Privacy policy

What data we process, why, for how long, and how to exercise your rights.

Privacy Policy

1 — DATA CONTROLLER

WHN Group

WHN GROUP SAS, 60 RUE FRANCOIS 1ER, 75008 PARIS. RCS Paris: 103 761 565

Contact: privacy@mesdevoirsfaits.app

2 — REGULATORY FRAMEWORK

This policy respects the highest international standards:

  • General Data Protection Regulation (GDPR - EU)
  • Data Protection Act (France)
  • Children’s Online Privacy Protection Act (COPPA - USA)
  • CCPA / CPRA (California, USA)
  • Apple App Store and Google Play Requirements

3 — COLLECTED DATA

We only collect data strictly necessary for the operation of the service.

Parent
  • Email and unique identifier
  • Subscription status
  • Technical data (IP, logs, device)
  • PRONOTE connection, if you turn it on: school address and encrypted access token — never the password; date and version of your consent
  • Phone number, if you provide it at sign-up (optional)
  • Communication preferences: your email and SMS consents, with their date and the version of the text accepted
  • Sign-up journey in the app (steps reached, pseudonymous device identifier), with no typed content
Child
  • First name or pseudonym
  • Grade level
  • Educational interactions with Milo
  • Homework imported from PRONOTE (subject, instructions, due date), if the parent turns the connection on

Homework photos: automatically deleted within 30 days.

4 — LEGAL BASIS

  • Contract execution
  • Parental consent (verified via email and payment card)
  • Legitimate security interest
  • AI transparency and supervision
  • Marketing consent (optional): tips and offers by email or text message, and ads on social networks (Meta, Google) based on your hashed email or phone number — can be withdrawn at any time

5 — AI TRANSPARENCY & SUPERVISION (MILO)

Milo is an educational AI built responsibly. Its operation is supervised by our team and protected by parental controls (PIN). No child's data is ever used to train third-party models. We apply principles of transparency, data quality and human oversight.

6 — RETENTION PERIOD

  • Parent account

    Subscription duration + obligations

  • Educational data

    24 months

  • Homework photos

    30 days

  • Technical logs

    12 months

  • Billing

    10 years

  • PRONOTE connection

    Until disconnection (token deleted)

  • Marketing contacts

    Until you withdraw consent, at most 3 years after the last contact

7 — SUBPROCESSORS AND TRANSFERS

  • Vercel
  • Supabase
  • Google Vertex AI (Gemini)
  • RevenueCat
  • Sentry
  • Apple
  • Google Play
  • Resend
  • Meta (with your consent)
  • Google Ads (with your consent)

To power the Milo tutor, message text, homework photos and voice audio are processed by Google (Vertex AI, European region); this data is not used to train the models. Any transfers outside the EU are governed by Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework. These transfers are triggered by the user — a message they type, a photo they take, a press on the microphone — and before the first of them the app displays a screen naming the data sent and its recipient, which can be declined. We confirm that Google, as a processor under Article 28 GDPR, provides these data with protection equivalent to our own: processing confined to European regions, no model training, no advertising purpose, contractual confidentiality and security obligations, and deletion of audio recordings after transcription. PRONOTE connection (optional, secondary school): at the parent's request, our servers connect to the school's PRONOTE twice a day to read only the child's homework. The password is used for the first connection and is not kept; only an access token is stored, encrypted, and deleted as soon as the parent disconnects PRONOTE. PRONOTE is published by Index Éducation, with which MesDevoirsFaits has no connection.

8 — YOUR RIGHTS AND ACCESS

In accordance with GDPR and CCPA, you have the right to access, rectification, erasure, and portability.

  • Access
  • Rectification
  • Erasure
  • Portability

9 — MINORS' DATA (GDPR & COPPA)

In accordance with Article 8 of the GDPR and the COPPA law, MesDevoirsFaits implements specific protection measures for minors.

  • Parent-managed PIN security architecture (registration by an adult only).
  • Access to the service by the child is contingent upon the creation of an account by the holder of parental authority (the parent) and is carried out exclusively under the latter's supervision.
  • No commercial profiling of children.
  • Simplified right to be forgotten for all pedagogical data.
  • Strict limitation of collection to essential educational needs.

10 — AI TRANSPARENCY

Milo is an educational AI that interacts with minors, so we apply heightened diligence. We commit to transparency, data quality and human oversight, and never use children's data to train third-party models.

A question about your data?

You can also contact the CNIL:

Last updated: October 4, 2026

App StoreGoogle Play