Privacy Policy

1 The essentials

Lanti is designed so that your family's information stays on your iPhone.

• No account, nothing at the publisher. Neither you nor your child has an account to open. VISION PM (the "Publisher") does not receive, store or consult any personal data from the Application: the texts sent to the artificial intelligence service pass through a server of the Publisher which forwards them without recording them (§ 4), and only the anonymous audience measurement, which you can turn off, reaches it (§ 5). The legal documents are read on pages of that same server, which the Parent area opens when you ask it to (§ 5a).
• No account for the child, no advertising, no advertising tracker, no advertising SDK. Only an anonymous audience measurement, carried out solely on the Publisher's behalf and which can be turned off at any time, counts which features are used; it contains no question, no answer and no information that could identify your child or you.
• Your child's voice never leaves the iPhone: it is turned into text on the device, then the sound is deleted.
• Your voice (when you read a challenge) stays on the iPhone: the Application sends it nowhere and excludes it from backups.
• Texts only leave the iPhone with your explicit agreement: to write an answer or a quiz, the text of the question and the earlier exchanges of the session, your child's age and gender, and instructions are sent to the artificial intelligence service of Mistral AI, a French company, which processes them in Europe (§ 4) — and, to check that they are suitable for a child, the text of that question and then that of the answer are checked by Mistral AI's moderation service (§ 4a). These texts are not used to train its models, Mistral AI does not keep them, and they do not leave Europe. In addition, unless you turn them off, anonymous usage statistics, containing no text and not linked to you, measure the Application's audience for the Publisher (§ 5). Your child's first name is never sent.

2 Who is responsible

Publisher: VISION PM, EURL. Its contact details, including the personal-data contact, are at the end of this document (§ 11).

The data described in § 3 is kept on your iPhone, under your control. For writing the answers (§ 4) and the safety check of questions and answers (§ 4a), the Publisher is the data controller: the texts pass through its server, hosted in France by Scaleway (§ 4), which forwards them to Mistral AI, its processor, with its own access key — you do not need to open an account with it, and this server keeps no text. For audience measurement (§ 5), the Publisher is the data controller and uses TelemetryDeck GmbH.

3 What is kept on your iPhone

The child's voice. While the child presses the character, the sound is recorded in a temporary file, transcribed into text by iOS speech recognition on the device, then the file is deleted. No sound is kept or transmitted.

Face ID. If you enable it, it is iOS that recognises your face (or your fingerprint, with Touch ID); the Application only receives a "yes" or a "no", never your face or any biometric data, and sends nothing.

Your voice. The challenge recordings are files kept in the Application's private folder, excluded from iCloud backups and from computer backups, and protected by the iPhone's encryption. The Application never sends them, neither to Mistral AI, nor to the Publisher, nor to anyone.

No contact details. The Application asks you for no e-mail address, no phone number and no postal address. An e-mail address given in an earlier version of the Application is erased from the iPhone the first time the new version is opened.

Backups and iCloud. If iCloud backup or computer backup of your iPhone is enabled, iOS may include the Application's data in it (except your voice recordings, and except the parent code, which is tied to this iPhone). These backups, like any storage in iCloud or in another service you may choose for your content (including your voice), fall under your Apple account or that service and under your responsibility: VISION PM is not responsible for them and has no access to them.

4 What is sent to the artificial intelligence service (Mistral AI)

When a question has no answer already known on the iPhone, the Application sends the items below, over an encrypted connection and through the Publisher's server (below), to the artificial intelligence service of Mistral AI, which writes the answer. If Mistral AI's main model does not respond (outage, timeout, unusable response), the same items are sent to another model of Mistral AI, by the same route and under the same conditions, which then writes the answer in its place. No other provider is involved.

• the text of the question (never the sound) — including that of the question the character suggests after an answer, when the child says "yes";
• during a single question session (from opening "Ask a question" until leaving it), the earlier questions and answers of that session and the questions already suggested, so that the answer follows the conversation and a suggestion does not come back. The Application opens no conversation kept at these services: each sending contains what is needed, and the session is forgotten on the iPhone as soon as the child leaves "Ask a question";
• the child's age, in years (never the year of birth), and the child's gender (boy or girl), to adapt the answer;
• the names of the enabled blocked topics, including those you create, so that a question on these topics is referred back to you (never the list of their words);
• writing instructions suited to a child;
• to build a quiz: a few question / answer pairs the child has already heard, with the child's age in years and gender;
• an access token for the Publisher's server, obtained once for this installation through Apple's attestation (App Attest), which proves that the request comes from a genuine copy of Lanti on a genuine Apple device: the server derives from it a pseudonymous installation identifier, unrelated to you, the iPhone's serial number or its advertising identifier, which is used only to limit the number of calls per installation: the server keeps it in memory only, with no database, forgets it at every restart and writes it in no log, not even in a shortened form. Nothing identifies your household; a reinstallation creates a new one. The access key to Mistral AI is never in the Application: the Publisher's server adds it.

A question refused by the word filter or by the safety check (§ 4a) is not sent. No other item is transmitted: neither the voice, nor the child's first name, nor your challenges, your recordings, the device's serial number or advertising identifier, or the location.

The Publisher's server. Each sending passes through a server of the Publisher (api.lanti.visionpm.fr), hosted in France by Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris (Paris region). It checks that the request comes from a genuine copy of Lanti and has the expected form, adds the Publisher's access key to it and forwards it as is to Mistral AI, then returns the response. It keeps no text: it has no database, and its technical log records, for each request, only the route called, the result, the time and the duration — never the question, the answer, the age or the gender. The number of calls from each installation is counted in memory, for the day, under the pseudonymous identifier above.

Your agreement. Before any first question, a set-up screen explains to you what is sent, what is never sent, to whom and why, and asks you "I accept" or "I refuse". Nothing is sent before "I accept". You can change your mind at any time in Parent area › Settings › Artificial intelligence: from the next question onwards, nothing more is sent, and the Application only answers with the answers already present on the iPhone. If what is sent changes, your agreement is asked for again.

Mistral AI processes this data as a processor of the Publisher, solely to write the answer or the quiz (and for the check in § 4a). Mistral AI, a company under French law registered with the Paris RCS under number 952 418 325, 15 rue des Halles, 75001 Paris, receives these texts from the Publisher's server, with the Publisher's access key: you do not need to create an account, and nothing identifies your household. No retention at Mistral AI. Mistral AI applies zero retention ("Zero Data Retention") to the Publisher's account: for the services the Application uses (writing of answers and safety check), it neither keeps nor records the texts received and its responses beyond the time strictly necessary to produce its response. These texts are therefore neither kept nor used to train Mistral AI's models. Processing in Europe. The Publisher's server calls Mistral AI only through its European endpoint (api.eu.mistral.ai): according to Mistral AI, the texts received and its responses are processed there in data centres located in the European Union and in the EFTA countries (Iceland, Liechtenstein, Norway, Switzerland). The data of the Publisher's account with Mistral AI (access key, billing, usage volumes) may be processed elsewhere; it contains no text from your child.

Mistral AI's guarantees. The processing is governed by Mistral AI's data processing agreement, compliant with the GDPR and incorporated into its terms (legal.mistral.ai/terms/data-processing-addendum); the list of its own sub-processors is published at trust.mistral.ai/subprocessors. According to Mistral AI, its data is hosted by default in the European Union, with encrypted backups spread across several zones of the Union, and its services comply with the SOC 2 Type II, ISO 27001 and ISO 27701 security standards; its reports and certificates can be consulted on its trust centre (trust.mistral.ai). Its terms and privacy policy: legal.mistral.ai/terms.

4a The safety check by Mistral AI

To make sure that what the child asks and what the child hears are suitable for them, the Application has these texts checked by Mistral AI's moderation service, over an encrypted connection:

• the text of a question (never the sound) that is about to be sent to the artificial intelligence service (§ 4), just before that sending, together with the earlier questions of the same session, to judge its meaning in context: the question is checked on its own and in that context — a question the iPhone already knows how to answer, or one of the Application's starter questions, is not sent;
• the text of the answer written by the artificial intelligence service, together with the question the character will suggest next, before Lanti says it;
• the text of a quiz written by the artificial intelligence service (its questions, their answer choices and their explanations), before it is offered to the child.

Nothing else is transmitted: neither the child's age, gender or first name, nor the blocked topics, nor the earlier answers of the session, nor the device identifier or the location.

What follows from it. A refused question is not sent to the artificial intelligence service; a refused answer is withheld and never told to the child, who is invited to talk about it with their parents. The question, the category concerned and, where applicable, the withheld answer are kept on the iPhone, in the Incidents tab of the Parent area; nothing is deducted from the day's questions. A quiz that is refused, or that could not be checked, is never offered. A refused quiz is kept on the iPhone, with the category concerned, in the Incidents tab of the Parent area, and the Application builds another one once the child has asked new questions; when the check could not be carried out (without a connection, for example), nothing is kept and it tries again later.

Who. Mistral AI, the same processor as in § 4, under the same conditions and through the same Publisher's server: the Publisher's access key, European endpoint, no retention of the texts ("Zero Data Retention"), no training of its models.

Your agreement. This check is part of the sending to the artificial intelligence service that you accept or refuse (§ 4): if you refuse, nothing is sent to Mistral AI.

5 Usage statistics (audience measurement)

To find out which features of the Application are really used, how often its limits are reached and whether its quizzes are pitched right for each age, the Application sends usage statistics. This is an audience measurement carried out solely on the Publisher's behalf, which is used only to produce anonymous statistics: never to track a person, to recognise them, to advertise or to cross-reference these statistics with other data. In accordance with the CNIL's recommendations on audience measurement, it does not ask for your prior agreement, but you can turn it off at any time; the Application then works in exactly the same way.

What is sent:

• the name of the action performed, chosen from a fixed list and attached to the character concerned (for example "Lanti: question answered", "Wonderli: quiz completed", "Comète: challenge played") or to the Parent area (for example "Blocked words page opened", "word added"), and, where applicable, details also taken from fixed lists: where an answer came from (artificial intelligence service, iPhone memory or starter answers), why a question went unanswered (for example word filter, safety check, daily question limit, no connection), how an activity was opened, the galaxy played or the accessory worn (among those supplied with the Application), the result of a completed quiz (its number of questions, right answers and stars won), the end of the day's play time, with the length chosen (for example 1 h), whether or not it was above the length advised for the child's age, and the activity the child was in; the nature of a refused question, the word or topic concerned are never sent, nor is anything you write in the Parent area (blocked words, topics, challenges, cards);
• the child's age bracket (4-6, 7-9 or 10-12 years);
• technical information added automatically by the measurement tool: version and build number of the Application, iOS version, iPhone model, architecture, screen size, scale and orientation, time zone, language, region, light or dark theme, reading direction, date and time of day (day, week, month, quarter, hour), installation mode (App Store, TestFlight or development), random identifier of the current session (renewed at each launch). The iPhone's accessibility settings and the usage history the tool ordinarily keeps (date of first launch, number of days and sessions, session duration) are replaced by a dash before sending;
• no identifier of your iPhone: the Application sends the same word for every iPhone, so TelemetryDeck counts all iPhones together and cannot tell the statistics of one from those of another; only the identifier of the current session, mentioned above, changes at each launch. The random identifier that earlier versions of the Application kept is erased from the iPhone at the update.

What is never sent: the text of questions and answers, the child's first name, year of birth or gender, your voice or the child's, your challenges, the device identifier or its advertising identifier, the location. The IP address is not kept.

Who collects them: VISION PM, the Publisher, is the controller of this audience measurement, which it carries out solely on its own behalf. The statistics are received by TelemetryDeck GmbH, Von-der-Tann-Str. 54, 86159 Augsburg (Germany), whose servers are in the European Union (Amsterdam, Frankfurt, Falkenstein and Nuremberg) and which never keeps IP addresses, neither in its database nor in its logs. TelemetryDeck receives from the Application only data that it treats as anonymous and regards, under its terms, as falling outside the GDPR; it announces no deletion period for these anonymous statistics. The Publisher only consults tables of anonymous statistics and cannot link them to a person; it does not cross-reference them with any other data.

Your choice: the Application presents this audience measurement to you at the end of set-up. You can object to it at any time, without having to justify yourself, in Parent area › Settings › Usage statistics: as soon as you turn them off, nothing more is sent, and the statistics awaiting sending on the iPhone are deleted. Your choice is kept on the iPhone; you can turn statistics back on in the same place.

5a The legal documents online

The Application holds no copy of the legal documents. In the Parent area (Settings › Legal information, and the screen of the agreement for artificial intelligence), a link opens, when you touch it and only then, the page that gathers them — terms of use, this policy, terms of sale, legal notice and help, each with its version and date (https://api.lanti.visionpm.fr/) — in a browser built into the Application, which shares neither cookies nor history with Safari.

These pages are served by the Publisher's server described in § 4, hosted in France by Scaleway SAS (Paris region): they no longer go through a host located outside the European Union. Like any web page, the server receives what any browser sends, in particular the IP address and the type of device, but it does not record them: its technical log notes, for each page, only its address, the result, the time and the duration. The pages have no cookie, no script and no audience measurement, and load nothing from another site. The Application sends nothing else there: neither the child's first name or age, nor their questions, nor anything you have written. Without a connection, the page does not open; the documents can still be read at the same address from any other device.

6 Apple

The Application is downloaded from the App Store and uses iOS features (on-device speech recognition, Face ID or Touch ID if you enable it, keychain, backups). Apple processes the data linked to your Apple account and, if you have accepted it in the iOS settings, diagnostic reports, under its own privacy policy.

7 Legal bases

• Performance of the service you have chosen to use: history, quizzes, challenges, settings kept on the iPhone; this installation's access to the Publisher's server (§ 4).
• Consent: the sending of questions to Mistral AI and their safety check by Mistral AI (withdrawable in Parent area › Settings › Artificial intelligence).
• Legitimate interest of the Publisher in measuring the audience of its Application in order to improve it: the usage statistics (§ 5), anonymous, exempt from consent under the CNIL's recommendations on audience measurement; you can object to them at any time in Parent area › Settings › Usage statistics.

Data concerning the child is processed at the initiative and under the control of the child's parent or legal representative, who sets up the Application and accepts this policy.

8 Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability (Articles 15 to 21 of the GDPR), as well as the right to set out directives on what happens to your data after your death.

For the data on your iPhone, you exercise them directly:

• view: Parent area (Questions, Quizzes, Challenges, Incidents, Settings);
• correct: first name, year of birth, gender, challenges, blocked topics and words in the Parent area;
• erase: delete a challenge, "Delete my voice", withdraw your agreement to the sending of questions, or delete the Application to erase everything;
• texts transmitted to Mistral AI: from the Publisher (§ 11), which forwards your request to its processor; as the Publisher does not receive these texts and nothing links them to you, it may not be able to find them;
• usage statistics: object to them by turning them off in Parent area › Settings; as nothing links them to you, the Publisher cannot find those of a particular parent.

For any question, write to the Publisher (§ 11). You may also lodge a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

9 Security

Parent code in the iOS keychain, tied to this iPhone; data protected by the device's encryption; Parent area protected by a code and an adult gate; exchanges with the Publisher's server and the sending of statistics encrypted (HTTPS); the Publisher's server reserved for genuine copies of Lanti (Apple attestation), with no database, and sole holder of the access key to Mistral AI, which is never present in the Application; Guided Access recommended so that the child stays within the Application.

10 Changes

Each version of this policy bears a number and a date. It is updated before any change to the Application that alters the data processed or the recipients, and can be consulted at any time in Parent area › Settings › Legal information and at https://api.lanti.visionpm.fr/confidentialite/.

11 Publisher's contact details