Children's Data Protection

When a child is added to a Mental Loadless family, we collect:

• Identity: first name, avatar (emoji), date of birth, gender (optional)

• Education: school level, homework, exams and their tracking

• AI Assistant: history of interactions with Coco for homework help

• Photos: images the family sends to the AI (planner, homework notebook, shopping receipt, task verification) — analyzed, not retained by us, kept at most 30 days by the processor for abuse monitoring, never used to train a model

• Notifications: homework and exam reminders sent to the parent's device

The processing of children's data is based on:

• GDPR Art. 8 (EU): parental consent required for children under 15 (France)

• COPPA (USA): parental consent required for children under 13

• App Store Guideline 5.1.1: explicit disclosure of data collected about minors

Explicit parental consent is collected via the mobile app before each child addition. The date, time, and identifier of the consenting parent are recorded in our database.

Each data category is collected for a specific purpose:

• Identity: identify the child within the family and personalize the experience

• Education: enable homework tracking, exam preparation, and Coco's educational help

• AI: provide homework help adapted to the school level

• Photos: extract the text or useful information from an image (a homework item, an event, a list). Only the result of the analysis is stored: we do not retain the photo. The processor may keep it for up to 30 days within the European Union for abuse monitoring, before automatic deletion, and never uses it to train a model

• Notifications: remind parents of important deadlines

Access to the child's data is strictly controlled:

• Parents/administrators can see: first name, avatar, date of birth, gender, school level, homework, exams

• The child gets a simplified space: their homework and Coco's homework help

• No one outside the family has access to this data

A child account emits no usage measurement, whatever choice was made elsewhere on the device.

The child's data is retained:

• As long as the child's profile is present in the family

• Until the family account is deleted

When a child's profile is deleted by an administrator, all associated data (homework, Coco history) is deleted within 30 days. Complete family account deletion triggers deletion of all data within 30 days.

As a parent or legal guardian, you have the following rights over the child's data:

• Access: request a copy of collected data

• Rectification: correct inaccurate information (available directly in the app)

• Deletion: delete the child's profile (available in the app) or the complete account

• Withdrawal of consent: you can withdraw consent at any time by deleting the child's profile

• Objection: object to certain processing (including AI homework help)

To exercise these rights: contact@mentalloadless.com

Specific measures protect children's data:

• Compartmentalization: data is partitioned by household in Cosmos DB, and a child account can access neither the personal data reserved for the adults in their family nor the data of another household

• Server-side JWT validation: no data is accessible without authentication

• Azure Functions proxy: no API keys are exposed client-side

• Encryption: data encrypted in transit (HTTPS/TLS) and at rest (Azure Cosmos DB)

• Consent trail: the date and author of parental consent are recorded and cannot be modified

For any questions regarding children's data:

SmartAILabs

Email: contact@mentalloadless.com

You may also file a complaint with:

• CNIL (France): www.cnil.fr

• FTC (USA/COPPA): www.ftc.gov