Privacy

1. Data controller

The data controller is Amdy Bouviala, sole trader (entrepreneur individuel), AKIANA 30, SIREN 941767949, 30, rue du Maréchal de Lattre de Tassigny, 94230 Cachan, France, reachable at hello@kork.fr. No data protection officer (DPO) has been appointed.

2. What data we process

• Account: login identifier (account created anonymously, then email and password if you create a full account).
• Child profile: first name, date of birth, sex, and the “points of attention” you enter (free text).
• Scan videos: that you record or import.
• Observations and reports: generated by the analysis (developmental milestones by area).
• Referral data: referral code, referrer/referee link, credit balance.
• Technical data: needed to run the service (logs, technical identifiers).
• Subscription and payment: handled by Apple’s App Store and RevenueCat. We do not store your bank details.

3. Why we process it (purposes)

• To provide the service: analyse the videos and produce developmental milestones, for observation and support.
• To manage your account, your subscription and the referral programme.
• To ensure the security and proper functioning of the app.

4. Legal basis

The processing is based on your consent (GDPR Art. 6(1)(a)), collected before the first analysis. As this involves a child’s data, and potentially data relating to their development, we collect explicit consent from the parent or holder of parental authority.

5. Who has access to the data (processors)

• Supabase: hosting of the database and the videos, in the European Union (Frankfurt region, Germany).
• Google (Gemini API): analysis of the videos by artificial intelligence. The paid tier is enabled: your videos are not used to train Google’s models and are processed under a data protection addendum.
• Apple / RevenueCat: subscription and payment management.

We do not sell your data and do not use it for advertising purposes.

6. Transfers outside the European Union

For the analysis, the videos are sent to Google (Gemini API). This processing may take place outside the European Union, governed by Google’s data protection addendum and the standard contractual clauses.

As a minimisation measure, the child’s first name is never sent to Google: only the sex, the age in months and the context you enter are used for the analysis.

7. Retention period

• Scan videos: hosted on our servers in the European Union (Supabase, Germany) and deleted automatically 30 days at most after the analysis. The copy sent to Google for the analysis is deleted immediately after it. You can also delete a video and its data at any time, in the app.
• Observations and reports: kept as long as your account is active, then deleted within 30 days after the account is closed. The automatic 30-day deletion only concerns the video file, not the report.
• Account data: kept until your account is deleted, which you can do at any time, in the app.

8. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time. To exercise them, write to hello@kork.fr. You can also lodge a complaint with the CNIL (the French data protection authority).

9. Security

Data is encrypted in transit (HTTPS) and at rest. Access is restricted to the processing strictly needed to run the service.

10. Data concerning a child

The app processes a child’s data. It is intended for the parent or holder of parental authority, who consents to the processing described here on the child’s behalf.

11. Contact

For any question about this policy or your data: hello@kork.fr.