Children's Data Protection

When a child is added to a Mental Loadless family, we collect:

• Identity: first name, avatar (emoji), date of birth, gender (optional)

• Education: school level, homework, exams and their tracking

• Wellbeing: daily mood and private space notes (visible only to the child)

• AI Assistant: history of interactions with Coco for homework help

• Notifications: homework and exam reminders sent to the parent's device

The processing of children's data is based on:

• GDPR Art. 8 (EU): parental consent required for children under 15 (France)

• COPPA (USA): parental consent required for children under 13

• App Store Guideline 5.1.1: explicit disclosure of data collected about minors

Explicit parental consent is collected via the mobile app before each child addition. The date, time, and identifier of the consenting parent are recorded in our database.

Each data category is collected for a specific purpose:

• Identity: identify the child within the family and personalize the experience

• Education: enable homework tracking, exam preparation, and Coco's educational help

• Wellbeing: provide the child with a private expression space (not accessible to parents)

• AI: provide homework help adapted to the school level

• Notifications: remind parents of important deadlines

Access to the child's data is strictly controlled:

• Parents/administrators can see: first name, avatar, date of birth, gender, school level, homework, exams

• The child only can see: their private space (mood, personal notes)

• No one else has access to the child's private space data, including parents

This separation is ensured by a separate Cosmos DB partition (`/userId`) for all private space data.

The child's data is retained:

• As long as the child's profile is present in the family

• Until the family account is deleted

When a child's profile is deleted by an administrator, all associated data (homework, private space) is deleted within 30 days. Complete family account deletion triggers deletion of all data within 30 days.

As a parent or legal guardian, you have the following rights over the child's data:

• Access: request a copy of collected data

• Rectification: correct inaccurate information (available directly in the app)

• Deletion: delete the child's profile (available in the app) or the complete account

• Withdrawal of consent: you can withdraw consent at any time by deleting the child's profile

• Objection: object to certain processing (including AI homework help)

To exercise these rights: contact@mentalloadless.com

Specific measures protect children's data:

• Isolation: the child's private space is partitioned by `userId` in Cosmos DB — technically inaccessible to other members

• Server-side JWT validation: no data is accessible without authentication

• Azure Functions proxy: no API keys are exposed client-side

• Encryption: data encrypted in transit (HTTPS/TLS) and at rest (Azure Cosmos DB)

• Consent trail: the date and author of parental consent are recorded and cannot be modified

For any questions regarding children's data:

SmartAILabs

Email: contact@mentalloadless.com

You may also file a complaint with:

• CNIL (France): www.cnil.fr

• FTC (USA/COPPA): www.ftc.gov