Missioni di Famiglia
Version 3.8.0 — in force from 1 November 2026 · Italian version
Missioni di Famiglia is an app that helps parents organise their children's small daily tasks, assigning points and rewards. The parent signs up. For each child the parent gives a name, which may be a nickname. The Provider does not sell data. There is no advertising in the app.
Provider: MFStudios
Email for privacy matters: assistenza@missionidifamiglia.com
For any privacy question, a message can be sent to the email address indicated above: the Provider answers directly.
Parent's data: first name and surname entered at registration, from which the family's name is formed; email address; password (never stored in clear text, only as a non-reversible cryptographic hash); the date the account was created and the login dates; the IP address of login attempts, kept for a short time only in order to block automated intrusion attempts.
If the parent signs in with their Google account, the Provider receives from Google the email address and the confirmation that it is verified, and uses them to create the account and allow access. Google Ireland Limited processes the access data under its own privacy notice.
What remains on record when an email is sent: an internal log keeps the destination address, the type of message, the date and the outcome of the sending.
Proof of what was accepted. When the parent accepts the Terms of use and this notice, the Provider keeps the text shown on screen, its version, the language, the date, the time and the network address of the acceptance (Art. 7(1) GDPR).
Subscription data, if activated: outcome, date and amount of each payment; the last four digits and the network of the card; the identifiers of the subscription and of the customer with the payment provider; the data needed to issue tax documents. The full card number is neither seen nor kept by the Provider: it is entered in fields hosted by Stripe (see point 4).
The country of residence and the country of the card. At sign-up the parent declares the country of residence, and at the time of payment the Provider receives from Stripe the code of the country of the bank that issued the card. Both are kept, but for different purposes: the country declared by the parent serves to comply with tax obligations, to establish which law protects the parent as a consumer and to verify that the service is offered where it may be offered; the country of the card serves only for tax documents, because it is the only indication of place that does not come from the parent (art. 6(1)(b) and 6(1)(c) GDPR). The country of the card comes from the bank, not from the parent, and does not decide whether a subscription is possible: the card may have been issued in any country. It is not used for any other purpose.
Children's data, entered by the parent: the name or nickname, up to 16 characters; the username for access, which the app builds from that name by adding a number and which the parent can change; the password chosen by the parent; the missions assigned and those completed, with date and time; the points accumulated, the corresponding value, any warnings and notes written by the parent.
What the app records while the child uses it. The rewards produce other data, referring to the child's profile and visible inside the parent's account: the drawn face chosen on first entry; the medals and trophies obtained; the recovery tokens received and used; the Den items; the contents of the Vault; the experiences requested and the diploma.
Photographs or videos cannot be uploaded to the app. The parent undertakes not to enter the information listed in point 8 of the Terms of use.
The marker of a free trial already used. If the sign-up begins with the free trial, at the moment the trial comes into being the Provider keeps two markers whose only purpose is to prevent the same family from starting a second one: a non-reversible cryptographic fingerprint of the parent's email address — the address in clear text is not written anywhere — and a random number, with no personal data inside it, in the mdf_pv cookie on the device from which the trial started. The network address is not used for this check. The details, including how long they are kept, are at point 9.
If notifications are turned on. Notifications are off and are turned on only on request from the app. From that moment the Provider keeps the notification subscription delivered by the browser — a delivery address and two encryption keys — together with the type of device and the language, and the person of the family to whom it belongs. No advertising identifier. If notifications are turned off from the app, the subscription is deleted immediately; if the permission is removed from the phone or the app is uninstalled, the browser answers with an error at the first sending and the subscription is deleted at that moment; a subscription not used for twelve months deletes itself.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating the account, allowing login and use of the app | Parent's data | Performance of the contract (art. 6(1)(b) GDPR) |
| Running the missions board, the points and the summary of the children | Children's data | Performance of the contract with the parent (art. 6(1)(b) GDPR) |
| Running the rewards: face, levels and ranks, medals, trophies, recovery tokens, Den, Vault, diploma | Children's data | Performance of the contract with the parent (art. 6(1)(b) GDPR) |
| Collecting the subscription and preventing payment fraud | Payment data | Performance of the contract (art. 6(1)(b)) and legal obligation of the payment provider |
| Keeping the app and the forms of the public pages safe: blocking suspicious automated logins and submissions, minimal technical logs | Username, IP, time | Security obligation of the controller (arts. 5(1)(f) and 32 GDPR) |
| Answering support requests | Email, content of the message and the technical data that the app attaches by itself (app version, starting page, screen size) | Performance of the contract / reply to a request of the data subject |
| Sending the notifications requested | Browser notification subscription, type of device, language | Performance of the contract / request of the data subject |
| Communications about similar services to those who have purchased | Email address | Legitimate interest (Art. 6(1)(f) GDPR; Art. 130(4) Italian Privacy Code) |
| Demonstrating acceptance of the Terms and of the policy, and of which version | Signed text, version, language, date, time, IP | Legal obligation of the controller (arts. 5(2) and 7(1) GDPR) |
| Knowing how many people visit the public pages and how many complete the sign-up | Visit counts, without network address, and whether the visitor is already a customer (point 9) | Aggregate statistics (Art. 122 Italian Privacy Code; Italian Data Protection Authority guidelines of 10 June 2021) |
| Issuing and keeping tax documents | Invoicing data | Legal obligation (art. 6(1)(c) GDPR) |
| Allowing the service to be resumed in the event of a return | Account, children's profiles and their history | Performance of the contract (Art. 6(1)(b) GDPR): retention for the stated period is agreed in the Terms of use, point 6 |
| Preventing the same family from taking the free trial more than once | Non-reversible fingerprint of the email and random number of the mdf_pv cookie (point 9) | Legitimate interest (art. 6(1)(f) GDPR): giving only once what is offered only once |
The processing of children's data, in full.
The children's profiles are the service requested by the parent: without them the app has nothing to show. That is why they are processed to perform the contract with the parent, without a separate consent. A consent without which the service would not work would not be freely given, and therefore would not be valid (art. 7(4) GDPR).
The processing is also based on the declaration made by the parent at sign-up: of being at least 18 years old and of exercising parental responsibility, guardianship or custody over the minors to be entered. That declaration applies to all the profiles created, including later ones.
The Provider does not ask the children for consent and does not offer the service to them: their profiles exist only inside the parent's account, they are not autonomous accounts, and the Provider has no direct relationship with them.
Which data to put in a child's profile is decided by the parent, who can remove it whenever desired: the functions to delete it are inside the app and are used without asking anything of the Provider. They are described at point 7.
The parent sees everything about the family. Each child, from the child's own profile, sees their own missions and points. No other family sees this data: there are no public leaderboards, no boards shared between families, and no social features.
Outside the app — the Provider's suppliers:
| Supplier | What it does | Where |
|---|---|---|
| Hostinger International Ltd. | Server hosting the app and the database | European Union |
| Stripe Payments Europe, Ltd. | Collection and management of subscription payments | Ireland (European Union) |
| Brevo SAS | Sending of service emails (address confirmation, password recovery, notices) | France, Belgium and Germany (European Union) — see point 5 |
| Aruba S.p.A. | Mailboxes of the service's two domains, including assistenza@missionidifamiglia.com: that is where correspondence with users arrives and stays | Italy (European Union) |
| Cloudflare, Inc. | Storage of the backup copy outside the service's server | Storage bound to European jurisdiction; the company is American — see point 5 |
| The Provider's accountant (Lapam Federimpresa) | Receives the electronic invoice of those who ask for one and forwards it to the Exchange System of the Italian Revenue Agency | Italy (European Union) |
| Anthropic Ireland, Limited | Program that reads the emails sent to assistance and helps prepare the reply | Ireland (European Union); processing also outside the Union — see point 5 |
Stripe. Card data is entered in fields hosted directly by Stripe inside the payment page: it does not pass through the Provider's servers, which neither see it nor keep it. The Provider receives and keeps only the outcome of the payment, the date, the amount, the last four digits and the network of the card, and the identifier of the subscription. Stripe acts in part as processor on behalf of the Provider (art. 28 GDPR) and in part as an independent controller for the obligations that the law imposes on Stripe directly — fraud prevention and anti-money-laundering legislation. For those processing operations Stripe answers on its own account, and its policy is published on stripe.com.
Brevo. Service emails are sent through Brevo SAS (106 bd Haussmann, 75008 Paris), which acts as data processor on behalf of the Provider (Art. 28 GDPR) and receives the recipient's email address and the content of the message.
Communications to those who have purchased. The Provider may send the parent who has purchased a subscription email communications about its own similar services. The parent may object at any time, free of charge, using the link in each message or by writing to assistenza@missionidifamiglia.com.
Not all emails pass through Brevo: some technical notices are sent directly from the service's server, without passing through any other supplier.
The off-site copy. A copy of the database and of the site files leaves the service's server and goes to a Cloudflare, Inc. storage facility, which acts as data processor on behalf of the Provider (Art. 28 GDPR).
The invoice. If the parent asks for the invoice, the electronic invoice file reaches the Provider's accountant, who forwards it to the Exchange System of the Italian Revenue Agency: there the recipient is not a supplier of the Provider, but a public body that processes that data by legal obligation and on its own account. The courtesy copy in PDF is sent to the parent by email. If the invoice is not requested, none of this happens.
Notifications. If notifications are turned on, to deliver them the Provider goes through the delivery service of the browser in use, which is not a supplier of the Provider: that service receives the delivery address that it issued itself and the message, delivered encrypted. See point 5.
Assistance. A program of Anthropic Ireland, Limited reads the emails sent to assistance and helps prepare the reply. It acts as data processor on behalf of the Provider (Art. 28 GDPR).
The Provider does not sell, transfer or exchange the data with anyone for marketing purposes.
In the event of a transfer of the business or of the branch that runs the service, the contract and the data pass to the buyer, with the same protections for the parent, who is informed by email.
The app's data is kept on servers located in the European Union.
For payment data only, Stripe may transfer data to the United States. Stripe adheres to the EU-US Data Privacy Framework, the framework recognised by the European Commission as providing adequate safeguards under art. 45 GDPR.
For service emails, Brevo keeps the data on servers in the European Union (France, Belgium, Germany), but the contract with the Provider provides for transfers to the United States, Canada and India to some of its suppliers (network infrastructure, support and technical monitoring tools). Those transfers are covered by the safeguards of art. 46 GDPR — standard contractual clauses approved by the European Commission and, where applicable, adherence to the Data Privacy Framework or an adequacy decision (that is the case for Canada). The content that passes through there is limited to the recipient's email address and the text of the service messages, with no data of the children.
For the off-site backup, the Cloudflare storage is bound to European jurisdiction and the files remain in the European Union; Cloudflare, Inc. is however a US company, and for any access that may take place from the United States it relies on the European Commission's standard contractual clauses and on its own EU-US Data Privacy Framework certification.
For notifications, the browser's delivery service may be located in the United States. Google LLC and Microsoft Corporation appear on the list of the EU-US Data Privacy Framework, the framework recognised by the European Commission as providing adequate safeguards under art. 45 GDPR; for delivery services that do not appear on it there is no adequacy decision, and what reaches them remains the delivery address issued by themselves and the encrypted message.
For assistance emails, the texts may be processed by Anthropic also outside the European Union: the transfer is covered by the standard contractual clauses of the European Commission (Art. 46 GDPR).
| Data | Retention |
|---|---|
| Parent's account and children's profiles | For the duration of the subscription or trial, then for 2 months from the end of the subscription; if no plan has ever been paid for, for 1 month from the end of the trial; if the email address has never been confirmed, for 1 month from sign-up. If the parent requests deletion: within 30 days |
| Completed missions, points, warnings | As above, unless deleted earlier by the parent |
| Rewards: chosen face, medals, trophies, tokens, Den items, Vault contents, experiences, diploma | As long as the profile of the child they belong to remains: they disappear together with it, and do not survive its deletion |
| Logs of login attempts (with IP) | 30 days at most, then automatic deletion |
| Backup copies | Up to 90 days |
| Invoicing and payment data (outcome, date, amount, identifiers) | 10 years, as the law requires for accounting records (art. 2220 of the Italian Civil Code and tax legislation) |
| Support correspondence | 24 months from the closing of the request |
| Log of service emails sent (address, type, date, outcome) | 24 months, then automatic deletion every night |
| Proof of the Terms accepted (signed text, version, language, date, time, IP) | 10 years from signing — the period within which a contract can be disputed (art. 2946 of the Italian Civil Code); then automatic deletion |
| Visit counts for public pages (point 9) | Rows without network address, used only for totals |
| Markers of the free trial already used (point 9) | 24 months from the trial, then automatic deletion every night; the mdf_pv cookie on the device lasts one year |
| Non-reversible fingerprint of the children's usernames, after deletion | No expiry, and this is intended: it serves only to ensure that the same username is never assigned to another child. It is a cryptographic fingerprint with no reference to the family: from the fingerprint it is not possible to trace the username or who held it. If it expired, that username would return into circulation |
Data are deleted when the periods in this table expire.
The 10 years for accounting data also apply in case of account deletion. It is a legal obligation that cannot be waived and it concerns only the accounting data of the payment — not the missions, not the points, not the children's profiles, which are deleted.
On closing the account, the parent may request the export of the data before deletion: it is supplied in a readable format.
The parent may at any time: access the data processed about the parent and the children; correct it if it is wrong or incomplete; delete it; restrict its processing; take it away in a machine-readable format; object to the processing in the cases provided for.
Deleting, without asking anyone. From the settings, under Users, Suspend pauses a profile and Delete forever deletes it with all its history; «Delete family» deletes all the family's data at once. Data are deleted from the app immediately. They may remain in backup copies until these expire, and the items listed in point 6 remain. A copy of the data must be requested before deleting.
For everything else: a message is sent to assistenza@missionidifamiglia.com. The reply arrives within 30 days, free of charge.
Complaint: it is possible to contact the Italian data protection authority (Garante per la protezione dei dati personali) — Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it — or the supervisory authority of the EU country where one lives or works — or to bring the matter before the courts.
The parent's data needed to create the account is indispensable: without it, the app cannot work. The same applies to at least one child profile: it is the service itself, without it there is nothing to show. Which data to put in that profile, however, remains a choice of the parent: a nickname can be used instead of the real name.
The parent may change their mind while filling in the form. At the «Your children» step of the sign-up, every name added appears in a list with a ✕ next to it: pressing it removes the name. Until the sign-up is confirmed nothing of that name is saved, so it is not a deletion — it is a change of mind.
Missioni di Famiglia uses technical cookies and its own first-party aggregate statistics cookie, which the guidelines of the Italian Data Protection Authority treat as equivalent to technical cookies. It does not use profiling or advertising cookies. For this reason no banner appears.
The cookies below are set when the app starts being used.
| Cookie | What it is for | Who sets it |
|---|---|---|
| Session cookie | Keeping the login while the app is used. It lasts seven days, then expires by itself | The Provider |
| mdfv | Remembering whether the page is viewed from a phone or a computer, in order to show the right version. It identifies no one | The Provider |
| mdf_casa | Remembering that this is the family's home device, so that the children's names appear at sign-in. It is written only on request from the parent dashboard. It lasts one year | The Provider |
| sx_vivo | Keeping track of the sign-up steps while they are filled in. It is deleted by itself when the browser is closed | The Provider |
| __stripe_mid, __stripe_sid | Security of the payment operation and fraud prevention | Stripe, only on the payment page |
| mdf_pv | Remembering that a free trial has already started from this device, so that the same family does not start a second one. It contains only a random number, no personal data. It is written only when a trial really starts, and it lasts one year | The Provider |
| mdf_cl | Internal statistics: indicates only whether the visitor is already a customer. Same value for all parents and same value for all young users. Lasts 30 days | The Provider |
Only one free trial per family. The mdf_pv cookie is set only when a free trial starts. Together with the cookie the Provider keeps a non-reversible cryptographic fingerprint of the email address, which remains even after the family is deleted. The periods are in point 6.
How many people visit the pages. Visits to the public pages and to the sign-up steps are counted with an internal system, on the service's server, without keeping the network address. Only totals are used. Those who enter the app receive the mdf_cl statistics cookie, the same for all parents and the same for all young users, which indicates only whether the visitor is already a customer. It lasts 30 days.
The two Stripe cookies appear only on arrival at the payment step: in the presentation pages there is nothing from Stripe, and those who merely look receive none. They are not advertising cookies and do not serve to profile. Their duration is set by Stripe, which states it in its own documentation.
The Provider adopts technical and organisational measures appropriate to the risk. Card data do not pass through the Provider's systems.
Photographs or videos cannot be uploaded to the app. No commercial communications are addressed to minors and no advertising is shown in the app. Minors are not profiled and are not subject to automated decisions.
The service is aimed at adults: only an adult who exercises parental responsibility, guardianship or custody may register, and the contract is with that adult. Child profiles are not autonomous accounts: they are sub-profiles created, suspended and deleted by the parent.
Anyone who notices that a minor has registered as a parent can write to the Provider, who may close the account and delete the data.
Substantial changes are communicated beforehand, with a notice inside the app and, if an email has been left, with a message. Previous versions are kept.
The app records the child's name or nickname, their missions, their points and the rewards obtained. In the app only their family can see them. The parent independently manages all of the child's data.