Privacy Notice — Bonbon Books

1. Who is the data controller

Bonbon Books is operated by Stacey DeSmedt ("we", "us", "our"). We act as the data controller for the personal data described in this Notice. If you have any questions, email privacy@frenchfun.ca.

2. Personal data we collect

We collect the following categories of personal data:

Teacher / parent account data: name, email address, hashed password, plan and subscription status.
Student game-account data: a display name or nickname chosen by the teacher/parent, an avatar, a 4-digit PIN (stored hashed), progress and quiz results, and bonbon totals. We do not require or ask for a student's real name, email, or date of birth.
Content you upload: flipbook images, text, and audio files.
Support messages: the contents of any message you send us.
Technical data: IP address, browser and device information, and basic usage/telemetry needed to run and secure the Service.
Cookies: essential cookies to keep you signed in and to remember preferences (see section 9).

Payment card details are collected and processed directly by Paddle, our Merchant of Record. We never see or store full card numbers.

3. Why we use it and legal basis

To provide the Service — create accounts, host flipbooks, track student progress and bonbons. Legal basis: performance of a contract.
To take payment and manage subscriptions — via Paddle. Legal basis: performance of a contract and compliance with tax/legal obligations.
To keep the Service secure — detect fraud, abuse, and technical issues. Legal basis: our legitimate interests in a safe Service.
To improve the product — anonymous or aggregated usage analysis. Legal basis: our legitimate interests.
To provide support — respond to your messages. Legal basis: our legitimate interests / performance of a contract.
Marketing — occasional product updates to teachers/parents who signed up. Legal basis: consent (which you can withdraw at any time).

4. How we share data

We share personal data only with:

Service providers / subprocessors who host and operate the Service (cloud hosting, database, storage, transactional email, error monitoring).
Paddle.com Market Ltd, our Merchant of Record, who processes payments, calculates and remits tax, and issues invoices and refunds.
Professional advisers (legal, accounting) where necessary.
Authorities where required by law, court order, or to protect our rights or the safety of users.

We do not sell personal data, and we do not use student data for advertising.

5. International transfers

We are based in Canada and our providers may process data in Canada, the United States, and the European Union. Where personal data leaves your country, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We keep personal data for as long as your account is active and for a reasonable period afterwards to meet legal, tax, and dispute-resolution obligations. Student accounts and their progress are deleted when the teacher/parent removes the student or closes their account. Billing records held by Paddle are retained according to Paddle's own policies. Backups are rotated regularly and deleted on a rolling schedule.

7. Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data or complete incomplete data.
Delete your account and associated data ("right to erasure").
Restrict or object to certain processing.
Receive a portable copy of the data you provided.
Withdraw consent where processing is based on consent.
Lodge a complaint with your local data-protection authority. In Canada, this is the Office of the Privacy Commissioner (priv.gc.ca). In the UK/EEA, contact your national supervisory authority.

To exercise any of these rights, email privacy@frenchfun.ca. We will respond within one month.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, encrypted storage, hashed passwords and PINs, row-level access control in our database, and least-privilege access for our team. No system is perfectly secure, so we also monitor for and respond to incidents.

9. Cookies

We use a small number of essential cookies to keep you signed in and to remember basic preferences. We may also use privacy-respecting analytics to understand how the Service is used. You can control cookies via your browser settings; blocking essential cookies may prevent you from signing in.

10. Children

Bonbon Books is designed to be used by children under adult supervision. Student game accounts are created by a teacher or parent, and children do not provide their own contact details or create their own accounts. We ask teachers and parents not to include real names, addresses, or other identifying details in student nicknames or uploaded content.

11. Changes to this Notice

We may update this Notice from time to time. When we do, we will change the "Last updated" date at the top and, for material changes, notify you by email or an in-app notice.

12. Contact

Stacey DeSmedt — privacy@frenchfun.ca.