerable for the validity of their key (credit, quota, rights) and for its confidentiality outside the platform. If a leak is suspected, they revoke it with the provider, and then delete or replace it on the platform.

15.4. Protection of keys

• The key is encrypted as soon as it is registered (AES-256-GCM), with a master key stored on the server, outside the database.
• It is never displayed again, to anyone. Only its last four characters remain visible, so that you can recognise it.
• It is decrypted only in memory, for the duration of a call. It is written neither to the technical logs, nor to the audit log, nor to exports.
• Your personal keys are visible to and manageable by you alone. No role is an exception to this: neither the administrator of your organisation nor Since & Co's staff can view them, use them in your place, test them or delete them from the interface. They follow you if you change organisation and are deleted with your account.
• Organisation keys are managed by the administrators of that organisation alone. The addition, replacement, enabling, disabling and deletion of a key are recorded in the audit log, without the key.
• When an organisation is deleted, its keys are deleted and do not appear in any export.
• The “Test” button sends the provider a minimal request, with no content whatsoever, to check the validity of the key. Only the result is kept.

A limitation to be aware of: encryption at rest protects the keys in the event of a leak of the database. It does not protect against a complete compromise of the server, which holds the master key.

15.5. What Since & Co sees and does not see

Since & Co records usage metadata, described in Article 22. The usage log contains neither the request, nor the response, nor the key. Exchanges with the provider pass through the platform's servers, which build the request and receive the response; the cases in which content is retained are listed in Article 22. Nor does your organisation's administrator see your personal keys: they can only prohibit their use in their organisation (Article 23).

15.6. No warranty regarding third-party services

Since & Co warrants neither the availability, nor the performance, nor the continued existence, nor the prices of the AI providers' services. A provider may change or withdraw a model, refuse a request or limit throughput. The unavailability of a provider or of a key does not constitute a breach by Since & Co.

Article 16 — Consent to the use of AI

1. Use of the AI features that you trigger is subject to your specific consent, separate from acceptance of the Terms. It also applies to those that run on the platform's servers with no key and no third-party provider, such as local audio transcription. Only skill suggestion and lexical keyword extraction are not subject to it. You can use the platform without giving it: only the features subject to consent will then be closed to you.
2. You give and withdraw this consent at any time from your profile, on the “AI consent” page. Withdrawing it is as simple as giving it.
3. The platform records the date of your agreement, the version of the Terms in force on that date and, where applicable, the date of its withdrawal. This evidence is kept for the lifetime of your account, then for 5 years after its deletion, in the same pseudonymised form as the evidence of acceptance of the Terms (Article 3).
4. Consent is checked before each call. Without active consent, the call is refused: nothing is transmitted to a provider and no local transcription is started. This rule applies to every user, including the publisher's staff when they act from their own account.
5. Withdrawal applies for the future. It has no effect on processing already carried out or on content already saved.
6. This consent is that of the user who triggers the feature. It replaces neither the information nor the agreement of the persons whose words or image appear in the content (see Article 9.2).
7. Processing launched by Since & Co in the course of operations, without a user account, does not fall under this individual consent. It is carried out on the client organisation's instruction, within the framework of the data processing agreement.

Article 17 — Transparency

In accordance with Regulation (EU) 2024/1689 on artificial intelligence (the EU AI Act):

1. You know when you are using an AI. AI features are triggered by an explicit action, on screens that identify them as such: session player (“AI is analysing the transcription”, “SIC sheet generated”), “AI review” screen, “My AI keys” and “Organisation AI keys” pages. The platform does not include a conversational agent.
2. AI proposals are flagged as such for as long as they are proposals. In the “AI review” screen, each proposal is presented as coming from the AI, with its justification and its confidence level. In the session player, the sheets produced are presented as generated.
3. Content written by an AI bears an “AI-generated” mark. Sheets saved from a transcription, AI review proposals that have been applied, and the glossary, description, business instruction and keywords produced by the processing in Article 14.3 are saved with the date of their generation and the provider and model used. This mark is displayed by a badge on the sheets, in the glossary and in the administration area. It disappears as soon as a user changes the content: the content then becomes the organisation's, under the responsibility of the person who reviewed it. It is for the organisation to indicate this origin where a rule or a practice so requires, in particular if it distributes the content externally.
4. Generated images must be presented as such by the person who publishes them, where they could be mistaken for real images.

Limitations of AI

A generative AI may:

• be wrong, including with confidence, and invent facts, standards, references or steps (“hallucinations”);
• omit a step, a safety instruction or a point requiring attention;
• mistranscribe a word, a proper noun, a figure or a technical term, or attribute words to the wrong speaker;
• reproduce biases present in its training data;
• produce different results for the same request;
• produce content that is close to an existing work.

These limitations are particularly important for operating modes and safety instructions: generated content must never be put into practice without having been checked by a competent person.

Article 18 — Human oversight and absence of automated decision-making

1. An AI output is a proposal. It has no value until an authorised person has reviewed and validated it. In the AI review, nothing is written to the SIC until a platform administrator, a member of Since & Co's staff acting under a mandate from the organisation, has applied the proposal; the applied content remains marked “AI-generated” (Article 17) until the organisation reviews and changes it.
2. The following are always decided by a human: the publication of a sheet or a learning path; the association of a skill with an activity, a learning path or a person; the validation of a learning outcome; any assessment; any review; the issuing or revocation of a badge; any human resources decision.
3. No automated individual decision. The platform does not take, by means of AI, any decision producing legal effects concerning a person or significantly affecting them, within the meaning of Article 22 of the GDPR. As at the date of this version, no AI feature assesses, scores, ranks or compares people: the AI features relate to the description of work (activities, operating modes, knowledge, glossary), not to individuals.
4. The client organisation and its users undertake not to use an AI output as the sole basis for a decision concerning a person: recruitment, assignment, remuneration, promotion, disciplinary sanction, termination of the contract, access to training, award of a certification.
5. The person who validates has the competence and the time needed to exercise genuine control. A purely formal validation does not meet this requirement.

Article 19 — Data not to be submitted to AI

You do not submit to an AI feature that calls upon a third-party provider:

• sensitive data: health, disability, origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, genetic or biometric data, convictions and offences;
• data relating to persons who have not been informed that their words, voice or image might be processed by an AI;
• trade secrets, manufacturing secrets or confidential or classified information, without the authorisation of their holder;
• data relating to minors;
• credentials, passwords, API keys, social security numbers, bank details;
• judgements on the behaviour or performance of an identifiable person.

Good practice

• Minimise: submit only the recordings and texts that are relevant. Stop the recording during exchanges unrelated to the activity.
• Pseudonymise: refer to people by their function (“the operator”, “the team leader”) rather than by their name, in interviews and in sheets alike.
• Review before submitting: review the transcription before launching the conversion into sheets; it is its full text that is transmitted.
• Prefer local processing where it is available.

The platform does not automatically filter this data. Compliance with this article rests on the user and on their organisation.

Article 20 — Training of models

1. Since & Co does not train any AI model with the content of client organisations and does not use it to improve models, whether its own or those of third parties.
2. Local processing uses pre-trained open models, run as they are. The semantic vectors computed from an organisation's content are used solely for skill suggestion; they remain on the platform.
3. The use that a third-party provider makes of the data it receives depends on its terms and on the plan subscribed to by the key holder. The terms applicable to application programming interfaces often differ from those of consumer offerings, and may change. Since & Co gives no undertaking on behalf of a provider. The key holder checks this point, provider by provider, and adjusts the settings of their account accordingly.
4. For processing carried out with Since & Co's resources, the undertakings obtained from the providers are set out in the annex to the data processing agreement.

Article 21 — Ownership of and responsibility for generated content

1. Ownership. Since & Co claims no right in generated content. As between Since & Co and the client organisation, it is treated like the organisation's other content (Article 8), subject to the provider's terms.
2. Uncertain protection. Content produced by an AI without any human creative input may not be protected by copyright. Since & Co does not warrant that generated content is capable of protection.
3. No warranty of originality or accuracy. Generated content is provided as is. Since & Co warrants neither its accuracy, nor its completeness, nor its compliance with a standard or regulation, nor its originality, nor the absence of resemblance to existing content. Similar results may be produced for other users.
4. Responsibility of the person who validates. The person who validates, saves, publishes or distributes generated content assumes responsibility for it, as if they had written it. The client organisation is answerable for the content of its space.
5. Third-party rights. Before publishing generated content, you check that it does not infringe the rights of a third party: copyright, trade mark, image rights, privacy, trade secrets.

Article 22 — Logging

22.1. AI usage log

Each call to a third-party provider made through a key gives rise to a log entry containing: the user, the organisation, the date and time, the feature, the provider, the model, the key used (personal, organisation or publisher), success or failure, a short error code and, where the provider communicates them, the number of text units (“tokens”) in input and in output.

This log never contains the request, the response, the key (even encrypted) or the provider's raw error message.

The following are not recorded in this log: local transcriptions and the testing of a key. Processing launched by the publisher in the course of operations with its own resources does appear in it, with “platform” as the key used, without a user and with the organisation processed (Article 14.3).

Purposes: security and detection of abuse, support, information of the key holder about the use made of the key, invoicing where applicable.

Access: you see all your own calls in “My AI keys”, across all organisations, with the organisation and the key used for each one. The administrator sees, in “Organisation AI keys”, only the calls made with the organisation's key; they see neither those you make with your personal key nor those of operational processing. Authorised Since & Co staff may access the log for the purposes set out above.

Duration: each entry is kept for 13 months, then deleted automatically (see the privacy policy). If your account is deleted before then, your entries are kept with no link to you. If the organisation is deleted, its log is deleted too.

22.2. Content retained by the platform

Apart from the usage log, the platform retains the following content, because it is the expected result of the feature or is necessary for checking it:

• the transcription of a session, saved with the session;
• the generated sheets that the administrator decides to save in the SIC;
• for the AI review and the knowledge review: the request sent to the AI, its response and each proposal (original value, proposed value, justification, status), in order to enable human validation and to keep a record of it. The request and the response are erased 6 months after the review, once all its proposals have been dealt with; the proposals and their status are kept;
• for the conversion of a transcription into sheets: a short extract of the AI's response (its first 500 characters at most), written to the technical log where that response is unreadable. This extract disappears with the log, which is kept for 30 days. In production, the raw response itself is not kept on disk: only the sheets that the administrator saves are kept. Any raw files remaining on the server are deleted automatically;
• the generated glossaries, descriptions and images, once saved.

22.3. Audit log

Operations on organisation keys, the enabling or disabling of AI for an organisation, and the authorisation or prohibition of personal keys, are recorded in the organisation's audit log. Audit log entries are kept for 3 years.

Article 23 — Control by the organisation

1. Enabling or disabling AI. The administrator can disable AI for their whole organisation from the “Organisation AI keys” screen. From then on, all the AI features triggered by a user are refused for that organisation, including for a user who has a personal key, and including local audio transcription, which requires no key. Only skill suggestion and lexical keyword extraction, which are local processing with no third-party provider, are not affected. This setting also applies to operational processing aimed at the organisation (Article 14.3). Each change is recorded in the audit log.
2. Authorising or prohibiting personal keys. Through a second setting, independent of the first and available from the same screen, the administrator authorises or prohibits the use of personal keys in the organisation. Where they are prohibited, no personal key is used for the organisation's data: only the organisation's key is used (Article 15.2). Each change is recorded in the audit log, and the user is informed of it in “My AI keys”.
3. Choosing its providers. The organisation chooses the providers it authorises by registering a key only for those providers. It supplements the above settings through its internal rules.
4. Operations by the publisher. Since & Co launches AI processing in the course of operations on an organisation's content only at the request or with the agreement of that organisation. It undertakes not to do so for an organisation that has disabled AI; the platform itself refuses processing aimed at that organisation (Article 14.3).
5. Informing. The client organisation informs its users and the data subjects of the use of AI. Where the law so requires, it informs and consults its employee representatives before introducing these features, and carries out the necessary assessments, in particular a data protection impact assessment.
6. Monitoring. The administrator has access to the status of the AI consents of the users of their organisation, and to the log of calls made with the organisation's key.

Article 24 — Prohibited uses of AI

It is prohibited to use the platform's AI features to:

• circumvent the rules of the Terms, the consent, key or disabling mechanisms, or a provider's usage policies;
• carry out large-scale extraction, or automated extraction, or divert the features to a use unrelated to skills mapping and training;
• produce or distribute unlawful content, or content that is misleading, defamatory or discriminatory, that infringes the rights of a third party, or that imitates a real person without their agreement;
• profile people, or assess or predict their behaviour, reliability, performance or personality;
• monitor employees, analyse their words or their activity for purposes of control or sanction, or use a recording for a purpose other than the description of an activity;
• infer the emotions of a person in their place of work or training, categorise them on the basis of biometric data, identify them by their voice or face, or engage in any other practice prohibited by Regulation (EU) 2024/1689;
• take an individual decision on the sole basis of an AI output (Article 18);
• use a third party's key without their agreement, or seek to obtain a key registered on the platform.

Failure to comply with this article may lead to suspension of the account (Article 5.5).

Article 25 — Availability and maintenance

Since & Co uses reasonable means to ensure access to the platform. It is not bound by an obligation to achieve a result (“obligation de résultat”), save for any service level commitment provided for in the contract entered into with the client organisation.

Access may be interrupted for maintenance, updates or security. Since & Co endeavours to schedule such work at times of lowest use and to inform organisations where the interruption is significant. The platform evolves: features may be added, changed or withdrawn.

Article 26 — Backups

Since & Co backs up the database and the uploaded files on a daily, weekly and monthly cycle. Daily backups are kept for 7 days, weekly backups for 4 weeks and monthly backups for 12 months. A copy is transferred over an encrypted connection to remote storage, separate from the hosting server.

These backups are used to restore the platform after an incident. They do not constitute an archiving service or a service for restoring, on request, content deleted by a user. Deleted data may remain in the backups until they expire.

The client organisation keeps, by its own means, a copy of the items it considers essential, using the export functions.

Article 27 — Support

Users contact the administrator of their organisation in the first instance. Online help and a support request form are accessible from the platform. Requests are handled by Since & Co in accordance with the arrangements provided for in the contract. To handle a request, authorised Since & Co staff may access the space of the organisation concerned.

Article 28 — Liability and limitations

1. Since & Co is liable for direct and foreseeable damage caused by a proven breach of its obligations.
2. It is not liable for: content uploaded, generated or validated by users; the use made of the platform and the decisions taken by the client organisation; the accuracy of AI outputs; the unavailability, prices or practices of third-party providers; the loss of an API key outside the platform; a fault in the user's equipment or connection; the organisation's failure to comply with its own legal obligations.
3. Between professionals, indirect damage (loss of business, of turnover, of opportunity, of reputation, of data not backed up by the client) is excluded. Since & Co's total liability is limited to the cap set by the contract entered into with the client organisation or, failing that, to the sums paid by that organisation in respect of the twelve months preceding the event giving rise to liability.
4. These limitations do not apply in the event of gross negligence or wilful misconduct, in the event of personal injury, or where the law prohibits them, in particular with regard to a consumer.
5. The platform's content, in particular operating modes and safety instructions, never dispenses with the need to comply with regulations, the employer's instructions and the rules of good practice of the trade.

Article 29 — Force majeure

No party is liable for a breach due to an event of force majeure within the meaning of Article 1218 of the French Civil Code. The following in particular are regarded as such, where they meet its conditions: the widespread failure of electronic communications or energy networks, a large-scale cyberattack despite security measures in line with the state of the art, a decision of a public authority, a natural disaster, an industrial dispute external to the party concerned.

Article 30 — Term and termination

The Terms apply to you for as long as you have an account. The duration of the client organisation's access and the conditions of termination are set by its contract with Since & Co.

In the event of a serious breach of the Terms, Since & Co may suspend the access concerned under the conditions of Article 5.5. The end of the contract results in the closure of the organisation's accounts, after the reversibility period.

Article 31 — Reversibility and data export

1. During the contract. The client organisation has export functions: activity sheets in PDF format, export of the data of an attached entity in a structured, machine-readable format (JSON).
2. At the end of the contract. At the client organisation's request, made before the end of the contract or within the period provided for in it, Since & Co delivers to it an export of its data (database and uploaded files) in a commonly used format.
3. Deletion. After delivery of the export or expiry of the period, Since & Co deletes the organisation's data. A safety export is made before deletion; API keys never appear in it. The data remains in the backups until they expire (Article 26).
4. Badges. The fate of the public pages of badges issued is settled with the client organisation at the time of deletion: deleting them causes them to lose their verifiable nature.

Article 32 — Personal data and cookies

The processing of personal data is described in the privacy policy. Cookies and other trackers are described on the cookies and trackers page. Since & Co's obligations as a processor are set out in the data processing agreement.

Article 33 — Governing law and jurisdiction

The Terms are governed by French law.

In the event of a dispute, the parties first seek an amicable solution. Failing that, and where the dispute is between professionals, it falls within the exclusive jurisdiction of the courts within whose jurisdiction Since & Co's registered office is located, including in the event of summary proceedings, multiple defendants or third-party claims under a warranty, unless the contract entered into with the client organisation stipulates otherwise.

This clause does not deprive a consumer or an employee of the protective rules of jurisdiction afforded to them by law. A consumer may have recourse to mediation.

Article 34 — Miscellaneous provisions and contact

If a provision of the Terms is declared void or unenforceable, the others remain in force. Failure to rely on a breach does not constitute a waiver of the right to rely on it subsequently.

For any question about the Terms: [to be completed]. For any question about your personal data: [to be completed].