Privacy policy

1. Data controller

The data controller is the company publishing the service, whose full identity appears in the legal notice.

For any question about your data, write to the email address given in the legal notice, stating the subject of your request.

2. Scope

This policy applies to the whole service: creating the parent account, declaring children, ordering and payment, the child completing the questionnaire, and producing and sending the report.

It does not apply to third-party websites that may be linked to, nor to the payment provider, which processes your payment data under its own responsibility and its own policy.

3. Data processed

We collect only the data needed to provide the service. The categories processed are as follows:

• Parent identity and contact details: surname, first name, email address, town, postcode, country of residence, preferred language.
• Sign-in account: password, kept only as an irreversible cryptographic hash; date of last sign-in and the associated IP address.
• Child profile: first name, age, country of schooling, school year. No email address for the child is requested or stored: the questionnaire invitation is sent to the parent.
• Questionnaire answers: answers entered by the child, any files or audio recordings submitted, progress and timestamps.
• Order and invoicing: chosen offer, amount, currency, promotional code, transaction reference, invoice. Bank card details never pass through our servers.
• Technical data: IP address, browser type, connection and error logs, failed sign-in attempts.

4. Purposes and legal bases

Each processing operation pursues a specific purpose and rests on an explicit legal basis:

• Creating and managing the parent account and verifying the email address: performance of the contract.
• Processing the order, collecting payment, issuing the invoice: performance of the contract and statutory accounting retention obligation.
• Having the child complete the questionnaire and producing the guidance report: performance of the contract, with the consent of the holder of parental responsibility for the child's data.
• Sending service-related emails — verification, payment confirmation, invitation, report: performance of the contract.
• Securing the service, preventing fraud and intrusion attempts, keeping a log of sensitive actions: legitimate interest of the publisher in protecting its users.
• Answering your support requests and requests to exercise your rights: legal obligation.

5. Children's data

The service is taken out by a parent or holder of parental responsibility, never by the child. That holder consents to the processing of their child's data when placing the order.

The child's data is kept to the strict minimum: first name, age, country of schooling, school year and questionnaire answers. No email address, no surname and no direct contact details for the child are requested. The invitation to take part is sent to the parent, who passes it on to the child.

The child accesses the questionnaire through an unguessable link and a temporary single-use access code, with no account created in their name. The holder of parental responsibility may request erasure of their child's data at any time.

6. Analysis by artificial intelligence

The report given to the parent is produced by an artificial intelligence model that analyses the child's answers against the service's assessment methodology.

That model runs on the publisher's own infrastructure, within the European Union. The child's answers are not sent to any third-party artificial intelligence provider and are never used to train a model, whether internal or external.

No decision producing legal effects or significantly affecting the child is taken solely on the basis of this automated processing: the report is a guidance document, left to the judgement of the parent and of the professionals they consult.

7. Recipients and processors

Your data is neither sold, rented nor passed on for advertising purposes. It is disclosed only to the following recipients, and only as far as they need it:

• Authorised staff of the publisher, bound by a duty of confidentiality and holding access limited to their duties.
• The hosting provider, which hosts the servers and the encrypted backups.
• The payment provider, which handles the transaction and receives only the data needed to carry it out.
• The email delivery provider, which sends the service's messages.
• Where applicable, administrative or judicial authorities, upon a valid formal request.

8. Transfers outside the European Union

Data is hosted and processed within the European Union. The artificial intelligence analysis runs on that same infrastructure, which avoids any transfer of the child's answers to a third country.

Should a processor come to handle data outside the European Union, such a transfer would be governed by an adequacy decision of the European Commission or by standard contractual clauses, and you would be informed by an update to this policy.

9. Retention periods

Data is not kept indefinitely. The following periods apply:

• Parent account and child profiles: for as long as the service is used, then three years after the last contact, unless erasure is requested earlier.
• Questionnaire answers and the report produced: three years from delivery of the report, so that the parent can return to it and order a follow-up.
• Invoices and accounting records: ten years, in line with statutory retention obligations.
• Sign-up session not carried through: twenty-four hours.
• Child's access code: until it expires, at most twenty-four hours after issue.
• Technical and security logs: six months to two years depending on their nature, then automatic deletion.

10. Security

Protecting children's data calls for a high standard. The following measures are in place:

• Encryption of all communications between your browser and the service.
• Passwords kept as an irreversible hash, computed with an algorithm designed to resist brute-force attacks.
• Encryption of technical secrets stored in the database and encryption of backups.
• Limits on sign-in attempts and temporary account locking after repeated failures.
• Role-based access separation: each person sees only what their duties require.
• A tamper-proof log of sensitive actions, and masking of personal data in technical logs.
• Files submitted by the child are stored outside the public area and checked on receipt.

11. Your rights

For yourself and for your minor child, you have the following rights:

• Right of access: obtain confirmation that processing exists and receive a copy of the data.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure: request deletion of the data, subject to statutory retention obligations, notably accounting ones.
• Right to restriction: request the temporary freezing of contested processing.
• Right to portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on the publisher's legitimate interest.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing already carried out.

12. Cookies and trackers

The service uses no advertising cookies, no analytics trackers and no social network cookies. No data is passed to any advertiser.

Only the strictly necessary cookies listed below are set. You may delete them from your browser at any time, but doing so signs you out and interrupts a questionnaire in progress.

13. Contact and complaints

To exercise your rights or ask a question about your data, write to the email address given in the legal notice, stating the nature of your request. You will receive a reply within one month, which may be extended by two months for complex requests.

Proof of identity may be requested where there is reasonable doubt as to the identity of the requester, and only in that case.

If the reply does not satisfy you, you may lodge a complaint with the data protection supervisory authority of your country of residence.