Privacy Policy & Cookies – ChildLink-MA

Last updated: March 30, 2026

1. Identity of the Data Controller

ChildLink-MA, a non-profit association (RNA W941020510 · SIRET 953277122 00019), is responsible for data processing on www.childlink-ma.org and the ChildLink-IA application.

2. Data Collected

Through forms (contact, collaboration): First name · Email · Phone (optional) · Message
Through the AI agent: Questions asked — non-identifying logs for performance only
Through the parental simulator: Voice data processed in real time by Azure Speech Services — not retained. Adult voices only.
No health data is requested or retained.

3. Purposes

  • Responding to contact and collaboration requests
  • Improving AI agent performance
  • Statistical monitoring via Plausible.io (cookie-free)
  • Parental training sessions via vocal simulation

4. Legal Basis

  • Consent — forms and simulator opt-in
  • Legitimate interest — AI improvement, anonymous statistics
  • Legal obligations — nonprofit operation

5. Data Processors & Cross-Border Transfers

  • Azure OpenAI (Microsoft) — AI responses · USA HQ · Processed in EU (francecentral) · Covered by Microsoft SCC
  • Azure Speech Services (Microsoft) — real-time voice · Not retained · Covered by Microsoft SCC
  • Azure App Service (Microsoft) — app hosting · France, EU
  • Make.com — session automation · USA HQ · Anonymized logs only · Covered by Make.com SCC
  • OneDrive (Microsoft) — session PDF storage · EU region · Covered by Microsoft SCC
  • Notion.so — contact forms · USA HQ · Covered by Notion SCC
  • Plausible.io — analytics · EU hosted · No cookies · GDPR compliant

All cross-border transfers are governed by Standard Contractual Clauses (SCC) under GDPR art. 46.

6. Retention

  • Form data: 12 months
  • Anonymous AI logs: 18 months
  • Voice data: not retained (real-time processing)

7. Processing Register (GDPR art. 30)

Processing 1 — Incoming messages
ConsentFirst name, email, message · 12 months · Notion.so (SCC)
Processing 2 — Parental simulator sessions
Opt-in consentVoice not retained · Anonymous PDF recap (hashed session_id) · 18 months · OneDrive (SCC)
Processing 3 — AI agent logs
Legitimate interestHashed IP (SHA-256), country, latency · 18 months · Azure francecentral (SCC)

8. Cookies

Plausible.io is used for analytics — cookie-free, GDPR compliant. No advertising or profiling cookies.

9. Your Rights

Access · Rectification · Deletion · Objection · Restriction · Portability · CNIL complaint
Contact: admin@childlink-ma.org

10. Security

SSL encryption · Azure francecentral (France, EU) · GDPR-compliant platforms

11. ChildLink-IA Application

Full privacy policy for the ChildLink-IA app Covers the AI assistant, parental simulator, vocal sessions, PDF reports and Azure processing in detail →