Privacy policy
Last updated: 26 October 2026
Understand how Holy Owly uses personal data, why we process it and how you can protect your privacy on our website and in the app.
Data controller
OWLY LEARNING — SAS
EUID : FR2501.130113053
holyowly.com
Privacy contact contact@holyowly.fr
1. Our commitment and the data controller
OWLY LEARNING is responsible for the processing described in this policy for Holy Owly services. Its contact details appear in the company information block. This policy covers parents and children using the website, family account area and app.
We explain what data is used, why it is used, who may receive it and how to exercise your rights. We limit the data requested to what is useful for the services you choose.
2. Why we use your data and our legal bases
- Creating and managing customer accounts, orders and subscriptions, providing app access and tracking learning progress: performance of the contract.
- Handling payments, order enquiries, customer support, after-sales service and refunds: performance of the contract; certain invoicing and record-keeping requirements also arise from legal obligations.
- Producing statistics and analysing usage to understand families’ needs and improve the service: legitimate interests, with respect for your rights. Optional trackers and PostHog analysis of parent journeys rely on your consent, not on legitimate interests alone.
- Processing data about children under 16 where processing relies on consent: consent from the holder of parental responsibility.
- Sending newsletters or commercial offers: your consent where required, or our legitimate interest in informing existing customers about similar offers where legally permitted, with the option to object.
- Using optional advertising tools and measuring conversions: your consent, according to your preferences.
3. Sources and categories of data
Data comes from information you provide when registering, signing in, making a purchase or contacting our team, and from your use of the website and app. Payment operations may also produce transaction confirmations supplied by the payment provider.
- Parent and account information: surname, first name, email address and information needed to manage the account and customer relationship.
- Child profile: first name or nickname and the school year or learning level entered to tailor the service.
- Technical data: device or smartphone identifiers, IP address and connection or usage information needed for the service to work.
- Order and payment data: selected subscription, transactions, amounts, currency and information needed for secure payment. Card details entered for payment are processed by the payment provider; restrictions specific to PostHog are explained below.
- Learning data: the child’s scores, results, completed missions and progress through the learning pathway, together with rewards earned, including bonus outfits and unlocked illustrations where these features are available.
4. Children’s data and parents’ role
Learning data allows us to track a child’s progress and adapt their pathway to their results. The parent or holder of parental responsibility is involved in creating and managing the child’s profile and can exercise rights concerning the child’s data.
Where processing concerning a child under 16 requires consent, we ask for the consent of the holder of parental responsibility. Consent to optional website tools does not authorise sending children’s data to PostHog: our configuration excludes that collection.
5. Who may receive your data?
Data is intended for authorised people at OWLY LEARNING who need it for their work. Service providers may process it on our behalf, according to their role and our instructions: secure payments, hosting, technical maintenance and development of the website, apps and information system, and sending marketing emails.
Stripe is involved in payments and PostHog in the optional analysis described below. Advertising tools offered in preferences may receive data if you accept them. Legally authorised judicial or administrative authorities may also receive data where disclosure is required by law. Contact us for details of the recipients and service providers concerned.
6. International transfers
Using certain service providers may involve processing or access to data outside the European Union or European Economic Area. PostHog’s collection endpoint is configured in Europe; this does not guarantee that every provider’s processing remains within the European Union.
Where an international transfer is necessary, it must be covered by a mechanism provided for under the GDPR, such as an adequacy decision or standard contractual clauses with supplementary measures where needed. Contact us to find out about transfers affecting your data and the applicable safeguards, or to request information about those safeguards.
7. How long data is kept
Data is kept only for as long as necessary for its purpose. For newsletter management, the stated retention period is three years of inactivity. For data collected as part of a subscription, the stated period covers delivery of the service and then three years after the contractual relationship ends, subject to applicable legal record-keeping obligations.
Cancelling an app subscription and unsubscribing from the newsletter are separate actions. You can object to marketing messages independently of your subscription, including by emailing contact@holyowly.fr. Withdrawing PostHog consent stops new collection as explained below; it does not by itself request erasure of data already collected.
Your PostHog choice is stored for 180 days without automatic renewal. This is the lifetime of your preference, not an event-retention period at the provider. You can ask us for further details about retention periods for different data.
8. Your data protection rights
Subject to the conditions set out in applicable law, you have rights of access, rectification, erasure, restriction of processing and portability. You may object to processing based on legitimate interests and, at any time, to direct marketing, including related profiling.
You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may also give general or specific instructions about the retention, erasure and disclosure of your data after your death, under the conditions provided by French law.
9. How to exercise your rights
Email contact@holyowly.fr or write to OWLY LEARNING at the registered office shown in the company information block. Explain the right you wish to exercise and provide information that allows us to find the relevant account. If there is reasonable doubt about your identity or authority to act for a child, we may ask for further information.
We respond within one month of receiving your request. This period may be extended by two additional months where justified by the complexity or number of requests; in that case, we inform you of the extension and its reasons within the first month.
10. What your choices mean
Refusing optional analytics or advertising tools does not cancel your subscription. Some data remains necessary to provide the service you request, secure your account or comply with a legal obligation; an erasure request affecting that data may therefore affect access to the service.
Objecting to advertising targeting and unsubscribing from marketing communications are different actions. You may ask for direct marketing to stop, not merely for less personalised messages. Messages necessary to manage your account or subscription are separate from newsletters and commercial offers.
11. Complaints to a supervisory authority
You can contact us with any question or concern. If you believe your rights have not been respected, including if you receive no response or are not satisfied with it, you can complain to the CNIL in France or the competent supervisory authority. The CNIL website also provides information about personal data protection.
13. Optional analysis of parent journeys with PostHog
With your consent, PostHog helps us improve the website and offers by analysing parent journeys: navigation, registration, checkout and retention. This analysis uses pseudonymous identifiers and error categories. A pseudonymous identifier can be linked to the parent account when you are signed in; this is not anonymous data.
Collection is configured to use PostHog’s European endpoint. Only explicitly allowed events and properties are sent. We do not send names, emails, child or payment-card data, full URLs or raw error content. Automatic interaction capture, session recording and automatic page or error capture are disabled. Separate technical diagnostics, unlinked to your account or journey, help fix service errors independently of this choice.
This analysis is optional. Your choice lasts 180 days without automatic renewal. Anonymous browsing identity stays in memory, without durable storage by the PostHog SDK in this browser. You can withdraw consent in preferences: collection stops immediately in this browser and, for your account, after synchronisation while signed in. If signed out, sign in again to apply withdrawal to your account too. Requests already started may finish.
You retain the rights described in this policy, including access, rectification and erasure, subject to applicable conditions. To exercise them or ask about this analysis, email contact@holyowly.fr.
14. Contact us about privacy
For questions about this policy, children’s data, recipients, retention periods or international transfers, contact OWLY LEARNING at contact@holyowly.fr or write to the registered office shown in the company information block.
