Privacy policy

Introduction

Sphère Télécom, publisher of the Owly app, is committed to protecting its users' privacy. This privacy policy describes the personal data we collect, how we use it and the rights you have, in accordance with the General Data Protection Regulation (GDPR).

Data collected

When you use Owly, we may collect the following data:

• Registration data: first name, email address, password (encrypted)
• Location data: GPS position of the child's device (latitude, longitude, accuracy), and the position of the parent's device when they choose to share it with their family
• Usage data: installed apps, time spent, blocking events
• The child's web browsing: domain names and addresses of the pages visited, and blocked sites
• The child's searches: terms entered into search engines, and the danger level assigned to them
• The child's YouTube activity: titles of the videos watched, channel names, search terms and viewing time
• Physical activity: daily step count, when the feature is enabled
• Device status: diagnostic readings (active services, granted permissions, battery level, sleep mode), sent only when troubleshooting mode is enabled in order to resolve an incident
• Support exchanges: content of the messages sent from the application or the website
• Email delivery statistics: opens and clicks, together with the IP address and browser used
• Technical data: device model, Android version, battery level, app version
• Connection data: IP address, date and time of connection
• Billing data: plan subscribed to, amount, payment date, last four digits and brand of the card used. The full card number is never transmitted to Owly.

Purpose of processing

The data collected is used solely to:

• Provide the parental control features (location, app blocking, alerts)
• Keep the service secure (authentication, protection against abuse)
• Improve the app (anonymised usage statistics)
• Communicate with you (support, important notifications)

Legal basis

Data processing is based on parental consent (GDPR article 6.1.a) for data relating to children, and on performance of the contract (GDPR article 6.1.b) for the data needed to run the service. Collecting a minor's location data requires the explicit consent of the parent or legal guardian.

Retention period

Personal data is kept for the duration of the use of the service. If an account is deleted, it is erased within 30 days.

Two exceptions relate to the law: connection data is kept for 12 months, and invoices along with the accounting data attached to them are kept for 10 years, in accordance with Article L123-22 of the French Commercial Code. The latter is limited to what an invoice requires and contains no data relating to the child.

Data sharing

Your personal data is never sold or shared with third parties for commercial purposes. It is only communicated to the subcontractors strictly necessary for the operation of the service, bound by contract:

• The hosting provider, for the storage of data on servers located in France.
• Mollie B.V., a licensed payment institution, for processing payments made by card. Only the data necessary for payment is transmitted to it.
• The artificial intelligence analysis provider, to decide whether a piece of content is suitable for the child's age. Depending on the case, it receives: the domain name to be examined, the term searched for by the child, or the title and channel of a YouTube video, each accompanied by the child's age alone. It never receives the child's name, email address, location, or the content of the pages visited.
• Google (Firebase Cloud Messaging), to deliver notifications to the family’s phones.

Security

We put technical and organisational measures in place to protect your data: password encryption, encrypted connections, secure servers hosted in France, a limit on login attempts and protection against automated attacks.

Your rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: delete your account and your data (available from the app)
• Right to portability: receive your data in a structured format
• Right to object: object to the processing of your data

To exercise your rights, write to us at contact@owly.website.

Cookies

The website www.owly.website does not use tracking, advertising or profiling cookies. No third-party cookie is placed. Only technical cookies strictly necessary for the website to work may be used.

Changes

We reserve the right to change this privacy policy at any time. Changes will be published on this page along with an update date. We encourage you to check this page from time to time.

Contact

For any question about the protection of your data, you can write to us at contact@owly.website.

You also have the right to lodge a complaint with the CNIL (the French data protection authority).