Version: v1.0 – Effective date: October 31, 2025

1. Who collects your data The Lumlyn app is operated by Lumlyn OÜ, a company registered in Estonia, with its registered office at [full address]. Data protection contact: privacy@lumlyn.com

2. What data we collect We follow the principle of data minimization (GDPR Art. 5). We only collect the information strictly necessary: Account data: email, password. Child data: age group (0–1, 1–2 … 5–6 years). Answers to questions about behaviour and family (e.g., daily routines, sleep patterns, emotional responses). Technical data: IP address, device type. App usage: questions sent to the chatbot, modules accessed. We do not collect: names, photos, exact location, or other data that could directly identify a child.

Cookies The app uses cookies and similar technologies: Strictly necessary: enable core functions (e.g., login, keeping sessions active, language choice). These cannot be disabled. Analytics (optional): help us understand how the app is used and improve it (e.g., number of visits, time spent in a module). These cookies are only activated if you give consent through the checkbox. You can withdraw your consent for analytics cookies at any time, from the app settings or by contacting privacy@lumlyn.com.

3. Legal basis for processing Parents / guardians: explicit consent (GDPR Art. 6(1)(a)). Educators / schools: in the EU/UK, processing is based on the contract between the school and the parent (GDPR Art. 6(1)(b)), or for public institutions, on public interest in education (GDPR Art. 6(1)(e)). In the US, we also apply the School Exception under COPPA. Therapists / clinics: processing is based on the contract with the parent (GDPR Art. 6(1)(b)) or on legitimate interest (GDPR Art. 6(1)(f)); therapists are required to invite the parent to confirm consent.

4. Why we use the data This strictly necessary information enables our AI system — built on verified sources and validated scientific research — to provide personalised guidance tailored to developmental stages. We do not use data for commercial profiling or marketing.

5. How we protect the data Data is encrypted in transit and at rest. Access is restricted to the Lumlyn founding team only. We do not share data with third parties. Data is automatically deleted after 24 months of inactivity, or earlier upon request.

6. Your rights You have the right to: Receive a copy of your data (access). Correct your data (rectification). Delete your data (erasure). Receive your data in a standard format (portability). Withdraw your consent at any time. To exercise any rights, contact: privacy@lumlyn.com

7. How to withdraw consent In the app: use the “Delete child data” button → processing stops immediately. By email: contact privacy@lumlyn.com. In both cases, all data will be permanently deleted within 30 days.

8. Children and minors The app is designed exclusively for parents, educators, and therapists of children aged 0–6 years. For all child-related data: In the EU/EEA, parental consent is required for users under 16 (or the lower age set by your country of residence). In the UK, this Policy complies with the UK GDPR and Data Protection Act 2018. Parental consent is required for users under 13. In the US, we comply with COPPA and obtain verifiable parental consent via email confirmation. Children do not provide data directly in the app.

9. Policy updates If we update this Policy, you will be notified in the app and on the website. The new version will be displayed with a policy_version number (e.g., v1.9).

10. Supervisory authorities EU/EEA: you have the right to contact the Data Protection Inspectorate (AKI), Estonia – www.aki.ee or the authority in your country of residence. UK: you have the right to contact the Information Commissioner’s Office (ICO), www.ico.org.uk.

This Privacy Policy is Version v1.0, effective as of October 31, 2025.