Privacy policy
Version 1.0 — Last updated: 21 September 2026
Dualia organises the life of a separated family. That means data about you, about the other parent, and about your children. This document explains what we do with it, plainly and without empty phrasing.
1. Who processes your data
Dualia is published by R DIGITAL INSTORE, a simplified joint-stock company with a sole shareholder, registered with the Paris Trade and Companies Register under number 939 683 462, with its registered office at 60 rue François 1er, 75008 Paris, France.
R DIGITAL INSTORE is the data controller for your personal data within the meaning of the General Data Protection Regulation (GDPR). Contact: contact@dualia.app.
No data protection officer has been appointed to date. Such an appointment is not mandatory for an organisation of our size; it will be reconsidered as the volume of data processed grows.
2. What we collect, and why
Data you provide to us.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password | Create and secure your account | Performance of the contract |
| First name | Identify you to the other parent | Performance of the contract |
| Your children's first name, date of birth and school | Organise the calendar and family information | Performance of the contract |
| Custody calendar, events | Organise shared family life | Performance of the contract |
| Expenses, amounts, receipts | Split costs between parents | Performance of the contract |
| Messages between parents | Enable communication | Performance of the contract |
| Parenting decisions | Keep a dated record of agreements | Performance of the contract |
| Memories, photos, journal | Build the family record | Performance of the contract |
| Documents (court orders, certificates, invoices) | Keep family documents in one place | Performance of the contract |
| Emergency contacts | Enable a relative to be reached in an emergency | Vital interests of the child |
Data we collect automatically. We keep connection dates and the email address associated with each action, in order to secure accounts and to trace changes in a space shared between two parents.
Dualia uses no advertising cookies, no third-party trackers and no analytics tools. The only data stored on your device is what the application needs to work: your login session and display preferences.
The website form. If you complete the "Become a pilot partner" form on dualia.app, your name, email address, organisation name and message are sent to us through Web3Forms (Zenuxlabs). This information is used solely to get back to you about the pilot programme, on the basis of your own initiative, and is kept for two years from the last exchange. The provider erases it on its side no later than three years after it was sent.
3. Your children's data
Dualia processes data concerning minors. This processing is based on parental responsibility: by creating a family space, you declare that you hold parental responsibility for the children you enter there, and that you are acting in that capacity.
- We collect no data directly from the child. Everything is entered by a parent.
- The child has no Dualia account and receives no communication from us.
- We carry out no profiling of children, no targeted advertising, no behavioural analysis.
- A child's data is accessible only to the parents of their family space and to the people those parents expressly invite.
When the child reaches the age of majority, they hold all the rights described in section 9 over the data concerning them, and may write to us directly at contact@dualia.app.
4. Health data
Some of the information you may enter constitutes health data within the meaning of Article 9 GDPR: a child’s allergies and intolerances, blood group, family doctor, health insurance provider, and any health document you upload.
These fields are optional. You can use Dualia without filling them in. By choosing to complete them, you expressly consent to Dualia keeping them for the use described here (Article 9(2)(a) GDPR). You may withdraw that consent at any time by deleting the data concerned, without affecting the rest of your space.
What we do not do, and will not do: no medical interpretation, no diagnosis, no treatment recommendation; no disclosure to an insurer, an employer or a health body; no use for statistical or commercial purposes, or for training models.
Dualia is not a certified health data host (French HDS certification). The health information you enter is what you upload yourself, outside any care setting. We offer no feature intended for healthcare professionals.
5. Who can access your data
This is what makes Dualia particular: your space is shared. You need to know precisely who sees what.
The other parent sees the entire content of the family space: calendar, children, expenses, decisions, memories, documents, messages. Two exceptions, which you control: your home address is visible only if you turn it on in your household settings, and time capsules cannot be read before their release date.
Apart from these two cases, assume that everything you put in a shared space is visible to the other parent. Dualia is not a private space, it is a common one. If you have several family spaces, they are strictly separated: no parent sees the content of a space they do not belong to.
Third parties you invite — a grandparent, a childminder, a professional — can only access what you open to them. The exact extent of that access is shown to you at the moment of the invitation. It is revocable at any time and is never granted without an explicit action on your part.
Our team. Access to production data is limited to those who need it to keep the service running, and is logged.
No one else. We do not sell, rent or exchange your data. We pass it to no commercial, advertising or analytics partner. In the event of a judicial order, we disclose only what the authority strictly requires, and we inform you unless legally prohibited from doing so.
6. Where your data is, and who hosts it
Your data is stored in France, in data centres located in Paris.
| Processor | Role | Servers | Head office |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, document and photo storage | Paris (eu-west-3) | United States |
| Vercel, Inc. | Application processing | Paris (cdg1) | United States |
| GitHub, Inc. | Delivery of the application and website | Global network | United States |
| Anthropic PBC | Automatic analysis of documents you submit (section 8) | United States | United States |
| Zenuxlabs (Web3Forms) | Delivery of the website’s "pilot partner" form | AWS, several regions | India |
An important distinction. The content of your family space — accounts, children, documents, photos, messages — is stored and processed in France. The application itself, however, is delivered to you by a global content network. That network receives no content from your space, but it does technically record your IP address when pages load, as any web server does.
Transfers outside the European Union. These providers are companies whose technical teams may, in limited maintenance-related cases, access the infrastructure. Such transfers are governed by the European Commission’s standard contractual clauses.
7. How long we keep your data
| Data | Period |
|---|---|
| Active account | For as long as you use the service |
| Inactive account | Deleted after 2 years without a login, following a warning sent one month beforehand |
| Family space content | For as long as the space exists (see below) |
| Dated parenting decisions | 5 years from creation, given their possible evidential value |
| Documents submitted for automatic analysis | Not retained by the analysis provider after extraction |
| Data of a deleted account | Erased 30 days after the request |
| Login logs | 12 months |
| "Pilot partner" form | 2 years from the last exchange |
The two-year period for inactive accounts follows the recommendation of the French supervisory authority (CNIL).
7.1 What happens when a parent deletes their account
Your account is deleted, the family space is not. In practice: you lose access to the space; your credentials and your own personal data are erased within 30 days; the content you created in the shared space remains accessible to the other parent — memories, photos, documents, decisions, expenses — and from then on appears under the label "Parent who left the space".
Why this choice. That content is not yours alone: it also concerns the other parent and your children. Allowing one parent, on leaving, to erase years of childhood memories and the history of parenting agreements would expose the other parent and the children to an irreversible loss — a real risk where a separation is conflictual. The GDPR expressly provides for this limit: the right to erasure does not apply where retention is necessary for the establishment or exercise of legal claims (Article 17(3)(e)), nor where it would adversely affect the rights of a third party.
If you believe specific content should nonetheless be erased, write to us at contact@dualia.app: every request is examined individually. If both parents delete their accounts, the family space and all its content are erased within 30 days.
8. Automatic document analysis
Dualia can analyse a document you upload — a court order, a parenting agreement, an invoice, a till receipt — to extract the useful information: amounts, dates, cost-sharing rules, custody schedule.
This analysis only takes place on documents you choose to submit for that purpose. No document in your space is analysed on our initiative or in the background.
- The document is sent to our analysis provider, Anthropic PBC;
- the information is extracted and shown to you on screen;
- nothing is saved without your confirmation — you check, correct, then confirm;
- the document is not retained by the provider after extraction.
You always stay in control. Dualia proposes, you decide. No automatically extracted information is applied to your family arrangement until you have confirmed it. You can use Dualia without ever relying on this feature and enter your information by hand.
9. Your rights
You have the rights of access, rectification, erasure (within the limits set out in 7.1), portability, objection, restriction, and the right to withdraw your consent at any time for the processing that depends on it — health data and automatic analysis.
To exercise these rights, write to us at contact@dualia.app. These requests are currently handled manually: there is not yet a dedicated screen in the application to delete your account or export your data. We reply within one month. Proof of identity may be requested where there is serious doubt about the identity of the person making the request.
Complaints. If our answer does not satisfy you, you may contact the French supervisory authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr, or the supervisory authority of your country of residence.
10. Security
- Encryption in transit between your device and our servers (HTTPS);
- encryption at rest on our servers;
- strict separation between family spaces, enforced at database level: a parent cannot technically reach the data of a space they do not belong to;
- documents and photos are not publicly accessible: each view goes through a temporary, signed, time-limited link;
- password protection: passwords found in known breaches are refused, with a ten-character minimum and a complexity requirement;
- daily database backups.
What we do not claim. Dualia is to date neither eIDAS-certified nor a certified health data host (HDS). Parenting decisions recorded in Dualia are dated and retained, but they do not constitute a qualified timestamp within the meaning of Regulation (EU) No 910/2014. We state this explicitly, because any suggestion to the contrary could lead you to attribute to them a legal weight they do not have.
In the event of a data breach likely to result in a risk to your rights, we will inform you as soon as possible and notify the CNIL within 72 hours, in accordance with Article 33 GDPR.
11. Changes to this policy
Any substantial change will be notified to you by email and in the application, at least fifteen days before it takes effect. The version in force is always available at dualia.app/en/confidentialite.html.
12. Contact us
R DIGITAL INSTORE — 60 rue François 1er, 75008 Paris, France — contact@dualia.app
This translation is provided for convenience. In the event of any discrepancy in interpretation, the French version prevails and is available at dualia.app/confidentialite.html.