Privacy policy for Kiluni

The short version (for parents)

• Your child needs no account and no password. Kiluni works without the child registering.
• No advertising, no sale of data, no advertising trackers. Kiluni contains no third-party advertising or marketing analytics services.
• Your child’s age stays on the device. You confirm the age during setup; a date of birth is never transferred to our servers.
• You decide. Microphone, camera and notifications are off by default and are only released with your consent in the parents area – where you can withdraw any permission at any time.
• The AI runs with us. We operate the language models that answer your child ourselves, on our own servers in Berlin – conversations are processed to produce an answer, not for advertising purposes. If our servers fail, AKI.IO GmbH in Berlin takes over; no further AI provider receives conversation content.
• Conversation histories delete themselves – after 90 days, permanently. Anyone who wants to keep them can switch that on explicitly.

1. Controller

HillcrownAI GmbH
Brüsseler Straße 6, 67657 Kaiserslautern, Germany
Managing director: Oliver Mauckner
Kaiserslautern local court, HRB 34035
Email: support@hillcrownai.com · Data protection: privacy@hillcrownai.com

Data protection officer:
fox-on Datenschutz GmbH, Pollerhofstr. 33a, 51789 Lindlar, Germany
Email: dsb+hca@fox-on.com

2. Who is Kiluni for, and who gives consent?

Kiluni is an app for children. Setup contains an explicit parent moment: an adult identifies themselves through a task for adults, sees what the child entered, confirms the age and grants the permissions. We record this consent on the device (time, method of confirmation, version of this policy, confirmed age). The legal basis for the processing is Art. 6(1)(b) GDPR (providing the app) and – where required – the consent of the holder of parental responsibility under Art. 6(1)(a), Art. 8 GDPR.

3. Which data does Kiluni process?

a) Data that never leaves the device

• The child’s profile: first name or nickname, age band, interests, chosen companion and chosen appearance of the app
• The consent record of the parent moment
• Time and usage rules set by parents
• Game progress and saved lists

b) Data transmitted to our servers so that the app works

• Conversation content (text, and audio in voice mode) so that an answer can be produced; linked through a pseudonymous identifier (a random device/child identifier), not through a name or an email address. So that the companion can address your child, the first name or nickname chosen in the profile is transmitted with the request.
• Uploaded pictures, if the camera permission has been granted and the child shows a picture
• Technical data to secure the service (e.g. IP address in server logs, app version, device type)
• Usage events in our own reporting system (e.g. “read-aloud started”), pseudonymous, on our own servers in the EU – we use no third-party analytics services for advertising purposes
• Class function (if used): joining a school class only takes effect once parents confirm it

c) Purchases (parents area)

Subscriptions are handled through the App Store (Apple) and Google Play; we never see payment data. To manage subscriptions we use RevenueCat (pseudonymous identifier, purchase status; the provider collects technical data such as device type, country and IP address on its own account).

4. Where the AI runs – and which providers help us

We operate the language models that answer your child ourselves, on our own servers in Berlin. Conversation content is processed there. If our servers fail, AKI.IO GmbH, based in Berlin, takes over the operation of the language models and of image generation; no further AI provider receives conversation content. We also host the real-time voice connection of the voice mode (LiveKit) on our own infrastructure.

Processors bound by contract help us run the service:

5. Transfers outside the EU

Five providers are based in the USA: ElevenLabs (processing in the EU workspace, provider based in the USA), Google, RevenueCat, Brave Search and Sentry. The transfer is based on an adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses. Everything else – AI, voice connection, hosting, database – stays in the EU.

6. Storage periods and deletion

• As a rule we delete conversation histories after 90 days. On explicit request this automatic deletion can be switched off – the histories then remain until they are deleted by hand.
• Once a conversation history is deleted, it is completely removed from our servers no later than 14 days afterwards.
• The same applies to accounts and child profiles: after deletion in the app (with a 14-day recovery period), the data is completely removed no later than 14 days afterwards.
• Usage events: pseudonymous, stored only for as long as is necessary for operating, securing and improving the app
• Statutory retention periods (e.g. for purchase receipts) remain unaffected

7. Your rights

Access, rectification, erasure, restriction, data portability and objection, as well as the right to withdraw consent at any time with effect for the future – in the app in the parents area under “Consent & permissions”, or by email to privacy@hillcrownai.com. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate.

8. Security

Transmissions are TLS-encrypted; access to our systems is limited to what is necessary. Children do not sign in with passwords – so there are no child credentials that could be lost.

9. Changes

We inform you about material changes in the app in the parents area. The version in force carries a date and a version number; the version confirmed during setup is recorded in the consent record on the device.