KidsConfetti Privacy Notice

Version of 24.10.2026 · Translation. The French version prevails.

This notice explains what personal data KidsConfetti processes, why, who receives it, how long it is kept and what your rights are. It is based on the Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) and its Ordinance (DPO).

---

1. Controller

[to be completed], sole proprietorship "KidsConfetti", [to be completed], Switzerland
Email: hello@kidsconfetti.ch

For any data protection question or to exercise your rights, write to this address. We have not appointed a data protection advisor.

2. What data do we process, and why?

2.1 Visiting the website

• Technical server logs: on each visit our host automatically records technical data (IP address, date and time, page requested, browser, response code). Purpose: operation, security, abuse detection. Retention: for the retention period set by our host Infomaniak (usually a few weeks at most), then automatic deletion.
• Internal statistics: we count listing views and clicks to providers. The IP address is never stored in clear: it is replaced by a keyed cryptographic hash (HMAC; for IPv6 only the network prefix is used). Purpose: knowing which listings are useful, showing providers aggregated statistics, detecting abuse. Retention: 24 months.
• Abuse protection: to limit the number of requests, we briefly keep a keyed hash of the IP address and email address. Retention: 24 hours at most.
• Cloudflare Turnstile bot check: if we enable the Cloudflare Turnstile bot check, the request form is protected by this service, which analyses technical browser data (including the IP address) to tell humans from bots. See sections 4 and 5.

2.2 Cookies

We use only the following two cookies, neither of which is used for tracking:

• a session cookie (technical), needed to secure forms (CSRF protection) and, for providers, to stay logged in to their account for up to 8 hours; it is deleted when you close the browser;
• the kc_town cookie (functional), which remembers the town you chose so that we can show you nearby providers; it is kept for 365 days and is not used for tracking.

We use no advertising, third-party analytics or social media cookies. If we enable the Cloudflare Turnstile bot check, Cloudflare may use technical mechanisms strictly necessary for that check.

2.3 Parents' requests

When you send a request, we process:

• your name, email address and, if you provide it, your phone number;
• party details: date, time slot, town, child's age, number of children, budget and your message (all optional except date, time slot and town);
• the providers chosen, the request reference, the date sent and a keyed hash of the IP address (abuse prevention).

Purposes: checking that the request really comes from you (email confirmation), forwarding it to the providers you chose so they can answer you, sending you an acknowledgement, being able to help if a provider does not answer, preventing abuse and producing anonymised statistics.

Data about your child: we do not ask for the child's name or photo, only their age and the number of children. Do not include health information in the message unless necessary (e.g. an important allergy). If you do, you expressly consent to this information being passed to the providers you chose, solely to prepare the party. You may withdraw this consent at any time for the future (providers that have already received the request must then be contacted directly).

Forwarding: nothing is sent to providers before you confirm via the link received by email. After confirmation, your request (including your name, email and phone) is sent only to the providers chosen, at the email address they provided or, for an unclaimed listing, the business email address published on their website. Your email address is set as the reply-to address so they can answer you directly. KidsConfetti receives an internal notification with the date, town, age, number of children and providers chosen (without your contact details).

Providers' responsibility: once received, each provider processes your data under its own responsibility (independent controller) and under its own privacy notice. Our terms prohibit them from using your data for advertising without your consent.

Retention: an unconfirmed request is deleted after 7 days. A confirmed request is deleted after 24 months (so that questions, complaints or abuse relating to the request can be handled). Emails already sent to providers remain in their inboxes, under their responsibility.

2.4 Contacting us

If you write to us (email, error report), we process your contact details and the content of the message to reply. Retention: as long as needed to handle your matter, at most 24 months, unless a legal retention obligation applies.

2.5 Providers

• Unclaimed listings: these contain only business information that the provider itself made public, usually on its website: trade name, category, town, website, business email and phone, published offer and prices, plus source and verification date. This data may relate to a natural person (e.g. a self-employed person). Purpose: showing parents the local offer and letting them contact the provider. This processing is based on our and parents' overriding interest in an overview of the offer and concerns data the person has made generally accessible (art. 30 para. 3 and art. 31 para. 1 FADP). The provider may object at any time: we will then hide the listing immediately and delete its data within 5 working days, except the name and website address, which are kept only so that the listing is not re-created (see section 7).
• Information email to listed providers: we send, once per email address, to the published business email address of a provider whose listing is unclaimed, an information notice under art. 19 FADP: which data about it we hold, where it comes from (the provider's own website), why we process it and what its rights are (have its listing corrected, claim it free of charge, have it removed). This email states our identity and address and contains no advertising. This processing is based on our legitimate interest in accurate listings and in informing the person concerned (art. 31 para. 1 FADP); the provider may object at any time via the link in the email, confirming its choice on the page that opens. To make sure this email is sent only once, we keep the date it was sent and a cryptographic hash of the email address.
• Unsubscribe: every email to a provider contains an unsubscribe link. To respect this choice permanently, we keep a cryptographic hash of the email address, without the address in clear, for as long as needed to stop sending messages.
• Claimed listings and accounts: business email address, published content (texts, photos), history of requests received, one-time login and claim links (valid for 1 hour when requested via the claim form on the website, 7 days in emails forwarding requests to providers, 21 days in the one-time information email to listed providers; deleted 7 days after expiry), security log (24 months).
• Paid plans: name or company name, billing address, email, plan chosen, payment history and invoices. Card or TWINT data is processed directly by Stripe; KidsConfetti has no access to full card data. Accounting records are kept for 10 years (art. 958f Code of Obligations).

2.6 Moderation of listings

When a provider edits the content of its listing, the change is checked automatically before publication, first by rules on prohibited content and links, then by an automated check carried out by an artificial intelligence model from Anthropic, acting as processor. Our contracting party is Anthropic Ireland, Limited (Ireland); processing takes place in the USA at Anthropic PBC. Only the following data is sent to Anthropic: the listing's name and category and the edited fields (description, prices, ages, region, languages, phone, website). This may include the provider's business data (e.g. the name of a self-employed person), but never parents' data. Under Anthropic's commercial terms, customer content sent via its API is not used to train its models. Purpose: protecting families and the Platform against unlawful, misleading or inappropriate content. A change that does not pass the check is not refused automatically: it is reviewed by a person (see section 3). Pending edits (including the provider's email address) and moderation records are deleted after 24 months. See also sections 4 and 5.

2.7 Reports

When you report a listing, we store the listing concerned, the reason chosen, your message, your email address if you provide it (optional) and a keyed hash of the IP address (abuse prevention). Purposes: safety of children and families, accuracy of listings, reviewing the report and, where appropriate, replying to your message. Retention: 24 months.

3. No profiling, no advertising

We carry out no profiling, no automated individual decision-making (art. 21 FADP), no targeted advertising and no cross-site tracking. We do not sell or rent any data. We do not send newsletters without your express consent.

4. Recipients

Your data is disclosed only to the following recipients, and only as far as necessary:

• providers chosen by you (section 2.3), as independent controllers;
• Infomaniak Network SA, Geneva (Switzerland): hosting of the website, database and email service, as processor; data is stored in Switzerland;
• Stripe (Stripe Payments Europe Ltd., Ireland, our contracting party for Switzerland, and Stripe group companies, in particular Stripe, LLC in the USA): processing of providers' payments, as processor and, for fraud prevention and its own legal obligations, as independent controller;
• Anthropic Ireland, Limited (Ireland), our contracting party, and Anthropic PBC (USA), which carries out the processing: automated check of listing edits made by providers (section 2.6), as processor; no parents' data is sent;
• Cloudflare, Inc. (USA): Turnstile bot check, if we enable it;
• advisers bound by confidentiality (accountant, lawyer) where necessary; authorities where the law requires; if the Platform is taken over, the successor, who would be bound by this notice.

Our processors are contractually required to process data only on our instructions and to protect it appropriately.

5. Disclosure abroad

Platform data is hosted in Switzerland. Data may be disclosed abroad only in the following cases:

• Stripe (providers' payments): Ireland (EU, recognised as adequate by the Federal Council) and the USA, where Stripe, LLC is certified under the Swiss-U.S. Data Privacy Framework, recognised as adequate by the Federal Council since 15 September 2024; otherwise on the basis of standard contractual clauses recognised by the FDPIC;
• Cloudflare (if we enable Turnstile): USA, on the same basis;
• Anthropic (moderation of listings, section 2.6): Ireland (recognised as adequate by the Federal Council) and the USA. As Anthropic is not certified under the Swiss-U.S. Data Privacy Framework, the disclosure to the USA is based on standard contractual clauses with the Swiss addendum, included in Anthropic's data processing addendum; only the listing data described in section 2.6 is sent;
• a provider located outside Switzerland, if you choose it: the disclosure is then necessary for concluding or performing a contract in your interest (art. 17 para. 1 let. b FADP).

6. Security

We take appropriate technical and organisational measures: encrypted connection (HTTPS), hosting in Switzerland, administrator access protected by two-factor authentication, one-time login links, keyed hashes instead of IP addresses in clear, restricted access, automatic deletion after the stated periods. No transmission over the internet is completely secure, however. In the event of a data security breach likely to result in a high risk, we will inform the FDPIC and, where necessary, the persons concerned (art. 24 FADP).

7. Your rights

You may at any time, free of charge and without giving particular reasons:

• ask whether we process data about you and obtain a copy (right of access, art. 25 FADP); we reply in principle within 30 days;
• have inaccurate data corrected;
• request deletion of your data or object to processing, subject to legal retention obligations (e.g. accounting records);
• receive the data you provided to us in a common format (data portability, art. 28 FADP);
• withdraw consent for the future.

To do so, write to hello@kidsconfetti.ch. We may ask for reasonable proof of identity (e.g. replying from the email address concerned) so that no third party obtains your data. For data that providers received with your request, contact them directly; we will gladly help you identify them.

You may also file a report with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

8. Children

The Platform is aimed at adults (parents and professionals). We do not knowingly collect data directly from children. If a child has sent us data, please contact us so that we can delete it.

9. Changes

We may update this notice when the Platform or the law changes. The current version is published on the website with its date. Material changes are notified to registered providers by email.

10. Languages

This notice exists in French, German, Italian and English. In case of discrepancy, the French version prevails.

---

[to be completed], [to be completed] – KidsConfetti – hello@kidsconfetti.ch – Version of 24.10.2026