Privacy policy

What data we process, why, for how long, and how to exercise your rights.

Privacy Policy

1 — DATA CONTROLLER

WHN Group

WHN GROUP SAS, 60 RUE FRANCOIS 1ER, 75008 PARIS. RCS Paris: 103 761 565

Contact: privacy@mesdevoirsfaits.app

2 — REGULATORY FRAMEWORK

This policy respects the highest international standards:

  • General Data Protection Regulation (GDPR - EU)
  • Data Protection Act (France)
  • Children’s Online Privacy Protection Act (COPPA - USA)
  • CCPA / CPRA (California, USA)
  • Apple App Store and Google Play Requirements

3 — COLLECTED DATA

We only collect data strictly necessary for the operation of the service.

Parent
  • Email and unique identifier
  • Subscription status
  • Technical data (IP, logs, device)
Child
  • First name or pseudonym
  • Grade level
  • Educational interactions with Milo

Homework photos: automatically deleted within 30 days.

4 — LEGAL BASIS

  • Contract execution
  • Parental consent (verified via email and payment card)
  • Legitimate security interest
  • AI transparency and supervision

5 — AI TRANSPARENCY & SUPERVISION (MILO)

Milo is an educational AI built responsibly. Its operation is supervised by our team and protected by parental controls (PIN). No child's data is ever used to train third-party models. We apply principles of transparency, data quality and human oversight.

6 — RETENTION PERIOD

  • Parent account

    Subscription duration + obligations

  • Educational data

    24 months

  • Homework photos

    30 days

  • Technical logs

    12 months

  • Billing

    10 years

7 — SUBPROCESSORS AND TRANSFERS

  • Vercel
  • Supabase
  • Google Vertex AI (Gemini)
  • RevenueCat
  • Sentry
  • Apple
  • Google Play

To power the Milo tutor, message text, homework photos and voice audio are processed by Google (Vertex AI, European region); this data is not used to train the models. Any transfers outside the EU are governed by Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework. These transfers are triggered by the user — a message they type, a photo they take, a press on the microphone — and before the first of them the app displays a screen naming the data sent and its recipient, which can be declined. We confirm that Google, as a processor under Article 28 GDPR, provides these data with protection equivalent to our own: processing confined to European regions, no model training, no advertising purpose, contractual confidentiality and security obligations, and deletion of audio recordings after transcription.

8 — YOUR RIGHTS AND ACCESS

In accordance with GDPR and CCPA, you have the right to access, rectification, erasure, and portability.

  • Access
  • Rectification
  • Erasure
  • Portability

9 — MINORS' DATA (GDPR & COPPA)

In accordance with Article 8 of the GDPR and the COPPA law, MesDevoirsFaits implements specific protection measures for minors.

  • Parent-managed PIN security architecture (registration by an adult only).
  • Access to the service by the child is contingent upon the creation of an account by the holder of parental authority (the parent) and is carried out exclusively under the latter's supervision.
  • No commercial profiling of children.
  • Simplified right to be forgotten for all pedagogical data.
  • Strict limitation of collection to essential educational needs.

10 — AI TRANSPARENCY

Milo is an educational AI that interacts with minors, so we apply heightened diligence. We commit to transparency, data quality and human oversight, and never use children's data to train third-party models.

A question about your data?

You can also contact the CNIL:

Last updated: August 18, 2026