Privacy Policy

Who we are

Kidilab is run by Adrien Martin, a sole proprietor based in France (20 allée Alexandra David Neel, 33300 Bordeaux, France). This policy explains what personal information we collect on our English-language pages, why, and your choices. Privacy questions: privacy@kidilab.com.

Information you give us

Our website is made for parents and other adults who create a scavenger hunt for a child. When you create a hunt, you give us:

• the first names of the children being celebrated, and optionally of guests;
• the age group, theme, activities and hiding spots, including custom hiding spot names;
• a map of your home or yard: an image you upload, or a map view you pick by searching a location;
• party details printed on the invitations: place, date, times, RSVP date, and a contact name and phone number or email;
• your email address, to send your download link (and any other address you enter on the download page to receive it);
• your time zone, detected by your browser, to check the party date.

If you contact us, we receive your name, email and message. Stripe, our payment provider, collects your card details directly; we never see your full card number.

Information collected automatically

• Our own audience measurement: a cookie (kdl_vid, 390 days) and a record of pages visited, form steps reached, approximate country, device type and traffic source, not linked to your name, email or order.
• Traffic source: a cookie (kdl_acq, 90 days) that remembers how you first found us, such as an ad or a search.
• Site testing: a cookie (kdl_xp, 390 days) used to show versions of some pages. US orders are not included in test results.
• Session recording (Microsoft Clarity): records clicks, scrolling and pages viewed, to help us improve the website. Clarity sets cookies, receives the addresses of the pages you visit, and Microsoft may also use this data under its own privacy statement. It loads without prior consent. Typed text is masked, but text shown on the page, which may include a child’s first name, can appear in recordings.
• Google Tag Manager and Google Analytics: load on every page in Google’s consent mode. Until you accept them in our cookie banner, they run with advertising and analytics storage turned off and send Google limited signals without cookies; once you accept, they use cookies. Through Google Tag Manager, this includes Google Ads conversion tracking.
• Pinterest: loads only if you accept it in our cookie banner.
• Google ad clicks: if you arrive from a Google ad and then buy, our server tells Google that a purchase happened, with the ad click identifier, an internal order identifier, the time of the purchase and the order value (converted to euros), even if you declined cookies. No name, email or child information is sent.
• Vercel Web Analytics: page-view counts without cookies.
• Our hosting providers process your IP address and browser information to deliver and protect the website.

How we use information

• to create, generate and deliver your kit, and let you download it again;
• to send service emails about your order (we do not send marketing emails to US customers);
• to answer your messages;
• to process payments and keep accounting records;
• to improve our website and measure our ads;
• to prevent fraud and abuse, and meet legal obligations.

We do not sell your personal information for money.

Children’s information

Kidilab is a general-audience website for parents and other adults. It is not directed to children, and children should not use it. We collect children’s first names and age group only from the parent or adult who creates the hunt, to personalize the kit. By entering this information, you confirm that you are the child’s parent or legal guardian, or that you have the parent’s permission to share it. The same applies to guests’ first names.

We do not knowingly collect personal information online from children under 13. If we learn that we have, we will delete it. If you believe a child has sent us information, contact privacy@kidilab.com. We never use children’s information for advertising, and we never send it to Stripe or to advertising partners. It is stored by our hosting providers (Vercel, Supabase), sent by Resend in your order emails (which include first names and a link to download your kit), and may appear in session recordings (Microsoft Clarity).

How we share information

We share information only with service providers who help us run Kidilab:

• Vercel: website hosting
• Supabase: database and file storage
• Stripe: payments (receives your email, an order number and internal identifiers; Stripe collects your card and billing details itself)
• Resend: order emails, which include your children’s first names and a link to download your kit
• Mapbox: map display and search
• Microsoft Clarity: session recording
• Google and Pinterest: as described above
• Slack: internal notifications about drafts, unpaid and paid hunts, with your email, theme, age group, price, traffic source, device type and approximate country, but no child names; technical error alerts may also be sent

We may also disclose information when the law requires it, or to protect our rights or others’ safety.

Do Not Track and Global Privacy Control

Our website does not currently respond to Do Not Track or Global Privacy Control signals. You can refuse Google cookies and Pinterest in our cookie banner at any time (this does not stop Google’s cookieless signals or the purchase report to Google described above). You can turn off Clarity session recording and our own visit measurement for this browser at any time with the button below.

How long we keep information

• The personalization of a paid hunt (names, age group, content, hiding spots, invitation details and home map) is deleted 24 months after the party date, or after payment if there is no party date.
• Unpaid hunts and drafts are deleted 24 months after the party date, or after creation if there is no party date.
• A buyer’s email address is deleted from our own database 24 months after their last purchase. Copies held by our service providers follow their own retention periods.
• Order records without personalization (date, amount, product, traffic source) are kept for 10 years, as required by French accounting law.
• Browsing data from our own measurement is kept for 25 months.

Security

We use reputable providers and encrypted connections, and we limit access to our systems to authorized people and service providers who need it. No system is perfectly secure. Map images you upload, and map views you capture by searching a location, are stored at unlisted links: anyone who has the exact link can open the image, so do not use anything you would not want to share.

International transfers

Kidilab is based in France, so the EU General Data Protection Regulation (GDPR) applies to how we handle your information, wherever you live. Your information is processed in France, elsewhere in the European Union and in the United States, where some of our providers operate. When a provider processes personal information outside the European Union, we rely on the EU-U.S. Data Privacy Framework if the provider is certified under it, or on the European Commission’s standard contractual clauses.

Legal bases (GDPR)

We process your information to perform our contract with you (creating, delivering and supporting your kit), to meet legal obligations (accounting and tax), on the basis of our legitimate interests (securing and improving our website, measuring our own audience, recording sessions with Microsoft Clarity, preventing fraud), and on the basis of your consent (Google cookies and the Pinterest tag). You can withdraw your consent at any time in our cookie banner. You can also complain to the French data protection authority, the CNIL (www.cnil.fr).

Your rights

Wherever you live in the United States, you can ask us to: access your personal information and get a copy in a portable format; correct it; delete it; and opt out of the sale or sharing of your personal information and of targeted advertising. Under the GDPR, you can also object to or ask us to restrict some uses.

To make a request, email privacy@kidilab.com (ideally from the email address used for your order), use our contact page, or write to us at the address below. We will verify your identity, usually by checking that the request comes from the email address used for your order. You may use an authorized agent; we may ask for proof of their authorization. We will answer within 30 days; if we need more time, as the law allows, we will tell you why. We will not treat you differently for using your rights.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing privacy@kidilab.com with “Appeal” in the subject line. We will answer within 45 days and explain our decision. If you are not satisfied, you can contact your state Attorney General.

Nevada residents: we do not sell personal information as defined by Nevada law. You can still send an opt-out request to privacy@kidilab.com.

Changes to this policy

We may update this policy. The date at the top shows the latest version. For significant changes, we will post a notice on our website.

Contact

Privacy: privacy@kidilab.com

General questions: contact@kidilab.com or our contact page

Mail: Kidilab, 20 allée Alexandra David Neel, 33300 Bordeaux, France