Privacy Policy

1. Who is responsible for your data

Adrien Martin, sole trader (Kidilab), 20 allée Alexandra David Neel, 33300 Bordeaux, France, is the controller of your personal data. Kidilab is based in France, so the EU General Data Protection Regulation (EU GDPR) applies; because we sell our kits to people in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 also apply. This policy tells you, as required by Articles 13 and 14 of these regulations, what data we collect on the UK pages of our website, why we collect it and what your rights are. Questions about your data: privacy@kidilab.com.

2. Data you give us

The website is made for parents and other adults who prepare a treasure hunt for a child. When you create a treasure hunt, you give us:

• the names of the children you are preparing the treasure hunt for, with, for each child, whether they are a girl or a boy, and, if you enter them, the names of the guests;
• the age group, the theme, the activities and the hiding places, including those you write yourself;
• a map of your home or garden: an image you upload, or a view you pick by searching for an address;
• the party details printed on the invitations: venue, date, times, reply-by date, a name and a phone number or email address;
• your email address, to send you the order confirmation and the download link for your kit;
• your time zone, detected by your browser, to check the party date.

If you write to us, we receive your name, your email address and your message. Your card details are collected directly by Stripe, our payment provider: we never see your full card number. If you pay with PayPal, you sign in to PayPal, not to Kidilab.

3. Data collected automatically

• Kidilab’s own visit measurement: a cookie (kdl_vid, up to 13 months) and a record of the pages viewed, the time spent, the steps of the form reached, where the visit came from, the type of device and the country, without your IP address or email address and without any link to your orders.
• Source of the visit: a cookie (kdl_acq, 90 days) that remembers where your first visit came from, for example an advert or a search engine. It is also used to link orders to our campaigns.
• Microsoft Clarity: heatmaps and recordings of how visitors move around the website, to understand where they hesitate. What you type in form fields is masked, but the text shown on the page (which may include a child’s name) can be seen in the recordings. Details in our Cookie Policy.
• Google Analytics and Google Tag Manager: load on every page in Google’s consent mode. Until you accept them, they run without cookies and send Google only limited signals; they only set cookies with your consent, which you can give, refuse or change at any time with the ‘Manage cookies’ link at the bottom of every page.
• PostHog: pages viewed, time spent, where the visit came from, type of device, operating system, language, country and market, linked to a random identifier for your browser and to the characteristics of its first visit (source, market, device, landing page), to understand the journey through to an order. Hosted in the European Union; does not receive your IP address, your name, your email address or anything you type. Details in our Cookie Policy.
• Pinterest: loads only with your consent.
• Vercel Web Analytics: counts page views across the website, without cookies.
• Our hosting providers process your IP address and browser information to run and protect the website (legitimate interests, Article 6(1)(f) UK GDPR).

You can object to Kidilab’s own visit measurement, to Microsoft Clarity and to PostHog in this browser at any time, with the button below.

4. What we use your data for

• to create your kit, deliver it and let you download it again (performance of a contract, Article 6(1)(b) UK GDPR);
• to send you the emails about your order, such as the confirmation and the download link (performance of a contract, Article 6(1)(b) UK GDPR); we do not send you newsletters or marketing emails;
• to reply to your messages (legitimate interests, Article 6(1)(f) UK GDPR);
• to process payments (performance of a contract, Article 6(1)(b) UK GDPR) and keep our accounts as French accounting law requires (legal obligation under the EU GDPR; under the UK GDPR, our legitimate interests in meeting that obligation, Article 6(1)(f));
• to measure visits, improve the website and measure how well our adverts work (legitimate interests, Article 6(1)(f) UK GDPR; consent for cookies that are not strictly necessary, Article 6(1)(a) UK GDPR);
• to prevent fraud and misuse (legitimate interests, Article 6(1)(f) UK GDPR).

We never sell your data. Without the details of the treasure hunt (the children’s names, the age group, the theme, the activities, the hiding places and the map), we cannot create your kit; the guests’ names and the party details for the invitations are optional. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (Articles 22A to 22D UK GDPR).

5. Children’s data

The website is made for the parents and adults who organise the party, not for children. We only receive the children’s names, whether each child is a girl or a boy, and their age group from the adult who creates the treasure hunt, to personalise the kit. By entering them, you confirm that you are a parent or legal guardian, or have a parent’s or guardian’s permission; the same applies to the guests’ names.

We never use children’s data for advertising, and we never pass it to Stripe, PayPal or advertising partners. It is stored by our hosting providers (Vercel, Supabase), sent by Resend in the emails about your order, and may appear in Microsoft Clarity recordings.

6. Who processes data on our behalf

These service providers process data for us:

• Vercel: website hosting
• Supabase: database and file storage
• Stripe: payments (receives your email address, an order number and internal identifiers; Stripe collects card details itself)
• Resend: sending the emails about your order, which contain the children’s names and the download link
• Mapbox: maps and address search
• Microsoft Clarity: analysis of how the website is used; Microsoft also uses this data for its own purposes and is responsible for that use
• PostHog: measurement of journeys through the website, hosted in the European Union
• Slack: internal notifications about treasure hunts in progress, unpaid treasure hunts and orders, and technical error alerts. They contain your email address, the theme, the age group, the price, where the visit came from, the type of device and the country, never the children’s names

If you pay with PayPal, you sign in to your PayPal account, and PayPal processes the data of that payment under its own privacy statement.

We may also disclose data when the law requires it, or to protect our rights or the safety of others.

7. Advertising and measurement partners

To measure how well our adverts work and to improve our campaigns, we share some data with the partners below. For these purposes, they are joint controllers with us and process the data under their own privacy policies.

Google (Google Ireland Ltd): we use Google Ads and Google Analytics to measure our visits and how well our campaigns work. For this, some usage data, data used to measure results (conversions) and your email address in hashed form may be sent to Google. If you arrive from a Google advert and then buy, our server tells Google that a purchase was made, with the advert click identifier, an internal order identifier, the time of the purchase and the order value (converted into euros), even if you declined cookies; no name and no child’s data is sent. Google’s privacy policy.

If you accept the ‘Google Ads (personalised ads)’ service in the cookie banner, Google can also use its cookies to show you personalised Kidilab adverts. You can withdraw your consent at any time with the ‘Manage cookies’ link at the bottom of every page.

Pinterest (Pinterest Europe Ltd): the Pinterest tag, active only once you have accepted cookies, records how visitors use the website (pages viewed), to assess how well our adverts work. You can withdraw your consent at any time through the cookie banner. Pinterest’s privacy policy.

8. How long we keep data

• The details you entered for a paid treasure hunt (names, age group, content, hiding places, invitation details and map of your home) are deleted 24 months after the party date or, if no date was given, 24 months after payment.
• Treasure hunts that are unpaid or not finished are deleted 24 months after the party date or, if no date was given, 24 months after they were created.
• Your email address is deleted from our database 24 months after your last purchase. Copies held by our service providers follow their own retention periods.
• Order records without personalisation (date, amount, product, source of the visit) are kept for 10 years, as required by French accounting law.
• Messages you send us are kept for 3 years after our last exchange.
• Data from our own visit measurement is kept for up to 25 months.
• For cookies, see our Cookie Policy.

9. International transfers

Your data is processed in France, elsewhere in the European Economic Area and, by some of our service providers, outside it, in particular in the United States. UK regulations recognise the European Economic Area as giving adequate protection. For transfers to the United States, we rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US ‘data bridge’) when the provider is certified under it, or on the European Commission’s standard contractual clauses together with the International Data Transfer Addendum (the ‘UK Addendum’). You can ask for a copy of the safeguards we rely on at privacy@kidilab.com.

10. Security

We take appropriate technical and organisational measures to protect your data against unauthorised access, change, disclosure or destruction. No system is completely secure, however. The map images you upload, and the views you pick by searching for an address, can be reached at unlisted web addresses: anyone with the exact link can open the image. Please do not upload anything you would not want to share.

11. Your rights

Under the UK GDPR, you have the following rights:

• Access: you can get a copy of your data;
• Rectification: you can have your data corrected;
• Erasure: you can have your data deleted;
• Data portability: you can receive your data in a commonly used format;
• Objection: you can object, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21 UK GDPR);
• Restriction: you can ask us to limit how we use your data;
• Withdrawing consent: you can withdraw your consent at any time, without affecting processing carried out before you withdrew it;
• Complaints: you can complain to us first, at privacy@kidilab.com; we acknowledge every complaint within 30 days and tell you the outcome without undue delay.

To use these rights, email us at privacy@kidilab.com, ideally from the email address you used for your order, or use our contact page. We reply within one month.

If you think we are not handling your data lawfully, you can complain to the Information Commission (ICO), the UK’s data protection regulator (ico.org.uk), or to the CNIL, the French authority responsible for us (www.cnil.fr).

12. Changes

We may update this policy. The date at the top shows the current version. If we make important changes, we will tell you by email or with a notice on the website.

13. Contact

• Your data: privacy@kidilab.com
• Other questions: contact@kidilab.com or our contact page
• Post: Kidilab, 20 allée Alexandra David Neel, 33300 Bordeaux, France