Privacy policy

0. Who is responsible for your data

The data controller is SH Conseil, sole trader (Shimon Mordehai Haliwa), 1 rue Marguerin, 75014 Paris, France (SIREN 108 902 396). For any question, or to exercise your rights: bonjour@teylio.com.

You may lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) if you believe your rights are not respected.

1. What we collect, and nothing else

Parent side: e-mail, password (hashed), country, language, consents; the payment method is held by the merchant of record, never by us.

Child side: nickname, code (hashed), birth year and month (to adapt the level), language, form of address, declared interests, what they would like to create, and the data produced in the workshop: messages (neutralised before any processing or storage), creations, completed steps, hints requested, proofs.

Never collected for pedagogical purposes: full name, full birth date, photo, voice, address, school, class, friends, location, health, religion, family situation, description of the child's character.

2. Why

To run the workshop and adapt it to the child (missions, hints, weekly report to the parent); to protect the child (filtering, crisis protocol); to meet our legal obligations. No advertising, no commercial profiling, no resale, no model training with children's data, neither by us nor by our subprocessors.

3. Neutralisation before processing

Every child message first goes through a deterministic local filter (phone numbers, e-mails, links, postal addresses, identity numbers, birth dates) before any model. The safety classifier receives this already-filtered text and spots the remaining contextual personal data (name, school, place, age); it is neutralised before the mentor, before the evaluator and before any storage. The raw text is destroyed as soon as the safety decision is made. Models receive a nickname, never an identity.

4. Retention

Transcripts: 90 days then deletion (structured session cards remain). Learner model, session cards, creations: while the account exists. Safety events: 12 months. Account deletion: effective within 30 days of the request, with an export offered first.

5. Your rights

From the parent space, at any time: see everything we know about the child (learner model, creations, transcripts, safety events), export (complete archive), correct settings, limit (duration, sessions per week, topics to avoid), revoke a share link, delete the account. Consent per child, versioned, renewed at any change of purpose; in France, joint child-parent consent under 15.

6. Subprocessors and transfers

The public list of subprocessors is kept up to date on the dedicated page. Data is hosted in the European Union. We ask our model providers for no content retention and no training; this guarantee will be confirmed contractually with the provider selected for production before access opens to families, and this page will be updated at that point.

7. Security and incidents

Encryption in transit and at rest, strict separation between the parent space, the child's workshop and the user-content origin, logging of every safety decision, internal access limited to one person in the current phase, every transcript read logged with a reason. If an incident affects your data, you are informed within 24 hours.

8. Contact

bonjour@teylio.com. You may also contact your country's data-protection authority.