Privacy Notice

Last updated: 2026-09-29

1. Who we are (Data Controller)

Spoky is operated by Бул Реолтор ЕООД (Bul Realtor EOOD), registered in Bulgaria (the "Company", "we"). For the purposes of the EU GDPR and the UK GDPR, we act as the data controller for personal data we collect about parents/guardians who create an account or subscribe. Contact for privacy matters: support@spokyapp.com.

2. Personal data we collect

Account data — parent's email address, password (hashed), display name, and, if provided via Google, profile avatar URL.
Subscription data — plan, status, current period dates, and the Stripe customer/subscription IDs that link your account to your purchase.
Support correspondence — messages you send us and any attachments.
Technical data — IP address (used briefly for rate-limiting and security; not stored long-term), browser type, basic device info, and minimal request logs.

About the child: Spoky is intended to be installed and supervised by a parent. We do not require the child to create an account or provide personal information. Chat messages and parent settings (PIN, allowed subjects, daily time limit) are stored only in your browser's local storage and are not sent to our servers, except that each message text and the chosen subject are sent over an encrypted connection to our AI provider in order to generate a reply.

3. Why we use your data (purposes & legal basis)

Provide the Service (account creation, authentication, delivering replies) — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Process payments and manage subscriptions — legal basis: performance of a contract and legal obligation for tax/accounting.
Security, abuse prevention and rate-limiting — legal basis: legitimate interests in keeping the Service safe.
Customer support — legal basis: performance of a contract and legitimate interests.
Comply with law (tax records, lawful requests) — legal basis: legal obligation.

We do not use personal data for behavioural advertising, profiling of children, or to train third-party AI models.

4. Who we share data with

Stripe — our payment processor (Stripe Managed Payments, Merchant of Record). Stripe collects and processes payment details (card data, billing address, tax info) directly from you at checkout, issues receipts, calculates tax, and handles refunds and chargebacks. See Stripe's privacy policy at stripe.com/privacy.
Hosting & backend — Supabase (database, authentication) and Cloudflare (edge hosting / DDoS protection).
AI provider — Lovable AI Gateway, which routes prompts to large language models such as Google Gemini, solely to generate replies.
Email delivery — providers used to send transactional emails (sign-in, receipts, support replies).
Professional advisers — legal and accounting advisers where necessary.
Authorities — where required by law or to protect rights, safety or property.

We do not sell or rent personal data, and we do not share it with advertisers.

5. International transfers

Some of our providers process data outside the EU/EEA and the UK (for example in the United States). Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional technical measures such as encryption in transit.

6. How long we keep data

Account data — for as long as your account is active, and up to 12 months after deletion for security and dispute purposes.
Billing & invoice records — retained by Stripe and by us for the period required by applicable tax / accounting law (typically up to 10 years in Bulgaria).
Support correspondence — up to 24 months.
Security logs — up to 90 days.
Local chat history — only on the child's device; you can clear it at any time from Parent settings → Clear all data.

7. Security

We apply appropriate technical and organisational measures: TLS encryption in transit, hashed passwords, row-level security on our database, access controls on a need-to-know basis, regular security updates, and signed webhooks for payment events. No system is 100% secure; please use a strong, unique password and notify us immediately at support@spokyapp.com if you suspect unauthorised access.

8. Your rights

Under GDPR / UK GDPR you have the right to:

Access the personal data we hold about you.
Have inaccurate data rectified.
Have your data erased (right to be forgotten).
Restrict or object to certain processing.
Receive your data in a portable format.
Withdraw consent at any time (where consent is the legal basis).
Lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP); in the UK, the Information Commissioner's Office (ICO); or your local EU/EEA authority.

To exercise any of these rights, email support@spokyapp.com. We respond within one month.

9. Cookies

We use only essential cookies / local storage required to keep you signed in and remember parent settings on the device. We do not use advertising or third-party tracking cookies. Payment pages presented by Stripe may set their own cookies; see Stripe's privacy policy linked above.

10. Children

Spoky is designed for children aged 7–13 used under parental supervision. We do not knowingly collect personal information directly from a child as defined by COPPA (US) or the GDPR-K rules. A parent installs Spoky, sets a parent PIN, and supervises use. Parents may review, export or delete locally-stored data at any time via Parent settings → Clear all data, or by emailing us. For the UK, Spoky is designed in line with the ICO Age-Appropriate Design Code: data minimisation by default, no behavioural advertising, no profiling, no nudge techniques, and parental controls active out of the box.

10a. Children's privacy laws worldwide

Spoky is used by children in many English-speaking countries. Wherever you live, the strictest common standard applies to everyone: a parent or guardian creates the account and gives explicit consent, we collect as little data as possible, we never show ads, track children or sell data, and the parent can see and delete everything at any time from the Parent Dashboard (“Delete all my child's data”).

Where	Law	What it requires	How Spoky complies
European Union, Ireland, Malta	GDPR (Art. 8) + EU Digital Services Act	Parental consent for children under 13–16 (by country); data minimisation; right to access and erase; no profiling-based ads to minors.	Only a parent can create the account and must tick the consent box. We collect the minimum data, never show ads, and the parent can delete all child data in one click.
United Kingdom	UK GDPR + Age Appropriate Design Code (Children's Code)	High-privacy defaults, no nudging, no profiling or geolocation by default, child-friendly explanations.	No tracking, no ads, no location. Safety filters are on by default and cannot be switched off by the child.
United States	COPPA (2025 amended rule) + state laws (e.g. California CCPA/CPRA, AADC)	Verifiable parental consent before collecting data from children under 13; clear notice; parent can review and delete; data retention limits.	The parent signs up, gives consent and pays; the parent dashboard shows what the child did; data can be deleted at any time; we never sell or share data.
Canada	PIPEDA + Quebec Law 25	Meaningful consent from a parent for children under 13 (under 14 in Quebec); safeguards and the right to withdraw consent.	Parental consent at sign-up, withdrawal by deleting data or the account.
Australia	Privacy Act 1988 (APPs) + Children's Online Privacy Code (from 2026)	Handle children's data fairly, in the child's best interests, with parental involvement for young children.	Child-first defaults, no ads or profiling, parent controls and deletion.
New Zealand	Privacy Act 2020 (IPP 4)	Collect children's information fairly and with extra care.	Minimal data, parent-controlled account.
India	Digital Personal Data Protection Act 2023 + DPDP Rules 2025	Verifiable parental consent for anyone under 18; no tracking, behavioural monitoring or targeted ads to children.	Parent-only accounts with explicit consent; no tracking, monitoring for ads, or targeted advertising of any kind.
South Africa	POPIA	Consent of a competent person (parent) for children under 18.	Parental consent at sign-up.
Singapore	PDPA + Advisory Guidelines on Children's Data	Parental consent for children under 13; higher protection standard.	Parental consent and safe defaults.
Nigeria, Kenya, Ghana	NDPA 2023, Data Protection Act 2019 (Kenya), Data Protection Act 2012 (Ghana)	Parental consent for children (under 18 in Nigeria and Kenya); age-verification and safeguards.	Parent-only accounts with explicit consent; child data can be erased on request.
Philippines, Jamaica & the Caribbean	Data Privacy Act 2012; Data Protection Act 2020 (Jamaica)	Parental consent and proportional processing for minors.	Parental consent and minimal data.

Parental consent is recorded with a date and time and shown in the Parent Dashboard. To exercise any right (access, correction, deletion, withdrawal of consent, complaint), use the dashboard or contact us; you can also complain to your local data-protection authority.

11. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be announced in-app or by email; the "Last updated" date above reflects the current version.

12. Contact

Бул Реолтор ЕООД (Bul Realtor EOOD) — privacy queries: support@spokyapp.com.