Privacy Policy

1. Data controller

This policy explains how explorations360 collects, uses, stores and protects personal data processed through the easystory360 platform, the easyviewer360 app and the connector that lets you link an artificial intelligence assistant to them.

2. Data we collect

• Identity and contact details: first name, last name, email address, phone number, company name.
• Content: media you upload and stories you create on the platform.
• Usage: login history and use of the service.
• AI connector, if you enable it: technical information about the access you grant (see section 8).

Online payments are processed by Stripe: we do not store your card numbers.

3. Purposes and legal bases

4. Recipients and service providers

Your data is never sold or rented. It is only shared with the technical providers strictly necessary to run the service:

Services you choose to connect yourself. If you connect an AI assistant (Anthropic’s Claude, OpenAI’s ChatGPT…) or your own ElevenLabs account, these providers receive the data needed for your request and process it under the contract between you and them (see sections 8 and 9).

5. Retention periods

6. Transfers outside the European Union

Platform data is hosted in the European Union. Some providers are however US companies, which may involve a transfer to, or access from, the United States:

• Google Firebase (Google LLC): hosting, EU region;
• Sendgrid (Twilio Inc.): technical emails;
• Google Gemini (Google LLC): writing assistance and media analysis.

These transfers are governed by the European Commission’s Standard Contractual Clauses (decision of June 4, 2021). We only use providers that have included them in their commitments, we limit access by entities located outside the EU, and where needed we add further measures (encryption, access restriction, pseudonymization).

7. Security

explorations360 implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration or disclosure. Secrets (connector tokens, ElevenLabs key) are never stored in clear text.

8. Connector for AI assistants (MCP)

easystory360 provides an MCP (Model Context Protocol) server at https://mcp.easystory360.tools/mcp. It lets you connect your own AI assistant to your account and ask it, in plain language, to read or edit your stories. It works with Claude (claude.ai, the Claude app, Claude Code), made by Anthropic, with ChatGPT, made by OpenAI, and with any other MCP-compatible assistant, under the same rules.

a. Activation: never by default

The connector only works after an explicit action on your part:

• either you sign in to your easystory360 account from the assistant and approve a consent screen (OAuth);
• or you create a personal token in your profile.

b. What the assistant can read

Access is limited to the account that granted it, never other users’ accounts.

• the list and content of your stories: titles, scenes, events and their texts, variables, languages;
• the names and types of the media in your library;
• the account’s quiz bank;
• the status of publications (links, access code). A publication’s password is only disclosed on explicit request;
• the list of your headsets and their status (on, story playing, installed content).

c. What the assistant can do, at your request

• edit your stories, their translations and the quiz bank;
• import media into your library;
• generate voice-overs, music or sound effects with your own ElevenLabs account, if connected (see section 9);
• publish a story or unpublish it;
• send a command to your headsets: play, pause or stop a story, install content, restart or shut down a headset.

Changes apply to the working copy of your stories: your visitors and headsets only see them after you publish again. The connector has no access to payment data.

d. What is sent to the assistant’s provider

Information the assistant reads through the connector is sent to its provider (for example Anthropic for Claude, OpenAI for ChatGPT), which processes it to answer you. You choose this provider, and it acts under the contract between you and it, according to its own terms, including data retention and use for model training. explorations360 does not control this processing.

Before connecting an assistant to an account that holds confidential information, we recommend reviewing the provider’s privacy policy and settings, for example those of Anthropic and of OpenAI.

e. What we store, and for how long

• Personal tokens: their hashed fingerprint (never the token itself), their name, their prefix, their creation and last-use dates.
• OAuth connections: the name of the authorized application, the authorization and last-use dates, and the fingerprint of tokens still valid. An access token lasts 1 hour, a refresh token 60 days. Expired tokens are deleted automatically.
• Traceability: every change made by an assistant is linked to the connection that made it, and publications are logged like those made from the editor.

All of this data is deleted with the account.

f. Revoking access

In your easystory360 profile, under “Connections”, you will find your personal tokens and the authorized applications (claude.ai, ChatGPT…). You can revoke each of them at any time, with immediate effect.

9. AI features built into the editor

Independently of the connector, some editor features use AI services:

• Writing assistance: when you ask for a translation, a correction, a rewording or the preparation of a text for speech synthesis, that text is sent to Google Gemini through our servers.
• Analysis of uploaded media: with a paid subscription, the editor can transcribe audio files and describe library images (description and keywords), also with Google Gemini. These analyses only start after your approval, in a window where each one can be declined separately.
• Speech synthesis: if you connect your own ElevenLabs account, the texts to be voiced are sent to ElevenLabs with your key. The key is stored encrypted and is never sent back to the browser. ElevenLabs processes these texts under the contract between you and it.

10. easyviewer360 app (Meta Quest)

easyviewer360, published on the Meta Horizon Store, does not collect any directly identifying personal data. It may process minimal technical data: session or experience identifier, playback or completion status of a sequence, anonymous device identifier (not linked to a Meta account).

It collects no location, biometric data, or audio or video of the user. This data is only used to play content, keep the app working and produce anonymized usage statistics. It is not used for advertising, is hosted in the EU (Google Firebase) and is not kept on the headset beyond the session. To exercise your rights, use the “SUPPORT” button in your easystory360 account.

11. explorations360.com website and cookies

The explorations360.com website uses Google Analytics for statistics, only after your consent. Data from the contact form, conversations with Alixe (the website’s assistant) and cookies are described in our legal notice (in French).

12. Your rights

Under articles 15 to 22 of the GDPR, you have the following rights:

• access to your data;
• rectification;
• erasure;
• restriction of processing;
• objection;
• portability;
• withdrawal of your consent at any time, for processing based on it.

Write to us at contact@explorations360.com. If you disagree with our answer, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the authority of your country of residence.

13. Changes to this policy

We update this page whenever a change to the service affects how your data is processed. The date of the last update is shown at the top of the page. The terms of use and sale are available on the easystory360 terms page (in French).