Privacy policy for FamiZ (www.famiz.fr)
This translation is provided for information only; only the French version is authoritative. Read the French version
Last updated: November 13, 2026
This page explains what data FamiZ (www.famiz.fr) uses, why, how long we keep it and how to exercise your rights. The other FamiZ applications each have their own policy.
Who is responsible for your data?
FamiZ (www.famiz.fr) is published by Aurélien SEMENCE and Sandrine SEMENCE, private individuals, in a non-professional capacity (together, "the publisher"; see the legal notice). They decide together how your data is used and how it is processed: they are its "joint controllers" (article 26 of the GDPR). Under their arrangement, a single address, privacy@famiz.fr, receives all requests; you may exercise your rights with either of them, and Aurélien SEMENCE answers them and keeps the record of processing activities. There is no data protection officer, as one is not mandatory for this service.
We send no advertising, and we neither sell nor rent out your data.
What FamiZ processes
FamiZ is the site where you manage your account, your family and the people close to you.
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Your family's profiles: first name; last name, date of birth, profile photo and notification address, if you wish; language, time zone, links between parents and children, right to manage the account | To put your family together | Contract | As long as the account exists |
| Your guests: first name of the people close to you that you add; last name and email address, if you know them; date added, and whether they have agreed to be recognized | To share with people close to you who do not have an account | Contract (yours); legitimate interest for the guest | Until you remove the guest, or until the account is erased |
| Your circles of people close to you: circle name, members, close circle or not | To organize the people close to you | Contract | As long as the account exists |
| Invitations to an adult: first name and email address of the invited adult; last name and date of birth, if you wish; children shared | To share the follow-up of the same children between two accounts | Contract (yours); legitimate interest for the guest | Valid for 7 days, erased 90 days later |
| Profile share links: profile shared, who issued the link, who used it | To attach a profile to another account | Contract | Valid for 24 hours (7 days at most), erased 90 days after it expires |
| Sites blocked for a profile | To let the manager decide which sites are open to each profile | Contract | As long as the account exists |
| "My emails": for each profile and each email channel of each site, subscribed or not, the date and origin of the last change | To send only the emails you have chosen | Consent | As long as the profile exists; only the latest choice is kept |
| The contact form: your address, your name, the subject, your message, the language and the page you are writing from, your account if you are signed in | To reply to you | Legitimate interest | 12 months, or until the account is erased |
The people you add (guests, invited adults) did not ask for anything. Only add people who agree to be contacted. Their address is used only for the emails that concern them: an invitation, or a list being shared. A guest learns nothing about your account, and you never learn whether their address already has a FamiZ account.
The contact form is limited to a few messages per hour. To enforce this, the sender's IP address and email address are kept for one hour in a scrambled form, then erased. The publisher is notified of your message and replies to you by email.
Your FamiZ account, shared across the applications
FamiZ uses the FamiZ account, shared by all FamiZ applications: a single sign-up and a single sign-in for all of them. This account is managed by the central account service, hosted by Amazon Web Services (AWS), in its Paris region.
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Account email address, password (stored hashed, so that no one can read it back) | To sign you in | Contract | As long as the account exists |
| Account profiles: first name; last name, date of birth, profile photo and notification address, if you wish; language, time zone, role in the account | To recognize you on each site, in your language and your time zone | Contract | As long as the account exists |
| Sign-ins: last activity, "remember me" choice | To keep you signed in | Contract | 1 hour without activity, or 1 year with "remember me" |
| Two-step verification, if you turn it on: the app's encrypted secret, hashed backup codes; for each security key or passkey, its public key, the name you give it and the dates it was added and last used | To protect your account | Contract | Until it is turned off, or until the key is removed |
| Sites used: date of each profile's first visit | To know which sites you use | Contract | As long as the account exists |
| Codes sent by email (verification, reset, change of address) | To prove that the address is yours | Contract | 15 minutes |
| Delivery status of your address: an email permanently rejected, a spam complaint, or 5 temporary failures in a row within 30 days | To stop writing to an address that rejects our emails; to ask you to re-verify it or change it | Legitimate interest | The "Your emails no longer arrive" flag on your account: 6 months; the count of temporary failures: 30 days; the AWS list of blocked addresses: until you re-verify the address |
| Technical logs of the central service (requests, errors) | To run the service, fix errors, prevent abuse | Legitimate interest | 6 months |
An account with no sign-in for 3 years is deleted: an email warns you 30 days before, then a reminder 7 days before. Simply sign in to any of the sites to keep it.
Account emails (verification code, password reset, account activated, invitation, change of address, security alerts) are sent through Amazon SES, from noreply@famiz.fr. We keep no copy of them. They carry the brand of the site the action came from, "by FamiZ".
The platform administrators, that is, the publisher and the people they authorize, who act under the publisher's responsibility, may look at your account for support, for security or to answer a request to exercise your rights. Each of their accesses is recorded, with its reason, in a log kept for 1 year. They may also review CadeauZ content that has been reported, to decide what action to take.
Erasing your account erases it from all the sites: profiles, lists, preferences, activity in each application, second factor and sessions. Gifts you reserved on other families' lists stay reserved, without your name, so as not to spoil their surprise. Once closed from "My FamiZ account", your account is no longer visible to others and is only erased 30 days later: signing in again before then cancels the closure. Erased data disappears from the backups no later than 35 days afterwards.
The account's processor
Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, hosts the central service (Paris region), sends the emails (Amazon SES, Paris region) and delivers the sites and images (CloudFront).
AWS is a company governed by US law. So that pages and images load quickly, CloudFront keeps temporary copies of them as close as possible to visitors, including outside the European Union. These transfers are covered by the European Commission's standard contractual clauses and by Amazon's participation in the Data Privacy Framework between the European Union and the United States.
Where is your data?
Your data stays in France: FamiZ and the central account service are hosted by AWS, in its Paris region, and the audience statistics are kept by the publisher, in France.
Who can see your data?
- The members of your account, according to their rights, and the people close to you that you share with, according to what you choose.
- The platform administrators, for support and security: their access is personal to each of them and recorded in the log.
- AWS, our host, which acts on our behalf.
Cookies and storage in your browser
We only use cookies that are necessary for the service. They are not used for advertising or to track you, and do not require your consent.
| Cookie or storage | What it is for | Duration |
|---|---|---|
Sign-in cookie (__Secure-famiz_session) | To keep you signed in from one site to another | Until the browser is closed, or 1 year with "remember me" |
Language (famiz-locale) | To remember the chosen language | 1 year |
Theme (famiz-color-theme) | To remember the light or dark theme | 1 year |
Audience measurement opt-out (famiz-no-stats) | To remember that you refused audience measurement on FamiZ | Until you turn it back on |
Audience measurement
To know which pages are useful and whether they load fast enough, we measure traffic on FamiZ with GoatCounter, an open-source tool that we host ourselves, in France. No data is passed on to a third party.
- We count visits to each page (its template, never a list or profile identifier), the site you came from, your browser, your operating system, your screen size, your browser's language and your country. We never go more precise than the country.
- We also measure how long pages take to display. These measurements are added up per day, per page and per device type, without any identifier.
- No cookie is set. Your IP address is not kept: CloudFront, at AWS, derives the country and the day's fingerprint from it, then removes it before passing on the measurement.
- To count each day's visitors, we keep a visit fingerprint until the next day, computed with a secret key, which cannot be used to recover your address. After that, only the number of visitors for the day remains.
- Measurements wait for at most 14 days, encrypted, in an AWS queue in Paris, before reaching us.
- FamiZ is measured separately from the other sites: we do not follow you from one site to another, nor on other sites, and these statistics are never linked to your account.
- They are kept for 25 months at most.
This measurement meets the CNIL's conditions for being exempt from consent. You can still refuse it with the "Audience measurement" switch at the bottom of every page. It is also turned off automatically if your browser sends the Global Privacy Control signal.
Children
The holder of an account is at least 15 years old. Profiles of younger children are created and managed by an account manager, their parent or the person responsible for them: no child under 15 signs up alone. A child's profile does not need an email address and cannot change the account's security. Its data is protected like that of the rest of the family, and erased with the account.
The security of your data
- All communications are encrypted (HTTPS).
- Passwords are never stored in plain text.
- You can turn on two-step verification, with an app or a security key; it is mandatory for the platform administrators.
- With a security key or a passkey, your fingerprint or face never leaves your device: we only receive a public key. A passkey also lets you sign in without a password, with no additional data.
- An email alerts you to every significant change to your account's security.
Your rights
At any time, you can:
- get a copy of your data, in a file you can reuse elsewhere;
- correct your data: most of it can be changed directly on the site;
- have your account and your data erased, yourself from "My FamiZ account" if you manage the account, or by writing to us;
- object to a use based on our legitimate interest, or ask for it to be restricted;
- withdraw your consent to an email you chose, from "My emails" or the unsubscribe link in the email.
Write to privacy@famiz.fr. We reply within one month. To protect your account, we may ask you to confirm your identity.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr).
Changes
This policy may change. If there is a significant change, we will let you know by email or on the site.