Privacy policy

Version 1.0 (beta) · Last updated: 2026-10-15 · The Hebrew text is the original. If the two differ, the Hebrew text governs.

In short

• Lumaylo is a Hebrew learning and play app for children aged 7 to 11, at lumaylo.com/app. A parent opens the account, gives consent and stays in control.
• The service is open in Israel only, as a free beta. There are no payments.
• We keep only what the app needs to work: a first name or nickname for each child, their progress, what they make, and the settings. No surname, address, phone number, location or photo of the child.
• No ads, no tracking, no selling of data, and no use of children's data to train AI.
• AI features (talking to the guide character, voice, read-aloud, studio magic) are off until a parent turns them on, each one separately, for each child.
• We do not keep children's voice recordings. We keep the text of a conversation for 7 days only.
• A parent can see the data, download it in one file, and delete everything at any time.

1. Who we are and how to reach us

Database controller (as defined in the Protection of Privacy Law, 5741-1981): NatureTech Hydroponics Ltd, 23 HaBanaim St, Ashdod, Israel, phone +972-53-431-9375 (the "Company", "we"). Lumaylo is a product of the Company.

• Privacy requests: [email protected]
• Support and general questions: [email protected]
• By post: 23 HaBanaim St, Ashdod, Israel, attention "Lumaylo – Privacy".
• Information security officer: Pavel Brandes.
• Privacy protection officer: at our current scale the law does not require us to appoint one (section 17B1 of the Law). The person responsible for privacy at the Company: Pavel Brandes.

2. Who this policy is for

This policy has two readers: parents and guardians (18 or over) who open a family account, and the children who use Lumaylo. Under the Legal Capacity and Guardianship Law, 5722-1962, parents are the natural guardians of their children, so the parent gives the consents and exercises the rights on the child's behalf. Children have their own short, simple explanation ("Lumaylo's secret").

Providing data is not a legal obligation; it depends on your choice and consent. Without some data, some features will not work (for example, without an email address there is no account, and without saved progress there is no adaptive practice).

3. What we keep, why, and where it comes from

3.1 Data about the parent

| Data | Why | Source | |---|---|---| | Email address and password (the password is stored only as an encrypted hash) | Sign-in, password reset, service messages | Parent | | The family name you chose for the account (optional), role in the family (owner, guardian, relative) | Managing the family and permissions | Parent | | Consents: what you agreed to, when, and which wording (version number) | Proof of consent, as the law requires | Parent | | Parent PIN for the parent area, stored only as a hash | So a child cannot enter the parent area | Parent | | Family invitations: the invitee's email address is stored only as a hash | So an invite works only for the address invited | Parent | | Devices linked to the family (the device name you chose, dates) and linked TV screens | Letting a child sign in on a family device without a password | Parent |

3.2 Data about the child

| Data | What exactly | Why | Source | |---|---|---|---| | Profile | The first name or nickname you chose, form of address (boy/girl), the look of the painted character (choices such as hair and skin colour), the guide character and its name, settings | To run the app and address the child correctly | Parent and child | | Progress and learning | Answers, completed lessons, levels, answer times, hints | To fit the difficulty and show the parent progress | App use | | Creations | Drawings, studio creations, the virtual house, pictures the child drew or "took" inside the game (of their character, not of themselves), virtual coins and items | To keep what the child made | Child | | Conversations with the guide (only if a parent turned "chat" on) | The text the child wrote or said and the answers | To hold the conversation; the parent can read it | Child, AI | | The guide's memories (only if a parent turned "memory" on) | Short facts the child shared ("loves dolphins"), what they taught the guide | So the guide remembers what matters to them | Automatic extraction from chats; the parent sees and deletes | | Feelings and calm tools | A feeling the child picked from a fixed list (only the choice and the date), and calm tools they used | The calm corner. The feeling is never sent to any AI and is not shown to parents (parents see only which tools were used, unless the child chooses to share a moment) | Child | | Safety alerts | Only the worrying message (for example about self-harm or bullying), when, and on which screen | To alert the parent and offer help | Automatic | | AI log | When a request was sent, for which feature, to which model, and its size. Never the text itself | Transparency for the parent; oversight | Automatic |

What we do not keep: voice recordings; photos of the child or their face; face recognition; location; the child's contact details; guesses about feelings from camera, voice or touch (we do not do this at all).

Memory filter: the guide's memory does not store health information, home address, school name, phone or email, friends' full names, or details of religion or ethnicity. The filter is automatic and not perfect; the parent sees, corrects and deletes every memory.

Sensitive data: we do not ask for data "of special sensitivity" as defined in the Law (for example health data). A child may write something like that in a chat on their own. Such data is kept out of the memory, and is deleted with the conversation after 7 days (section 8).

Feelings the child picks: it is doubtful that a momentary feeling a child picks ("happy", "sad") is "data about their state of health" under the Law, but to be careful we treat it as data of special sensitivity: only the choice from a fixed list and the date are kept, it is never sent to AI, it is not shown to parents as a trend or history, and it is deleted after 60 days. Consent to keeping it is part of the express consent given when the account is opened.

No personality assessment: we use progress only to fit the difficulty to the child and to show the parent. We do not prepare any assessment of a child's personality, intellectual ability or functioning, for parents or for anyone else.

Technical data: the server records IP addresses and request times for security (for example, locking out after failed sign-ins) and to fix faults. The device keeps a copy of the app's data (browser local storage) so it works fast, and offline.

4. AI and voice: what is sent and where

AI features run on Google Cloud Vertex AI (Google's Gemini models). Each feature needs a separate parent consent for each child (section 5). When a switch is off, the server sends no request at all; it checks before every call.

What is sent to Google, and only when the feature is on:

• Written chat: the child's text, part of the earlier conversation, our instructions to the guide, and relevant memories. The names of the children in the family are removed from the text before it is sent.
• Voice chat: the child's voice in real time, only while they hold the talk button. We do not keep the recording; we keep only the text, for 7 days.
• "Say it" (English pronunciation practice): the child's short recording is checked on our own scoring server, in memory only, and deleted at once. In some exercises the recording is sent once to Google to be turned into text, and is not kept. Same "voice" switch. With the switch off, the child taps "I said it!" and no sound is sent.
• Read-aloud: sentences the guide says are sent to Google (Gemini TTS) to be turned into speech, without the child's name. Only with the "read aloud" switch on; otherwise the device reads with its own voice or shows captions.
• Creative studio: the child's drawing, or a short sentence they typed ("a witch on a broom"), after a safety check, so the AI can suggest parts or paint.
• Character from a photo (only if the parent chose it when creating a profile): one photo is read once to guess colours for a painted character. We do not store the photo, and origin, race, religion, health and age are never read.

What Google does with it: under the Google Cloud terms, Google does not train models on this data. We do not use Google Search in children's conversations, do not keep voice sessions on Google's side for resuming, and do not turn on request logging. Disclosed openly: by Google's default, requests are kept in memory only (never written to disk), isolated to our cloud project, and deleted within 24 hours at the latest, to answer faster; Google does not use them for training. We are working to switch this cache off and will update this page when it is off. In addition, under the Google Cloud terms Google may keep requests for a limited time to detect abuse; we will ask Google for an exception and update this page. Processing happens in the United States and in Google's "global" region.

The guide says it is an AI: in the first chat of the day and whenever the child asks "are you real?". AI can make mistakes.

5. Parental consent

• When opening the family account the parent confirms they are the parent or guardian, agrees to the terms of use and this policy, and agrees to the keeping of the data in section 3.
• Each child has six separate switches in the parent area: written AI chat · voice chat · read-aloud (cloud voice) · the guide's memory · AI in creation · character from a photo. In a new account every switch is off.
• Each decision is recorded with the date, who decided, and which wording the parent saw. It can be changed or withdrawn at any time without affecting the rest of the app. Learning, practice, games and the calm corner work with every switch off.
• Two parents: under section 18 of the Legal Capacity and Guardianship Law, parents act in agreement, and one parent is presumed to agree to the other's act. The parent who opens the account confirms they act with the agreement of the other parent or guardian, if there is one. A parent or guardian of a child who did not agree may write to [email protected], and we will stop processing that child's data (except what is needed to handle the request) until the parents agree.
• How we know it is a parent: an account opens only with a verified email address, a statement that the person is 18 or over and the child's parent or guardian, and the parent area is locked with a parent PIN. The child gives no consent at all. If we learn an account was opened by someone who is not a parent or guardian, we will delete it.
• Full consent wording: "Parental consent".

6. Who receives data

• Service providers working for us ("holders"), only to provide the service: server hosting (Hetzner, in the EU), database and files (Supabase, in Germany), AI and voice (Google Cloud), sign-in and reset emails (Resend). The full list, with what each provider receives and where, is sent to anyone who asks at [email protected].
• The parents in the family see their children's progress, conversations, memories, AI log and safety alerts (not the feelings the child picked). An invited relative ("grandpa") sees the family but not the children's data.
• Never: advertisers, ad networks, data brokers, third-party analytics inside the app. We do not sell data and do not build advertising profiles.
• By law: if a court order or the law requires it.
• Sale or merger: if the Company or the product is sold, we will tell parents in advance, and the data stays protected under this policy.

7. Transfer abroad

Data is stored and processed outside Israel. Transfers follow the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and for each provider we rely on more than one ground:

| Provider | Where | Ground for the transfer | |---|---|---| | Hetzner (app server) | Finland, later Germany | A state party to the European Convention on automatic processing of personal data (reg. 2(8)(a)), and a data processing contract (reg. 2(4)) | | Supabase (database) | Germany (Frankfurt); a US company | The same: Germany (reg. 2(8)(a)) and a data processing contract (reg. 2(4)). Supabase holds ISO/IEC 27001 | | Google Cloud (AI) | United States and "global" | The parent's express consent when turning a feature on (reg. 2(1)), and a data processing contract (reg. 2(4)). Google Cloud holds ISO/IEC 27001 | | Resend (sign-in email) | EU region; a US company | A data processing contract (reg. 2(4)) |

In its contract each provider commits to use the data only to provide the service to us, to keep it confidential and secure, to delete it at the end, and not to pass it on except to sub-processors bound by the same terms (reg. 3). Even when data is abroad, your rights (review, correction, deletion) stay the same, and we remain responsible to you.

8. How long data is kept

| Data | Deleted after | |---|---| | Conversation text (written and voice) and conversation summaries | 7 days | | Saved conversations (title and short summary) | 90 days from last use | | The guide's memories and what the child taught it | 12 months unused | | Safety alerts | 30 days (the text is erased once the parent has read it) | | AI log | 30 days | | The family privacy log (exports, deletions, switch changes) | 400 days | | Progress, creations, settings and consents | Until the parent deletes them or the family | | A linked family device | 180 days unused | | Server logs (IP addresses) | 30 days | | Encrypted backups | Up to 35 days. A deleted child does not come back even if a backup is restored | | An unused account | After 24 months without sign-in we send a notice; with no reply within 30 days we delete the family |

If the service closes or the beta ends without continuing, we give at least 30 days to download the data, and then delete it.

9. Your rights (and the child's)

Under the Protection of Privacy Law, a parent may, on the child's behalf:

• Review the data (section 13 of the Law). The parent area shows what is kept, the conversations and the AI log, and can download everything in one file.
• Ask for correction of data that is wrong, incomplete, unclear or out of date (section 14). Memories can be corrected and deleted directly.
• Delete: one child, or the whole family, in the parent area (parent PIN and confirmation). All data and files are deleted.
• Withdraw consent at any time.
• Not receive marketing: we send no advertising without prior consent, and every such message has an unsubscribe link.

You can also write to [email protected]. We will ask you to confirm you are the parent on the account before releasing data. We answer within 30 days. If we have not answered or you are not satisfied, you may contact the Privacy Protection Authority at the Ministry of Justice (www.gov.il/en/departments/the_privacy_protection_authority) or the court.

The child: we explain to them in their own words what is kept and who sees it, and we listen to their requests (for example to delete a drawing or a memory). Every conversation shows "parents can read the conversations" and a "tell a grown-up" button.

10. Information security

We follow the Protection of Privacy (Data Security) Regulations, 5777-2017. Among other things: encryption in transit (HTTPS); a database in which each family sees only its own data (tested automatically); a parent area that opens only with the parent PIN, locked after 5 failed tries; server access only for authorised staff; a database definitions document and a security procedure; encrypted backups; and an automated check that fails if anyone adds a tracker. No security is perfect. If a serious security incident happens, we will report it to the Privacy Protection Authority and notify parents as the law requires.

11. Safety

If a child writes or says something worrying (self-harm, abuse, danger, bullying, severe distress), the guide answers gently with a fixed text, suggests talking to a trusted adult, offers helplines (ERAN 1201, the National Child Online Protection hotline 105), stops the topic, and the parent gets an alert. Lumaylo is not an emergency service. In immediate danger: police 100, Magen David Adom 101.

12. Cookies and device storage

In the app (lumaylo.com/app): no advertising or tracking cookies, and no Google Analytics. Only necessary cookies: a sign-in cookie (up to 24 hours), a sign-in refresh cookie (up to 30 days) and a parent-area cookie (removed after 10 idle minutes and at most after an hour). The app keeps a copy of the data in the browser's local storage. On the marketing website (lumaylo.com): visit counting with Google Analytics, only if you agree. Details: "Cookie notice".

13. Changes to this policy

For a material change (for example a new provider receiving children's data, or a new use of data) we will tell parents in advance in the app and by email and, where needed, ask for consent again. The version and the update date appear at the top of the page.

14. Outside Israel

At this stage the service is for families in Israel only. Before opening in the United States (COPPA), the European Union (GDPR) or the United Kingdom we will update this policy.