Privacy Policy

Gardspace is operated by The Citadel - Épopée SAS, a French company (SIREN 999 058 829) based in Chatou (78). This Privacy Policy explains how we collect, use, and protect your personal data when you use the Gardspace application and website.

1. Data we collect

We collect data that you provide directly.

Account information: email address, name, and role (Family or Professional). For nannies: country of residence (used to determine your G-TRID country code), and date of birth (used for age verification only — never displayed publicly). For families: country of residence (used to build the nanny's verified activity record across countries).

Child information: first name, date of birth, profile photo (optional), and child gender — used solely for grammatical accuracy in Daily Reports generated in French. Child gender is never used for profiling, advertising, or any analytical purpose.

Session data: session logs, event entries (meals, naps, activities, observations, notes, memories), Daily Reports, and Handover Notes entered in the Care Space.

Media: photos and videos captured directly in the Gardspace application. Photos and videos are automatically deleted after 48 hours. Download is available to parents during this period. Media is never accessible via public URLs — only via time-limited signed URLs.

Professional data (nannies): NTR (Nanny Track Record), G-TRID identifier, Passport PDF content, and declared profile information.

We also collect technical data: device type, operating system, app usage data, and crash reports. We do not collect advertising identifiers or sell your data to third parties.

2. How we use your data

We use your data to provide the Gardspace service — generating Daily Reports, building the NTR, activating the G-TRID, and maintaining the Care Space.

Country of residence data is used to assign a permanent professional identifier (G-TRID) to nannies and to build their verified activity record across countries. This data is not used for advertising or shared with third parties for commercial purposes.

Date of birth (nannies) is used solely for age verification and is never displayed publicly or shared with families.

Child gender is used solely for grammatical accuracy in Daily Reports generated in French. It is not used for any profiling, advertising, or analytical purpose.

3. Data storage and security

Your data is stored on secure servers within the European Economic Area. We use encryption in transit and at rest. Access to data is strictly limited to authorised personnel.

Media files (photos and videos) are stored temporarily with a 48-hour TTL and are accessible only via time-limited signed URLs. They are never publicly accessible and are automatically and permanently purged after 48 hours, regardless of account status.

4. Data retention

Account data is retained for as long as your account is active. Session logs and Daily Reports are retained permanently within your Care Space and are accessible to the family at all times.

Upon account deletion — Nanny accounts: the G-TRID is anonymised and retained in an audit log for record integrity. All other personal data is permanently deleted within 30 days. Family accounts: the Care Space and all associated data — sessions, reports, memories, and child information — are permanently deleted within 30 days.

Media files (photos and videos) are automatically purged after 48 hours regardless of account status.

5. Children's data

Gardspace is designed to protect children's data. Child-related content belongs to the family and stays within their Care Space. We never use children's data for advertising, analytics sharing, or third-party purposes of any kind.

If you are a parent or guardian in the United States creating a Care Space for a child under 13, please refer to our Children's Privacy Notice for information about our compliance with the Children's Online Privacy Protection Act (COPPA).

6. Your rights

Under GDPR, you have the right to access, correct, and delete your personal data. To exercise these rights, contact us at privacy@gardspace.com or visit our Data Deletion page. We will respond within 30 days.

If you are based in the United Kingdom, our UK Representative is The Citadel - Épopée. Our ICO Registration Number is ZC114076 (registered 01 April 2026 · expires 31 March 2027). Our Data Protection Officer can be reached at privacy@gardspace.com.

7. Cookies

The Gardspace website uses no advertising cookies. We use strictly necessary cookies for session management and security. No third-party tracking cookies are set without your explicit consent.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the application or by email. Continued use of Gardspace after notification constitutes acceptance of the updated policy.

9. Contact

The Citadel - Épopée SAS
66 Rue du Lieutenant Ricard · Chatou 78400 · France
privacy@gardspace.com