Privacy Policy

AtyKids places particular importance on protecting data, all the more so for a project involving children. This policy explains what data we collect, why, on what legal basis, and what your rights are.

1. Data controller

Levis Global LLC, a company incorporated under the laws of the State of New Mexico (United States), entity number 0008023766, publisher of the Site (see the Legal notice).
Contact: contact@atykids.com

2. Data we collect

We apply strict minimization: we collect only what is necessary for each use. Depending on how you use AtyKids, this may concern the following categories.

a. Account and personal space

• Email address, and depending on your choices a display name, first name, last name, role (parent, teacher, teaching assistant, educator, professional, other), organization name (optional), an avatar (emoji), and your language.
• Sign-in: by email and password, or via "Sign in with Google". If you choose Google, it sends us your email address and basic profile information; we keep only your email address in our databases.

b. Subscription and payment

• Payments are made through Stripe Checkout. Our servers neither receive nor store full card numbers. We keep only a Stripe customer identifier, the status and plan of your subscription, and its renewal date.

c. Content you create

• Your exchanges with the assistants (the messages you write), your Studio creations, and your personal tracking of Atlas resources (status, next step, due date).
• My paperwork: the things you choose to keep track of. For each one, only what you write yourself: its name, where it stands (to do, waiting, done), a date to remember, a list of things to bring (labels, never files) and your notes. These exist so you stop rewriting the same things for every new organization and every new appointment.
• These are free-text fields: please do not share any health data or information directly identifying a child.

AtyKids is made to be used by the adults who support children. It does not ask you to create an account for a child, and it does not require a child's identity, a diagnosis or medical information.

When you use a free-text field, you may still choose to mention information about a child. We recommend sharing only what is useful for the situation. What you write is kept in your own space and, for the features that generate an answer or a support, sent to the technical provider needed to generate it.

My paperwork is not a medical record, not a disability file, not an official administrative file, and it is not used for any diagnosis. None of your conversations feed it, and its content is never sent to an assistant automatically: if you want to reuse it in a conversation, you pick the item, you tick what you want to carry over, you read the exact text, and you are the one who sends it. Nothing is sent to a school, an office or a professional. You can delete an item at any time; it then goes for good, together with its notes and its list.

d. Consents

• We keep a record of your acceptance of the Terms of Use and this Policy (document type, version, date), in order to prove that your agreement was obtained.

e. Referral program

• If you become a partner: your application (name, email, profile, country, website or social handle, audience size, message), your referral code, and your commissions (amounts, status, Stripe payment references). Partners' banking and identity-verification data are processed directly by Stripe (Stripe Connect) and are not kept by us.
• If you arrive via a referral link: an attribution link (connecting your account to the partner) is kept to calculate commissions. Referral click tracking contains no personal data (no IP address, no identifier).

e bis. The complimentary CANOPY ebook

• If your annual subscription opens a CANOPY book: the title chosen, its language, the dates the right was opened, confirmed and first downloaded, and the references of the invoice that opened the right.
• If you ask to receive that book before the end of your withdrawal period: the date of that request, the date of your acknowledgement that you lose the right of withdrawal for that book, the version of the wording you accepted and the language in which you read it. These serve to carry out your request and to establish that this consent was indeed obtained, as the regulation requires. They are processed on the basis of performance of the contract and compliance with a legal obligation.
• Nothing else is collected on that occasion: no IP address, no browser fingerprint, no data about the child, and no data about your reading of the book.

f. Public forms on the Site

Live enquiries (open forms)

• “Organizations and institutions” form. We process the information you provide in order to answer your request: your name, your email address, your organization, your role, your country or territory, the type of organization, the subject of the request, the context you describe and, if you provide it, the number of people concerned.
• “Request the investor deck” form. We process your name, your email address, your organization if you provide it, the profile you identify with, the market you were viewing when you sent the request, and the context you describe.
• In both cases the request is sent to the AtyKids team by email. It is not automatically recorded in the AtyKids account database, and this form does not automatically add you to any prospecting list. The message itself is of course kept in the team's mailbox.
• These two forms do not go through Netlify Forms. The page language and, for the investor request, the market you were viewing are sent along so that we answer in the right language and the right context.

Closed forms (answers retained)

• Printable sheet and questionnaire: collection closed. These two forms are no longer offered on the Site. Answers already collected remain subject to the retention period stated below, and you may request their deletion at any time.
• Your answers (respondent profile, context, needs, desired uses, level of trust, free-text message), which could be provided anonymously, and your email address if you asked to be contacted back.
• These forms were handled through our host Netlify (Netlify Forms), which automatically recorded technical data (IP address, user agent, referrer) for security and proper operation.

f bis. ATLAS listing application

• What we collect. Your first name, your last name, your professional email address and your link to the resource. These four are internal and are never published. Then the information you propose for the listing: public name, description, category, audiences, ages, languages, ways of working, website, optional public contact details, country and territory, scope, professional address only if you receive people on site, declared activity and regulatory status, claimed qualification. No coordinates are collected, and no document can be uploaded.
• Purpose. To review the application, to reply to you and, if it is accepted, to prepare and then, by a separate decision, publish an ATLAS listing. Legal basis: legitimate interest (art. 6(1)(f)) for the review and the reply, since you write to us of your own accord; and your express, separate authorisation for the publication of the fields shown as public.
• Recipients. The team responsible for AtyKids, in an internal register. No third-party recipient through this form. Internal notes and recorded checks are never shown publicly.
• Publication. Only the fields marked as public can be published, and only after acceptance AND putting the listing online. The published listing then states that the information was provided by you and reviewed by AtyKids on a given date. It is neither a recommendation nor a certification.
• Retention. Three years at most from the last contact coming from you, like the other public enquiries on the Site. A published ATLAS listing follows the directory's own life cycle: it is corrected, suspended or removed on request. No automatic purge exists: the rule applies through a human action.
• Your rights. You can ask at any time for your application to be corrected, withdrawn or deleted, and for the listing that came out of it to be removed, by writing to contact@atykids.com.
• No outreach. Sending this form subscribes you to no newsletter and adds your address to no prospecting list.

g. Technical data and analytics

• Connection data (including IP address) processed by our host for the security of the Site.
• Cookie-free analytics (Umami), which collect no personal data, and your display preferences kept in your browser's local storage (see section 8).

h. CANOPY bonus (digital book offered by SLOWO)

• When your first annual subscription opens the bonus, we record the existence of that entitlement, the title you chose, its language, the dates of grant, choice and first download, and the billing references needed to establish that the bonus is due. Nothing else is collected for this bonus: no child data, no reading data.
• The book is hosted and served by AtyKids's own infrastructure: no data about you is passed to SLOWO in order to deliver it.

AtyKids neither requests nor requires any health data and makes no diagnosis. Free-text fields (exchanges with the assistants, notes, support) must not be used to enter sensitive data or data identifying a child. If such information is nevertheless entered, it is processed as content you provide, solely to operate the relevant feature; we encourage you to avoid it and you can delete it.

If you contact us via our WhatsApp support number, we keep the content of your support messages, your phone number and technical message identifiers to handle your request. This channel is routed through our provider Twilio (WhatsApp Business Platform); it is human support, no automated system answers on our behalf.

3. Purposes and legal bases

• Providing and managing your account and personal space (assistants, Studio, Atlas tracking, My paperwork), basis: performance of the contract (art. 6(1)(b) GDPR).
• Managing subscriptions and payments, basis: performance of the contract (art. 6(1)(b)) and compliance with our accounting and tax obligations (art. 6(1)(c)).
• Granting and delivering the CANOPY digital book attached to the first annual subscription, basis: performance of the contract (art. 6(1)(b)): the bonus is part of the plan you subscribed to.
• Operating the referral program: performance of the contract (art. 6(1)(b)) for partners, and legitimate interest (art. 6(1)(f)) for the attribution needed to calculate commissions.
• Ensuring security, preventing abuse, and proper operation of the Site, basis: legitimate interest (art. 6(1)(f)).
• Understanding needs and prioritizing features, basis: legitimate interest (art. 6(1)(f)); analysis is carried out in an aggregated/anonymized way as much as possible.
• Responding to enquiries sent through the Organizations and institutions and Investors forms, and following up on those exchanges, basis: legitimate interest of Levis Global LLC in responding to the professional, institutional and strategic enquiries spontaneously addressed to it (art. 6(1)(f) GDPR). This basis covers neither a newsletter, nor general marketing follow-up, nor any prospecting unrelated to your enquiry.
• Contacting you, where you have consented, basis: your consent (art. 6(1)(a)), which you can withdraw at any time.
• Meeting our legal obligations, basis: legal obligation (art. 6(1)(c)).

4. Recipients and subprocessors

Your data is accessible to the team responsible for AtyKids (Levis Global LLC). We use the following subprocessors, each for a specific purpose:

• Supabase, Inc.: database, account management, and authentication (personal space, assistants, Studio, Atlas, My paperwork).
• Netlify, Inc.: site hosting. Collection through Netlify Forms only concerns the closed forms described above; the public forms currently open do not go through it.
• Stripe, Inc.: processing subscription payments and, for partners, paying out commissions (Stripe Connect).
• Google Ireland Ltd. / Google LLC: "Sign in with Google" (OAuth authentication), for people who choose this sign-in method. Google acts as a separate data controller for its own authentication service.
• Zoho Corporation: sending notification and confirmation emails related to the forms (SMTP service).
• Resend (Plus Six, Inc.): sending the emails related to your account and its follow-up (a welcome message, for example), and receiving the matching delivery and unsubscribe information.
• Anthropic, PBC: technical service provider processing the conversation content needed to generate the assistants' responses, on our behalf.
• Twilio Inc.: routing of WhatsApp support (WhatsApp Business Platform), for people who contact us through that channel.

We do not sell or rent your data.

5. Transfers outside the European Union

Several of our subprocessors (notably Netlify, Stripe, Google, Zoho, Anthropic and Twilio, as well as, depending on the hosting region, Supabase) are established in the United States: your data may therefore be processed outside the EU. These transfers are framed by appropriate safeguards (European Commission standard contractual clauses and/or the EU-US Data Privacy Framework).

6. Retention period

• Account and associated data (profile, created content, exchanges with the assistants, Studio creations, Atlas tracking, My paperwork items, CANOPY bonus and the book you chose): kept for as long as your account exists, then deleted when the account is deleted, subject to the legal obligations below.
• Billing and commissions: kept for the period required by applicable accounting and tax obligations.
• Proof of consent (legal acceptances): kept for as long as necessary to prove compliance with our obligations.
• Questionnaire answers (collection closed): kept for a maximum of 24 months, then deleted or anonymized.
• Organizations and Investors enquiries and the related exchanges: kept for as long as needed to handle them, then for a maximum of three years from the last contact coming from you. If a contractual relationship is then established, or if a legal obligation requires a different retention, the data concerned follows the period applicable to that new purpose.
• Email address (follow-up): until your deletion or unsubscribe request.

7. Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection, and portability, as well as the right to withdraw your consent at any time. From your personal space, you can also export your data and delete your account.

To exercise your rights: contact@atykids.com.

You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

8. Cookies and local storage

The Site uses no advertising cookies and does not follow you across other sites. It stores, in your browser's local storage, your display and reading preferences (theme, text size, etc.), strictly necessary for operation and kept on your device. Three cookies may be stored, the ones described below, and only if you accept them.

We use Umami, a cookie-free analytics tool: no personal data is collected, and no consent is required. These analytics cover the public site only: none are loaded in your private space. We also send Umami, from our servers, the crossing of a few milestones (account created, first use, subscription), as anonymous counters: those sends carry no identifier, no address, no content, and cannot be linked back to anyone.

Recommendation attribution cookie (atk_ref)

• When: only if you arrive through a recommendation link (atykids.com/r/CODE) and you accept it. We ask you there and then. Until you accept, nothing is stored on your device: the code only travels in the page address, for the time of your decision.
• Purpose: to know who recommended AtyKids, so that this person receives their commission if you subscribe. That is a commercial purpose, not a "strictly necessary" cookie, which is why your agreement is asked for first.
• Lifetime: 90 days.
• Content: the recommender's code alone. No data about you, no data about a child, no IP address, no browser fingerprint.
• If you decline: no cookie is stored, no refusal is recorded, and you carry on browsing as usual. No attribution is rebuilt later.
• First attachment kept: if a recommendation has already been accepted, a second one does not replace it.
• If you then create an account: the attachment is recorded once with that account, and the cookie stops being the reference. Any commission is visible to the partner, who never sees your identity.
• The full program rules are in the Recommend program terms.

Campaign origin cookie (atk_utm)

• When: only if you arrive through a campaign link (an address carrying utm_source) and you accept it. We ask you there and then. Until you accept, nothing lasting is stored on your device: the labels travel in the page address and, at most, in the tab's session memory, which is cleared when you close it.
• Purpose: to know which partners, publications or channels make AtyKids known, and which of them bring people who actually use it. That is a commercial purpose, not a "strictly necessary" cookie, which is why your agreement is asked for first.
• Lifetime: 90 days.
• Content: only the campaign labels present in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), normalized and capped at 64 characters each. No data about you, no data about a child, no IP address, no browser fingerprint. We do not follow you on any other site.
• If you decline: no cookie is stored, no refusal is recorded, and you carry on browsing as usual. No origin is rebuilt later.
• First origin kept: the campaign that made you discover AtyKids is never replaced. A later visit only updates the most recent known origin.
• If you then create an account: those labels are recorded once with that account, and the cookie stops being the reference. They serve our internal acquisition statistics only and are passed to no advertiser.
• "Do Not Track": if your browser announces it, you are not asked and nothing is recorded.

Visit-counting cookie (atk_vid)

• When: only if you accept audience measurement. Until you give that explicit consent, nothing is stored on your device for this purpose. This consent is separate from Umami's cookie-free measurement.
• Purpose: to count public-site visits without over-counting them, so we can measure an audience of distinct visitors. It is a durable identifier: a measurement purpose, not a "strictly necessary" cookie, which is why your consent is asked first.
• Duration: 90 days.
• Content: a random identifier specific to your browser. On the server we keep only a fingerprint (a hash) tied to the visit date. No data about you, no child data, no IP address, no browser fingerprint.
• If you refuse or withdraw this consent: no cookie is stored, and an existing identifier is deleted. "Do Not Track": if your browser announces it, nothing is stored and any existing identifier is erased.

9. Security

We implement reasonable technical and organizational measures to protect your data against unauthorized access, alteration, or disclosure.

10. Data concerning children

AtyKids is intended for adults (parents, relatives, professionals). Our forms and free-text fields must not be used to transmit identifying or health data about a child.

11. Les Voix AtyKids (closed forms)

The two "Les Voix AtyKids" forms are no longer offered on the Site. This section describes the data that may have been collected while they were, and stays here for as long as that data may exist. The consents collected then were separate and did not constitute registration for any other processing. To request deletion of that data: contact@atykids.com.

A. "Be notified of the launch" form

• Data: email address; profile (optional); technical data strictly necessary for the form to work (including an anti-spam field).
• Purpose: to inform you of the launch and new episodes of Les Voix AtyKids.
• Legal basis: your explicit consent (art. 6(1)(a)).
• Retention: until you withdraw your consent or unsubscribe; contacts that become inactive are reviewed and deleted according to the general AtyKids policy.

B. "Propose your voice" form

• Data: first name or nickname; email address; general role; desired format; most comfortable mode of expression (optional); general topics; necessary technical data.
• Purpose: to review a participation proposal and contact you about the Les Voix AtyKids project.
• Legal basis: your explicit consent (art. 6(1)(a)).
• Retention: twelve months after the last exchange when no participation is undertaken; any longer retention is justified or subject to a new agreement.

Clarifications:

• a proposal does not constitute authorization to record or broadcast;
• a separate consent will be requested before any public production;
• this form requests no medical data and no data directly identifying a child;
• you may request access, rectification, or deletion of your data at contact@atykids.com.

Collection and email delivery rely on the same subprocessors (Netlify, Zoho) and the same framing of transfers outside the EU as the rest of the Site (see sections 4 and 5). This section does not constitute a complete legal validation of the future component dedicated to minors' voices, which will be framed separately before any opening.

12. Google Calendar (optional connection)

Team members who follow relationships with schools and partners can connect their Google Calendar to AtyKids. This connection is optional: it is requested from the account settings, and it is switched off in the same place. No calendar is connected without that step.

When you connect, Google shows the permission being requested: see, create, change and delete events on calendars you own. That is the https://www.googleapis.com/auth/calendar.events.owned permission, and that is what it allows.

What AtyKids actually does with it is narrower, and this is the full list: create an appointment attached to a sales opportunity, change its date and time, re-read that exact event when someone asks for it, and notice that it has been deleted in Google. In the product as it stands today:

• we do not copy your personal calendar into AtyKids;
• we do not watch your calendar in the background: we read it only when someone asks for it from the screen;
• we do not add any guest and do not send any invitation automatically.

We draw that distinction on purpose: the permission granted is broader than the use we make of it. It is the product's behavior that limits it, and we do not claim that the permission itself would technically prevent broader access.

What we write into the Google event. Only the name of the organization, in a title of the form "AtyKids x Organization name", the date, the start and end time, and, if the person typed one, a short professional context sentence they wrote themselves. A calendar event is read on a phone, on a watch, and gets shared by mistake, so we copy into it none of the following: Deal Desk commercial terms, internal notes on an opportunity, information about a child or a family, or a support observation.

What we keep on our side. The address of the connected Google account, so we know whose connection it is; the identifier of the event created in Google; the appointment's title, date, time, time zone and status; the synchronisation dates; and the references needed to keep the connection working.

Security and disconnection. The credentials issued by Google are not kept in clear text: they are encrypted at rest by the platform's secret storage, and the connection record only holds a reference to them. Disconnecting from the account settings deletes those secrets, and AtyKids can no longer talk to your calendar. No security measure is absolute, and we do not claim otherwise.

Disconnecting, however, does not erase the appointments already recorded in the sales follow-up: they are part of the history of the professional relationship and follow the retention periods described in section 6.

Google as a third party. This optional integration goes through Google Ireland Ltd. / Google LLC, already named in sections 4 and 5, whose privacy policy is available at policies.google.com/privacy.

13. Changes

This policy may change; the update date shown at the top of the page prevails.

14. Contact

For any question about your data: contact@atykids.com.