Privacy policy
This is the plain-English version, and it is the real one. Nothing important is hidden in a longer document somewhere else.
Last updated: 21 August 2026 · Applies worldwide to zupelo.com, the Zupelo apps, and the Zupelo parent and school portals.
The short version
- We collect the least we can and still teach your child well
- We never sell data, and we never show children outside advertising
- We never use a child's voice, writing or drawings to train AI models
- You can read, export or delete everything from the parent portal
1. Who we are
Zupelo Learning ("Zupelo", "we", "us") builds a learning app for children aged 4 to 15 and the portals used by their parents, carers and teachers. We are the data controller for the information described here. You can reach our privacy team at privacy@zupelo.com and our Data Protection Officer at dpo@zupelo.com.
2. What we collect
| What | Why we need it | How long we keep it |
|---|---|---|
| Child's first name or nickname | So the app and the buddy can talk to them | Until you delete the account |
| Age band (not date of birth) | To pick the right games, reading level and time limits | Until you delete the account |
| Learning activity: games played, answers, scores, streaks | To teach at the right level and show you progress | Until you delete the account |
| Buddy conversations | So you can read them, and so we can keep them safe | 12 months, then deleted |
| Voice recordings from speaking games | To score pronunciation and give feedback | Deleted within 24 hours |
| Parent or teacher email address | Account access, reports and billing | Until you close the account |
| Payment details | To take payment | Held by our payment providers, never by us |
| Device and crash data | To keep the app working on your device | 90 days |
3. What we never collect
No surname for a child. No date of birth. No home address. No location or GPS. No contacts or address book. No camera roll access. No advertising identifiers. No third-party advertising or tracking software of any kind inside the children's app.
4. Children's privacy
Zupelo is designed for children, so children's privacy is the design brief rather than an afterthought. A child cannot create an account alone. A verified parent, carer or teacher sets it up and holds the controls.
We build to meet the children's privacy rules that apply where our users live, including the United States Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code, the children's provisions of the EU and UK GDPR, Brazil's LGPD, India's DPDP Act, and equivalent laws elsewhere. Where local rules are stricter than this policy, the stricter rule applies.
There is no open chat, no public profile, no follower count, and no way for an unknown adult to contact a child on Zupelo. Friend connections require approval by a grown-up on both sides.
5. AI buddies
Buddies are powered by large language models and are limited to the game in front of the child. Anything off-topic is redirected. Every conversation is stored in the parent portal for you to read.
We do not use children's messages, voice, writing or drawings to train AI models — not ours, and not any third party's. Where a request is processed by an AI provider, it is under a contract that forbids training on the content and requires deletion after processing.
If a message suggests a child may be upset or unsafe, the buddy responds gently, encourages them to speak to a trusted adult, and the conversation is flagged to the account holder and reviewed by a trained member of our team.
6. Who we share with
We never sell personal information and we never share it for advertising. We share only with service providers who help us run Zupelo — cloud hosting, payment processing, email delivery, AI processing and error monitoring — each under a written contract limiting them to our instructions. We publish the current list at zupelo.com/subprocessors.
We may disclose information if the law requires it, or to protect a child from harm.
7. Where your data lives
Zupelo runs in data centres in several regions. We store data in the region closest to you where we can, and schools can request a specific region. Where information crosses borders we use approved safeguards, including Standard Contractual Clauses and the UK Addendum.
8. Your rights and controls
From the parent portal you can, at any time: read every buddy conversation; export everything we hold about your child in a portable file; correct anything wrong; permanently delete a child's profile or the whole account; turn off voice; turn off buddies entirely; and set or remove screen-time limits.
Deletion is completed within 7 days and confirmed by email. You also have the rights given to you by your local law, including access, correction, deletion, restriction, objection and portability, and the right to complain to your data protection authority. Teachers and schools should see the school terms, where the school is the controller and Zupelo is the processor.
9. Cookies and similar technology
The children's app uses no advertising or analytics cookies. Our website uses only what is needed to make it work, plus privacy-friendly analytics that do not identify individuals and never run in the children's app. Where consent is required, we ask before anything optional runs, and you can change your mind at any time.
10. Security
Data is encrypted in transit and at rest. Access by our staff is limited to the few people who need it, logged, and reviewed. We run independent security testing at least annually. If a breach ever affects you, we will tell you and the relevant regulator within the timeframes the law requires.
11. Changes to this policy
If we change anything that matters, we will email account holders at least 30 days before it takes effect and show a notice in the parent portal. The date at the top always tells you when this version was published.
12. Contact us
Privacy questions: privacy@zupelo.com. Data Protection Officer: dpo@zupelo.com. Child safety concerns: safety@zupelo.com. We answer within one working day.
This page is written to be understood. It is a sample policy prepared for a concept product and is not legal advice. Before launch it must be reviewed by qualified counsel in every market where Zupelo operates. See also our terms and conditions and disclaimer.