Privacy Policy

Last updated: August 27, 2026

This policy describes how your personal data is processed when you use:

the showcase website accessible at dahlikit.com (hereinafter “the Website”);
the p’tit planning software, in its “Discovery” (free) and “Sérénité” (paid) versions, for computers as well as the companion mobile application (hereinafter “the Application”).

It is drafted in accordance with Regulation (EU) 2016/679 (“GDPR”) and the amended French Law No. 78-17 of January 6, 1978 (“Informatique et Libertés”).

1. Who is responsible for your data?

The data controller for the data collected via the Website and the Application is:

VAILLES Noémie, a French sole trader (entrepreneur individuel)
Registered under SIRET number 94458084400016 (SIREN 944580844) with the French national business register (RNE) since 19 May 2025
Address: 2 rue des Fontanelles, 31320 Castanet-Tolosan, France
Contact: contact@dahlikit.com

Dahlikit and p’tit planning are trademarks operated by VAILLES Noémie; they are not separate legal entities.

VAILLES Noémie has not appointed a data protection officer (DPO), as this appointment is not mandatory with respect to its activity. For any questions regarding your data, please write to contact@dahlikit.com.

2. Our guiding principle: local operation by default

p’tit planning has been designed according to the principle of privacy by design. By default, the data you enter into the Application (child records, first names, photos, schedules, daily reports) are saved only on your computer. They are neither hosted, nor accessed, nor backed up on Dahlikit’s servers.

There are, however, limited exceptions, specific to certain features you trigger voluntarily, where precise data leaves your device: AI help, weather, sending reports, mobile sync, and license validation. They are described in detail in Article 4. Outside of these features, the Application runs 100% offline.

Allocation of responsibilities

When you enter information in the Application concerning the children you care for, you act as the data controller for this data within the framework of your professional activity as a childminder. When this data transits through an online feature of the Sérénité plan, Dahlikit and its providers act as data processors, meaning they process this data solely to execute the feature you requested and strictly according to your instructions.

3. Data processed via the Website (dahlikit.com)

Processing	Data concerned	Purpose	Legal basis	Retention
Navigation	IP address, connection data and technical logs	Provide and secure the Website, prevent abuse	Legitimate interest (art. 6.1.f)	Up to 12 months
Contact form / email (contact@, bonjour@)	Name, email address, message content	Answer your request, request a demo	Pre-contractual measures / legitimate interest (art. 6.1.b and f)	3 years after last contact
Group license request (RPE, communities)	Identity, structure, contact details	Establish a quote and commercial follow-up	Pre-contractual measures (art. 6.1.b)	3 years after last contact
Audience measurement	Page viewed, date and time, referring page, country, device and browser type, language; a temporary technical identifier, computed for the day and not retained	Knowing whether the Website is visited and the Application downloaded, in order to improve them	Legitimate interest (art. 6.1.f), processing exempt from consent under CNIL guidelines	13 months

The Website uses no advertising trackers. Audience measurement is handled by a tool we host ourselves, on our server in France (see article 6).

4. Data processed via the p’tit planning Application

4.1. Data entered into the Application (all versions)

Child records, first names, dates of birth, hours, rituals, equipment photo library, schedules, daily moods, tracking sheets.

Storage: exclusively local, on your computer.
Dahlikit has no access to it and keeps no copy.
Backing up this data is your responsibility; you can export, print, or delete it at any time.

4.2. Purchase and management of the Sérénité subscription

Payments and subscriptions are processed by Stripe (Stripe Payments Europe, Ltd., Ireland), a PCI-DSS certified payment provider. Stripe collects and directly processes payment data (name, email, billing address, credit card details) to execute the transaction. The vendor is VAILLES Noémie, who issues the invoice.

Dahlikit never receives your credit card details. Dahlikit only receives information necessary to issue and track your license (email, transaction ID, subscription status).
Purpose: execution of the subscription contract, delivery of the license key, support, accounting and tax obligations.
Legal basis: execution of the contract (art. 6.1.b) and legal obligation for invoicing (art. 6.1.c).
Retention: duration of the subscription; accounting documents are kept for 10 years (legal obligation).
Processing by Stripe: see its privacy policy on stripe.com.

4.3. Features assisted by artificial intelligence (Sérénité plan only)

The following features require an internet connection and transmit data to an AI provider in order to generate a result:

tailored activity creation (based on children’s age, your themes, your equipment);
“another idea?” button;
equipment recognition from a photo;
filtered web search for ideas.

Transmitted data: the content of your request (e.g. ages, themes, equipment type) and, for recognition, the photo you submit.

Purpose: generate the requested suggestion or recognition.
Legal basis: execution of the Sérénité contract (art. 6.1.b); the processing is triggered solely at your initiative.
Providers: Dahlikit and Mistral AI (a French company, 15 rue des Halles, 75001 Paris). Operation: to avoid having to provide your own access key, these requests transit through a secure relay operated by Dahlikit, hosted on a server located in Paris, France, which transmits them to Mistral AI with Dahlikit’s access key. Dahlikit acts here as a data processor: the relay only routes your request and the response, without permanently storing the content or your photos. Processing by Mistral AI is governed by its API terms; under those terms, data sent through the API is not used to train the models.

Important — photos and children: the recognition feature is for equipment. You remain responsible for the photos you submit. We recommend that you do not transmit any photos allowing the identification of a child through this feature.

4.4. Integrated weather (Sérénité plan)

To suggest activities adapted to the weather, the Application queries an online weather service.

Transmitted data: an approximate location (municipality or zip code). No child data is transmitted.
Purpose: display forecasts and adapt activity suggestions.
Legal basis: execution of the contract (art. 6.1.b).
Provider: Open-Meteo (open-meteo.com). The service is queried without an account or advertising identifier; only an approximate location is transmitted to get forecasts.

4.5. Sending daily reports to parents

The Application allows exporting a daily report as a PDF or sending it by email to parents.

Mechanism: the email is sent from your own email account, via the SMTP settings you configure in the Application (e.g. your Gmail, Orange, OVH address…). The report and the recipient’s address therefore transit through your email provider, exactly like an email you would send yourself.
No sending server of Dahlikit is used; Dahlikit receives neither the report nor the parents’ address. Your SMTP password is stored locally, in your operating system’s secure credentials manager (never in plain text, never transmitted to Dahlikit).
As a childminder, you are responsible for informing parents and having the legal basis for this sending (care contract, consent).

4.6. Synchronization with the companion mobile application

To access your data on your phone, the Application offers synchronization via your own personal cloud space (Google Drive). The operation, designed so that your data remains with you, is as follows:

You connect your own Google Drive account from the Application (OAuth authorization). The Application requests the most restricted access possible (drive.file): it can only access files it creates itself, in a dedicated folder Pti'Planning Sync, and nothing else on your Drive.
Your data (child records, equipment, schedules, photos) is deposited in YOUR Google Drive, not on a Dahlikit server. Dahlikit has no access to this folder or to your synchronized data.
The data deposited on your cloud is encrypted (AES-GCM 256 bits) before any upload. The synchronization journal contains children’s personal data (first names, ages, allergies, parents’ contact details) and photos: these are never deposited in clear text on Google Drive — the third party only sees encrypted, unreadable content. The encryption key is generated on your computer and shared directly between your devices at pairing time (via the QR code and PIN displayed); it never transits through Dahlikit, which does not hold it. If you paired your devices before this protection was added, pair them again to enable it.
Access tokens to your Drive are encrypted and stored locally on your devices; they do not transit through Dahlikit.
Google acts here as the host of your personal space; the processing is governed by your Google account terms. See Article 5 (recipients) and Article 7 (transfers).
Synchronization is optional: if you do not connect a cloud, the Application remains 100% local.

4.7. Activation and license validation

The Sérénité version requires validation of a license key. This verification is performed via a relay operated by Dahlikit, hosted on a server located in Paris, France, which compares your license identifier against your subscription status (from Stripe). The exchange is strictly limited to the license identifier and subscription status; no child data is involved.

5. Recipients and processors

Your data is never sold. They may be shared with the following providers, strictly for the purposes described:

Provider	Role	Country
Hostinger International Ltd.	Hosting of the companion mobile app and of the editor relay (AI + license validation) — `app.dahlikit.com`, on a server located in Paris	France (EU)
Vercel Inc.	Hosting of the showcase website `dahlikit.com` only	United States
Stripe Payments Europe, Ltd.	Payment and subscription (payment data)	Ireland (EU) — potential subprocessors in the United States
Mistral AI	AI features of the Serenity plan, via Dahlikit’s secure relay	France (EU)
Google LLC — Google Drive	Hosting of your personal cloud for mobile synchronization (at your sole initiative)	United States
Open-Meteo	Weather service (Sérénité plan)	Switzerland / European Union

Note: sending reports by email does not use any provider of Dahlikit: it uses your own email provider (see Article 4.5). Similarly, data synchronized to Google Drive is stored in your own Google account, under your contractual relationship with Google. Administrative or judicial authorities may also receive data when required by law.

6. Cookies and tracking

The Website uses no advertising cookie, and places no analytics cookie.

Only cookies strictly necessary for the shopping cart’s operation (Stripe Checkout) may be placed when you make a purchase. In accordance with CNIL guidelines, these cookies are exempt from consent as they are essential to provide the service you request.

Audience measurement

To know whether the Website is visited and the Application downloaded, we use Umami, an open-source tool that we host ourselves, on our server located in France. No traffic data is passed to any third party, not even to Umami’s own publisher.

This measurement is exempt from consent under CNIL guidelines, because it meets their conditions:

it places no cookie and uses no durable identifier: a visitor is recognised for a single day only, by a technical fingerprint recomputed daily and never stored in the clear;
your IP address is used solely to derive country and device type, then discarded — it is not retained;
it serves only to produce anonymous traffic statistics, is never cross-matched with another processing operation, and is never used to re-target you;
it does not follow you across websites: it knows nothing of your browsing outside dahlikit.com.

We also measure clicks on the download buttons (chosen operating system, version, page language). These events carry no data about you.

Consequently, no consent banner is imposed on you. Should you prefer not to be counted, your browser’s “Do Not Track” setting, or any blocker, is enough to prevent the measurement.

7. Data transfers outside the European Union

No child data is processed outside the European Union by Dahlikit or by the providers it has chosen. The editor relay (AI features, license validation) is hosted in Paris, and AI requests are processed by Mistral AI, a French company.

One exception, and it is your own doing: synchronization deposits your data in your own Google Drive space, hosted in the United States — it is optional, you trigger it, and the data is encrypted before upload (see Article 4.6). Vercel, also established in the United States, hosts the showcase website only: no child data transits through it. Stripe contracts via its Irish entity (EU) but may use subprocessors in the United States. Mistral AI, finally, may use subprocessors outside the EU, framed by standard contractual clauses. Corresponding transfers are framed by appropriate safeguards under Articles 44 et seq. of the GDPR:

standard contractual clauses of the European Commission (SCC); and/or
certification under the EU-U.S. Data Privacy Framework (DPF), when the provider participates (which is the case for Google).

The weather service Open-Meteo is established in Switzerland, a country benefiting from an adequacy decision by the European Commission; no additional safeguard is required for this transfer.

For AI features, requests transit through Dahlikit’s relay, in France, and are then transmitted to Mistral AI (Dahlikit’s key); for synchronization, data goes into your own Google Drive, which falls under your direct relationship with Google — and it is deposited there encrypted (see Article 4.6). You can obtain a copy of the applicable safeguards by writing to contact@dahlikit.com.

8. Retention periods

Data	Duration
Connection logs of the Website	12 months maximum
Website traffic statistics	13 months
Contact / commercial requests	3 years after last contact
Customer and license data	Duration of subscription
Accounting and invoicing documents	10 years (legal obligation)
Data entered in the Application	Under your sole control, locally
Data transmitted to AI / weather features	Not permanently stored by Dahlikit

9. Security

Dahlikit implements appropriate technical and organizational measures: encryption of exchanges (HTTPS/TLS), recourse to compliant providers (PCI-DSS for payment), minimization of transmitted data, and default local storage on the Application side. Since no system is infallible, we recommend that you regularly back up your local data.

10. Data concerning minors

The Application processes information relating to the children cared for (first name, age, equipment photos, reports). This data is entered and controlled by the user childminder, acting as the data controller within the scope of their activity. It is their responsibility to inform legal representatives and to have an appropriate legal basis. Dahlikit does not access this data, except for limited transit through the online features of the Sérénité plan, where it acts as a processor and under the instructions of the user.

11. Your rights

In accordance with the GDPR, you have the following rights: access, rectification, erasure, restriction, objection, portability, as well as the right to define directives regarding the fate of your data after your death.

For data entered in the Application: since it is stored locally, you exercise these rights directly (modification, export, deletion, uninstallation).
For other processing (contact, license, billing): address your request to contact@dahlikit.com, accompanied by proof of identity if necessary.

We reply within one month, extendable by two months for complex requests.

12. Complaints to the supervisory authority

If you believe your rights are not respected, you can file a complaint with the National Commission for Information Technology and Civil Liberties (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

13. Policy updates

This policy may be updated to reflect legal, technical, or feature changes. The applicable version is the one published on the Website at the date of your consultation. The date of the last update appears at the top of the document.