Privacy Policy

Last updated: October 28, 2026

1. Data controller

Data controller: Timothée Miminoshvili, sole proprietor (trade name TEL-MI Labs) — SIREN 847 659 216
Address: 72 rue de Dantzig, Hall 14, 75015 Paris, France
Data protection contact: Timothée Miminoshvili — dpo@pictoflow.com
General email: contact@pictoflow.com

2. Data collected

2.1 Account data (parent or professional)

• Email address (required)
• Password (required — stored only in hashed form, never in plain text)

2.2 Data relating to children

The account is created and managed by an adult. Within their space, they can create child profiles containing:

• a first name or nickname and a display color;
• the content created for the child: cards (images and labels), schedules, sequences, rewards, board progress.

Uploaded images may contain photos. We recommend using only what the child needs: a nickname is enough, and a photo is never required (see section 3).

2.3 Technical data

• IP address — used for security (anti-bot protection, our hosting providers' logs); we do not keep it in our databases
• Browsing information (user agent, language), processed in the same logs
• Technical device identifier (used to count the devices linked to the account, to apply the device limit, and to list them in “My devices”)
• Consent data (record of your choices)
• Technical logs kept by our hosting providers (short duration)
• Visit statistics for public pages (page viewed, site you came from, country, device type, browser, operating system, load time) — no cookie, no identifier: see section 11
• Performance indicators for those same pages (how fast they display and respond), measured along with the statistics above: they come with the technical name, in the page's code, of the elements concerned (for example the title or an image) and the address of the main file displayed (for example the illustration image). This address may contain technical display settings, such as the image's width or quality; none of this contains any information about you

2.4 Subscription data (if applicable)

• Billing information (processed by Stripe)
• Payment history and subscription status
• Your card numbers never pass through our systems: they are entered directly with Stripe.

3. Protection of children's data

Pictoflow is a service intended for parents and caregivers of children. Children deserve specific protection of their data; here are our commitments:

• No child accounts: the account belongs to the adult. No data is collected directly from the child.
• The parent stays in control: child profile data is entered by the holder of parental authority (or the caregiver they have authorized), who exercises all rights over this data (see section 8). By creating a profile, the adult declares this (ToU, article 7.3).
• Data minimization: a nickname and a color are enough to create a profile. No date of birth and no medical information are requested, and we ask you not to write any health information or diagnosis in free-text fields.
• No exploitation: children's data is used only to operate the service — and, as simple totals (for example: the number of accounts that have started at least one session), to measure how Pictoflow is used in order to improve it. No total describes a child or a family. Never for advertising, never for profiling, never shared with third parties.
• No measurement on the child's screen: visit measurement never runs on the Dashboard.
• No commercial message ever appears in the interface used by the child.

4. Purposes of processing

• Provide the Pictoflow service (creating cards, schedules, board tracking)
• Manage accounts and authentication
• Ensure security and prevent abuse (anti-bot protection)
• Diagnose technical errors (error reports with a pseudonymized identifier — see section 7)
• Measure how the service is used, only as overall statistics: visits to public pages, and usage totals (accounts created, schedules set up, sessions started, returns) — see section 11
• Manage subscriptions and billing
• Answer your requests (support)

5. Legal bases

5.1 Performance of a contract (article 6.1.b GDPR)

• Management of the adult's account, provision of the service, subscription management

5.2 Legitimate interest (article 6.1.f GDPR)

• Child profile data: the child is not a party to the contract, which is concluded with the adult. Their data is processed under the legitimate interest of the child, and of the adult who supports them, in having the tool chosen for them. This interest only outweighs the child's rights thanks to the safeguards of section 3: data kept to a minimum, no advertising and no profiling, no sharing, rights exercised by the holder of parental authority, immediate deletion of the profile at any time.
• Security and abuse prevention
• Technical error diagnosis
• Measuring visits to public pages and overall usage statistics, to improve the service
• Support and assistance

5.3 Legal obligation (article 6.1.c GDPR)

• Retention of billing data (accounting and tax obligations)
• Proof of consent collection

5.4 Consent (article 6.1.a GDPR)

To date, no processing is based on consent. Our visit measurement is configured to be exempt from it (article 82 of the French Data Protection Act): no cookie, no identifier, for our own use only — you can object to it at any time (section 11). We use no advertising trackers. If this were to change, your consent would be collected before any tracker is set, and this policy would be updated.

The parental consent rule for minors (article 8 GDPR) does not apply here: it covers services offered directly to a child and based on consent. Pictoflow is aimed at the adult, the child has no account, and no processing relies on consent.

6. Retention periods

6.1 Account and content data

• Active account: kept as long as the account exists
• Account deletion: immediate erasure from our active systems (profiles, cards, images, preferences); copies held in our security backups are overwritten within 30 days at most
• Inactive account: deleted after 2 years of inactivity, preceded by an email notice and a 30-day period during which simply signing in is enough to keep the account

6.2 Records and billing

• Record of your acceptance of the Terms of Use and of your consent choices: 5 years (statutory limitation period) — after account deletion, this record is kept in a form dissociated from your identity
• Invoices: 10 years (accounting obligation)
• Payment data: kept by Stripe according to its own obligations

6.3 Technical data

• Technical logs: short durations set by our hosting providers
• Local trackers: see the Cookie Policy
• Visit statistics: available for 6 months (Cloudflare). Usage totals are recalculated on demand: nothing is kept separately.

7. Data recipients

7.1 Internal access

Pictoflow is operated by a sole proprietorship with no staff: only the data controller accesses the data, strictly as needed (assistance, maintenance).

7.2 Processors

Processor	Role	Data location
Supabase	Database, authentication, image storage, server functions	European Union (Ireland)
Vercel	Website and application hosting	United States (safeguards: see 7.3)
Stripe	Payments and billing	United States (safeguards: see 7.3)
Brevo	Sending service emails (confirmation, password reset)	France (European Union)
Sentry	Technical error diagnosis	European Union (Germany) — user identifier pseudonymized (hashed) before being sent
Cloudflare	Anti-bot protection (Turnstile), DNS, receipt of emails sent to our @pictoflow.com addresses, and visit measurement for public pages (Web Analytics)	United States (safeguards: see 7.3)
Google (Gmail)	Reading the emails you send to support	United States (safeguards: see 7.3)
Infomaniak	Sending our replies to your emails (contact@pictoflow.com)	Switzerland (recognized by the European Commission as providing adequate protection)

We never sell or rent any data. No advertising third party has access to your data or your children's data.

7.3 Transfers outside the European Union

Application data (accounts, profiles, content) is hosted within the European Union. Some processors (Vercel, Stripe, Cloudflare, Google) are established in the United States: these transfers are governed by the European Commission's standard contractual clauses and/or their certification under the EU–US Data Privacy Framework.

8. Your rights (and your child's)

Under the GDPR, you have the following rights:

• Right of access (article 15): know what data is held and obtain a copy
• Right to rectification (article 16): correct inaccurate data
• Right to erasure (article 17): request deletion of your data
• Right to restriction (article 18): temporarily suspend processing
• Right to portability (article 20): retrieve your data in a structured format
• Right to object (article 21): object to processing based on legitimate interest
• Right to withdraw consent: at any time, for any processing that would rely on it

Child profile data: these rights are exercised by the holder of parental authority (or their authorized representative), from the account hosting the profile.

9. Exercising your rights

9.1 Directly in the application

• Access and portability: "Download my data" button in the GDPR Portal
• Rectification: child profiles and content can be changed in the application; for your email address, write to us
• Erasure: account deletion from the settings (immediate effect)

9.2 By email

• Contact: dpo@pictoflow.com
• Response time: 1 month maximum (extendable by 2 months for complex requests, in which case you would be informed)

9.3 Complaints

• CNIL: www.cnil.fr
• Or the supervisory authority of your country of residence

10. Data security

10.1 Technical measures

• Encryption in transit (HTTPS/TLS)
• Password hashing (bcrypt — never stored in plain text)
• Strict account isolation: each account can only access its own data, enforced by the database itself (Row Level Security)
• Pseudonymization of the user identifier in error reports
• Secure backups (encrypted in transit)

10.2 Organizational measures

• Access limited to the data controller alone
• Security reviews at every major evolution of the service
• Ongoing awareness of the operator regarding data protection

11. Cookies and trackers

Pictoflow uses trackers that are strictly necessary for the service to work, and a cookie-free visit measurement (Cloudflare Web Analytics) on its public pages only: home, about, guides, sign-up.

This measurement stores nothing on your device, gives you no identifier and cannot recognize you from one visit to the next. It is never active in the management space (Editing) or on the child's screen (Dashboard). You can object to it at any time from the Cookie Policy: your choice is remembered on your device.

No advertising trackers. Details: Cookie Policy.

12. Changes to this policy

This policy may be updated to reflect changes in our practices, new legal requirements, or the addition of new services. You will be notified of significant changes via the website, by email (if you have an account), or in the application.

13. Contact

13.1 General questions

Email: contact@pictoflow.com

13.2 Data protection contact

Contact: Timothée Miminoshvili — dpo@pictoflow.com

13.3 Exercising GDPR rights

GDPR Portal: GDPR Portal

---

14. Accessibility

We aim for WCAG 2.2 AA compliance. If you encounter any accessibility issue, write to us at support@pictoflow.com.

---

Version history:

• 1.0 (December 2024) - First GDPR-compliant version
• 1.1 (July 2026) - Real data controller, factual corrections
• 1.2 (July 2026) - Actual processing (removal of audience measurement; declaration of Vercel, Brevo, Sentry, Cloudflare), "Protection of children's data" section, clarified retention periods, accuracy corrections
• 1.3 (September 2026) - 30-day grace period before deletion of an inactive account: email notice, then 30 days during which simply signing in is enough to keep the account
• 1.4 (September 2026) - brand spelling, no substantive change
• 1.5 (September 2026) - Legal basis for child profile data clarified (legitimate interest, article 8 GDPR not applicable), no health data in free-text fields, accuracy fixes (no username, IP address not kept in our databases)
• 1.5.1 (September 2026) - Removed the mention of an avatar for child profiles (feature removed, no such data collected), no substantive change
• 1.6 (September 2026) - Declaration of the providers handling support emails: Cloudflare (receipt), Google Gmail (reading) and Infomaniak (sending replies)
• 1.6.1 (October 2026) - Purpose of the technical device identifier corrected (device limit and “My devices” list, not synchronization), no substantive change
• 1.7 (October 2026) - Cookie-free visit measurement of public pages (Cloudflare Web Analytics), with a right to object; overall usage statistics to improve the service
• 1.8 (October 2026) - Visit measurement: measured data completed with page performance indicators (elements concerned, address of the main file displayed) and the operating system, already measured but not listed; same purpose, same retention period

---

Last updated: October 28, 2026