Privacy Policy

We collect the following data:

• Identification data: email address, display name (via Azure Entra External ID)

• Family data: family members, dietary preferences, allergies, diets

• Usage data: shopping lists, calendar events, homework, household chores, food inventory

• Private space data: private tasks, notes, wellbeing tracking (accessible only by the user concerned)

• Technical data: device identifiers for push notifications, authentication tokens

• AI data: conversation history with the Coco assistant, memorized preferences

Your data is used to:

• Provide the Application's features (family management, shopping, calendar, etc.)

• Personalize the AI assistant Coco's suggestions

• Send push notifications (reminders, alerts)

• Manage your Premium or Coco+ subscription

• Improve the Application and fix bugs

Data processing is based on:

• Contract performance: providing the Application's service

• Consent: collected at first launch for AI processing and notifications

• Legitimate interest: service improvement, security

Your data is hosted and processed by:

• Microsoft Azure (Cosmos DB, Azure Functions) — France Central region (Europe)

• Azure OpenAI Service (GPT-4o) — France Central

• Azure Speech Services (Whisper STT, TTS Neural) — West Europe

• Azure Entra External ID — Authentication

• RevenueCat — In-app subscription management

All AI data is processed in Europe (France Central and West Europe), in compliance with GDPR.

Your data is retained as long as your account is active. If your account is deleted, all your data will be permanently removed from our servers within 30 days.

Under the GDPR, you have the following rights:

• Access: obtain a copy of your data

• Rectification: correct inaccurate data

• Deletion: delete your account and all your data (available in the Application)

• Portability: receive your data in a structured format

• Objection: object to certain processing

• Restriction: request restriction of processing

To exercise your rights, contact us at: contact@mentalloadless.com

We implement appropriate technical and organizational measures:

• Encryption of data in transit (HTTPS/TLS) and at rest

• Secure authentication via OAuth2 PKCE (Azure Entra)

• API keys stored server-side only (never in the application)

• Rate limiting on APIs (20 requests/minute per user)

• Private space data partitioned by user

For any questions regarding this policy:

SmartAILabs

Email: contact@mentalloadless.com

You may also file a complaint with the CNIL (French Data Protection Authority) or your local data protection authority.

The application allows adding minor children's profiles. Explicit parental consent is collected and recorded before each addition.

For more information about the collection and processing of minors' data, see our dedicated policy: mentalloadless.com/en/children-privacy