Privacy policy

Last updated: 28/07/2026

This policy explains what data we collect, why, how long we keep it and what your rights are. As Smallprof is aimed at children, we pay particular attention to protecting their data, in accordance with the General Data Protection Regulation (GDPR).

1. Data controller

The data controller is the site publisher: Caroline DANIEL, sole trader (micro-entreprise), 4 Rue de l'Industrie, 74160 Saint-Julien-en-Genevois, France — info@smallprof.com.

Data Protection Officer (DPO): no DPO appointed (not required given the nature and volume of the processing). For any question about your data, contact info@smallprof.com.

2. Parental consent

The account is created by an adult legal guardian of the child. By ticking the box provided during registration ("I am the legal guardian and accept the terms"), you give your informed consent to the processing of your child's or children's data for the purposes described below. You can withdraw this consent at any time by deleting the relevant profile or the family account.

3. Data collected

About the parent (account holder)

Family name / account name and family nickname;
Country declared by the family (no automatic geolocation);
Email address (login identifier);
Password (stored encrypted / hashed, never in plain text);
Subscription and payment data managed by Stripe (we do not store the full card number).

About the child

First name (or a pseudonym chosen by the parent);
Year of birth / age (to adapt the level);
Game language;
Login PIN code (stored as a hash, never in plain text);
Educational progress data: answers, scores, skills practised, levels, rewards.

We do not require the child's full name and encourage you to use a first name or a pseudonym.

If the parent enables the public leaderboard, the following information may be displayed: the child's nickname, avatar, declared-country flag, age bracket, XP or weekly score, streak and, for the family leaderboard, family nickname and total XP. This option is off by default and can be withdrawn at any time in the parent area; the data then ceases to appear on the leaderboard.

4. Purposes of processing

Provide the educational service and adapt the difficulty to the child's level;
Allow the parent to track progress;
Manage the account, subscription and billing;
Ensure the security and proper functioning of the service;
Measure audience in an aggregated and anonymised way (visit statistics);
Display the profile on the public leaderboard only when the parent enables this option.

We never use children's data for advertising purposes and do not resell it to any third party.

5. Legal basis

Processing is based on the performance of the contract (provision of the service), the legal guardian's consent (child data and the optional public leaderboard) and legitimate interest (security, aggregated statistics). Billing is based on a legal obligation to retain accounting records. The parent controls leaderboard activation and must inform and involve the child in this choice according to their age and maturity.

6. Retention periods

Account and progress data: kept as long as the account is active. If the account is deleted, they are erased within 30 days.
Billing documents: kept in accordance with legal accounting obligations, i.e. 10 years.
Technical and security logs: kept only for as long as necessary for security, incident prevention and the establishment, exercise or defence of legal claims, then deleted or anonymised.
Public leaderboard: withdrawing the option ends the public display of the relevant data.

7. Recipients and processors

The data is only accessible to authorised staff of the publisher. We use the following processors, which provide compliance guarantees:

OVH — data hosting (European Union);
Stripe — payment processing and only the parent/payment data required for it;
Emails (welcome, weekly summary) are sent via our host OVH's mail infrastructure; no third-party emailing provider has access to the data.

Data is neither sold nor used for advertising. No child data is sent to a third-party artificial intelligence model.

8. Your rights

In accordance with the GDPR, you have the following rights, for yourself and for your child:

Right of access to the data;
Right to rectification of inaccurate data;
Right to erasure ("right to be forgotten");
Right to restriction and right to object to processing;
Right to portability of your data.

Right to erasure: you can delete a child profile or the entire family account directly from the parent area. Deleting the family account cascades to erase the parent account, the child profiles and all associated progress data.

To exercise your rights or for any question, contact: info@smallprof.com. You may also lodge a complaint with the competent supervisory authority; in France this is the CNIL (www.cnil.fr).

9. Security

We implement technical and organisational measures to protect the data: password encryption, restricted access, hosting within the European Union, protection against unauthorised access. As no system is infallible, we undertake to inform you in the event of a data breach likely to create a risk to your rights.

10. Cookies

The site only uses technical cookies necessary for its operation (session, language preference). For more details, see our cookie policy.

11. Changes

This policy may be updated. Any substantial change will be brought to your attention. The date of the last update appears at the top of this page.