Privacy Policy — Kiddly
Version 1.3 — 25/09/2026 (legal review in progress) — Translation; in case of discrepancy, the French version prevails. Data controller: Kiddly, trade name of Krapul SRL (company under formation, represented by Len Malrain), Rozenstraat 13, 1650 Beersel, Belgium — company number: pending · privacy@thekiddly.app. Until the company is incorporated, Len Malrain personally assumes the obligations of the data controller.
This policy explains, without jargon, what data Kiddly processes, why, for how long, with whom, and how to exercise your rights. It matches our record of processing activities point by point.
1. In short
- Kiddly is a family application hosted in the European Union (Paris). No data is sold; no advertising; no profiling.
- Some data is necessary to create and operate your account. Other data and features are optional and are only processed when you choose to use them or, where the law requires it, when you give your consent (health, location, notifications, Lending & Donations) — a consent separate from these terms, versioned, time-stamped, and withdrawable as easily as it was given.
- Kiddly makes no decision producing legal effects or significantly affecting you based solely on automated processing.
- You can export all your data and delete your account from the application (Profile → Privacy).
2. What data, for what, on what basis
| What you do | Data | Why | Legal basis | Retention |
|---|---|---|---|---|
| Create an account and a family | email, first/last name, language, avatar, phone (if Lending & Donations), family members (name, relationship, sex, date of birth), pregnancy | provide the service | contract (art. 6.1.b); children's data is entered by a parent holding parental authority (see §2 bis) | until you delete the account or the data; in case of inactivity, according to the chosen duration (§3) |
| Health tracking | vaccines, related documents, milestones, growth, allergies, diets, appointments, pregnancy | reminders and family health record | explicit consent (art. 9.2.a), separate from the other consents, withdrawable as simply as it is given; if one of the parents withdraws it, the health module is disabled for the whole family and Kiddly stops using this data (no more reminders); data already recorded is kept, without processing, until you erase it yourself, request its erasure at privacy@thekiddly.app or remove the account | same |
| Calendar, tasks, meals, groceries, Baby Gear | events, administrative tasks, meal plans, lists, owned items (photo, condition, child) | family organization | contract | same |
| Receive notifications | notification tokens of your device, content and status of the notifications | reminders and service events | contract; your device's permission for push | tokens: life of the account; notifications: 12 months |
| Order a printed album | order, delivery address, amount, payment identifier, album photos | production, delivery, accounting | contract; legal obligation for accounting | 7 years (Belgian accounting obligation), including after account deletion, detached from your account identity |
| Complaint about an order | messages exchanged with the team, internal note | handle the dispute | contract, then legitimate interest: follow-up of requests and establishment, exercise or defense of rights | 7 years, aligned with the order |
| Lending & Donations | listings (photos, description, postal code, municipality), requests, good-faith contract, signatures | free connection between families | specific consent for the module (versioned, withdrawable) | see §4 |
| Lending & Donations — contact | email and phone of the signing parent | arrange the handover with the other family | specific consent (v1.2) | visible during the exchange only, never kept in the contract |
| Report / block | report (reason, details), block, moderation measures | safety of exchanges and children | legitimate interest: service safety, abuse prevention, handling of reports, defense of the parties' rights | reports: 24 months after closure; blocks: until unblocked |
| Share your calendar (ICS) | sharing token, exposed events | subscription from a third-party calendar | contract, voluntary activation | until revoked |
| Nearby activities and services | position at the time of the search (never stored), places you save | suggest local activities and services | consent (location permission), withdrawable | places: until deleted by you or with the account |
| Proof of your consents | timestamp, version, IP address, browser/device | demonstrate your consent (art. 7.1) | legal obligation | until account deletion (see §6) |
2 bis. Data about other people (children, co-parent, contacts)
Kiddly receives most data not from the person concerned but from a parent who enters it: their children, the other parent before they join the family, contacts (doctor, daycare, relatives) in the calendar or the health record.
- Children: data is entered and controlled by a parent holding parental authority, who exercises the child's rights on their behalf. Any parent who is a member of the family has access to it and can correct or delete it.
- Other parent: when they join the family with the invitation code, they are informed by this policy of the data already entered about them and acquire the same rights over the family's data (managing members and roles remains reserved for the administrator and owner roles). In the event of a disagreement between parents (separation, removal of a member, dispute over a change), write to us at privacy@thekiddly.app: we apply an internal procedure for handling these requests.
- Contacts and third parties: their details are used solely for your family organization; they are never shared. You are responsible for having the right to record them. Where the data concerns contacts or third parties who are not Kiddly users, Kiddly does not contact them directly. Where individually informing these people proves impossible or would involve a disproportionate effort, Kiddly applies the exception provided for in article 14.5.b of the GDPR and makes this information publicly available to them; they can exercise their rights at privacy@thekiddly.app.
3. Inactive accounts
If you no longer use Kiddly for the duration you have chosen (180 or 365 days), we warn you 14 then 7 days in advance, by notification, email and in the application; without a new sign-in, the account and its data are deleted, except for the legal retention obligations (§2, orders).
4. Lending & Donations: who sees what
- All signed-in users see: your listings, their photos, your postal code and your municipality. Never your address, never a GPS position.
- The family with whom a request is accepted additionally sees: your family name, your first name, your email and your phone number — and you see theirs. These details remain visible until the end of the ongoing exchange, including if one family blocks the other in the meantime, then are no longer accessible.
- No one else sees your profile or your family's data.
- Good-faith contract: it keeps the family name and the first name of both parties. Twelve months after the end of an exchange, it is anonymized. If an exchange ended without confirmation or was the subject of a report, these identities are kept for up to 24 months after the end of the exchange, even in case of account deletion, to allow the defense of rights in the event of a dispute (art. 17.3.e), then anonymized automatically.
- Inactive items: a listing with no activity for 60 days is deactivated; its photos are deleted after 12 months of inactivity.
- Moderation: in the event of a report, the Kiddly team may view the listing or exchange concerned, send a reminder of the rules, hide a listing or suspend a family's access to the module. You are informed in the application, as well as of the lifting of the measure. The author of a report is never revealed. Contestation: support@thekiddly.app.
4 bis. Your photos: where, who, how long
| Photos | Who sees them | Storage | Duration |
|---|---|---|---|
| Avatars and family memories | your family | private, temporary links | until deletion |
| Baby Gear (items) | your family | private, temporary links (1 h) | until the item or the account is removed |
| Printed albums | your family; the printing provider for production | private; print file transmitted to Gelato | 7 years for the order; print file kept by Gelato for the duration of production then deleted according to its processing terms |
| Lending & Donations listings | all signed-in users | public for signed-in users | until the listing is withdrawn; deleted after 12 months of inactivity |
| Thumbnails and technical backups follow the original data. The team only accesses photos for support or for the moderation of a reported listing. |
5. With whom your data is shared (processors)
We only share your data with providers that process it on our behalf, under contract:
| Provider | Role | Data | Where |
|---|---|---|---|
| Supabase | hosting, database, storage, functions | all | European Union (Paris) |
| Google Firebase Cloud Messaging (Google LLC) | sending push notifications | your device's token, title and body of the notifications | United States — see §5 bis |
| Resend | sending transactional emails | your email, email content | European Union (Ireland, eu-west-1) |
| Stripe | album payments | payment data, amount | European Union (Stripe Payments Europe); possible transfers to Stripe Inc. — see §5 bis |
| Gelato (Gelato AS, Norway) | printing and delivery of the albums | delivery address, print files | Norway (EEA); printing by a partner printer close to the delivery address, as a general rule in the European Union for Belgium |
| OpenStreetMap / Nominatim | geocoding of the addresses you enter | entered address | European Union |
No data is transmitted to advertisers or to data brokers.
5 bis. Transfers outside the European Economic Area
Your data is hosted and processed in the European Union. Some providers may however process a limited part of the data outside the EEA:
| Provider | Country | Data | Legal mechanism |
|---|---|---|---|
| Google LLC (Firebase Cloud Messaging) | United States | device token, notification content | Chapter V GDPR safeguards: adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses of the European Commission, depending on the provider's current certification |
| Stripe Inc. | United States (the contract is concluded with Stripe Payments Europe Ltd, Ireland) | payment data | same |
| Resend | European Union (Ireland) — no transfer | email, email content | — |
| Gelato | Norway (EEA, adequate country); printers as a general rule in the European Union for Belgium | address, print files | standard contractual clauses if a printer outside the EEA were to be involved |
| You can obtain a copy of the applicable safeguards by writing to privacy@thekiddly.app. |
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw a consent at any time (without effect on past processing).
- In the application: Profile → Privacy → Export my data (complete file, including your consents) and Delete my account.
- Withdrawals: the health, location, notifications and Lending & Donations consents can be withdrawn from the Profile or the module's settings; push notifications can also be disabled in your phone's settings.
- By email: privacy@thekiddly.app. We reply within one month.
- Deletion: your account and strictly personal data are erased. The following are kept, detached from your account identity: print orders and their complaints (7 years, accounting obligation) and, where applicable, the contractual identity of an unconfirmed or reported exchange (up to 24 months, see §4). If a loan is physically in progress, the deletion is carried out after the return of the item; the application tells you so at the time of the request.
- Complaint: Data Protection Authority, rue de la Presse 35, 1000 Brussels — autoriteprotectiondonnees.be.
7. Security
Data encrypted in transit (TLS) and at rest; access partitioned by family at the database level; Baby Gear photos in private storage accessible via temporary links; team access limited to support and moderation operations, server-side only. Report any incident to privacy@thekiddly.app.
8. Children
Kiddly is intended for adults. Data about your children is entered and controlled by you, under your parental responsibility. Do not publish any photo of a child in a Lending & Donations listing.
9. Changes
We update this policy when our processing changes; the date and the version appear at the top, and the history is available on thekiddly.app. A substantial change is notified to you in the application; where a consent is concerned, it is requested again.
10. Contact
Krapul SRL (under formation) — Rozenstraat 13, 1650 Beersel — privacy@thekiddly.app (data) · support@thekiddly.app (help, moderation) · legal@thekiddly.app (terms).