Privacy Policy
Effective date: 20 July 2026 · Public website version
Including children's privacy and parental controls
Operator: Avatud OÜ (registry code 12443197) · Viru väljak 2, 10111 Tallinn, Estonia · team@hellomoti.app
Quick privacy summary for families. A parent controls the account. During a session, Moti processes the child's voice and words so the AI can respond. Hello Moti does not keep audio recordings or a full transcript. We keep a short summary, topics covered, progress information, and session usage. We do not sell children's data or use it for targeted advertising. The parent can request access, correction, or deletion.
A simple explanation for children: Moti is a computer program, not a person. It listens while you speak so it can answer. Do not tell Moti passwords, your full address, phone number, or secrets that should be shared with a trusted adult. Your parent can see and manage the learning information saved in your profile.
This Privacy Policy explains how Avatud OÜ ("Avatud", "we", "us", or "our") collects, uses, shares, protects, and retains personal data when an adult creates a Hello Moti account and enables a child to use the Service. It also explains the rights available to parents, children, and other users.
1. Who is responsible for the data?
Avatud OÜ, registry code 12443197, with registered address at Viru väljak 2, 10111 Tallinn, Estonia, is the controller of personal data processed through Hello Moti, except where a provider acts as an independent controller for its own purposes. Contact: team@hellomoti.app.
For users in the European Economic Area, the United Kingdom, and Switzerland, Avatud is the controller for the purposes of applicable data-protection law. You may also complain to your local supervisory authority. Avatud's lead authority in Estonia is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
2. Scope and account model
Hello Moti is a parent-managed AI study companion for children aged 6 to 17. Only an adult Account Holder creates the account, purchases access, creates a child profile, and provides permissions. A child does not create an independent contractual account.
This Policy applies to the website, application, child profiles, voice sessions, purchases, support, and related communications. It does not govern third-party websites or services that the Account Holder visits independently.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Adult account data | Name, email address, Google authentication identifier, account settings, language, country or region. | Account Holder; Google sign-in. |
| Child profile data | First name or nickname, age or age band, preferred language, selected Moti character or voice, learning preferences. | Account Holder and, during use, the child. |
| Live voice and session content | Audio stream, spoken questions, homework prompts, answers, and context needed to conduct the live session. | Child and Account Holder during a session. |
| Saved learning record | Short session summary, topics covered, progress indicators, achievements, task status, and next-step suggestions. We do not save a full transcript as the child's learning record. | Generated from the session and reviewed through automated systems. |
| Usage and technical data | Session start and end time, Moti Time used, IP address, device and browser information, language, security logs, error logs, and approximate location inferred from IP at country or region level. | Device, browser, servers, and service providers. |
| Purchase and billing data | Product purchased, price, currency, tax location, payment status, transaction identifier, refund and chargeback status. We do not receive full card numbers. | Account Holder, Stripe, bank or payment provider. |
| Support and communications | Messages sent to us, troubleshooting information, complaint or refund details, and records of consent or requests. | Account Holder and our support systems. |
| Cookies and similar technologies | Authentication, session, fraud-prevention, security, and payment-flow identifiers. | Browser and third-party service providers. |
4. Voice data: what we do and do not store
No Hello Moti audio library. Hello Moti does not intentionally create or retain audio recordings in its own application database, and it does not create voiceprints or use a child's voice for biometric identification.
Live audio is transmitted to OpenAI or another disclosed AI infrastructure provider so speech can be recognised and the AI can respond in real time. The audio and conversation content are processed during the session. We do not use API data to train our own general-purpose model.
Our AI provider may temporarily retain API inputs and outputs for service delivery, security, or abuse monitoring under its business data terms. OpenAI states that eligible API inputs and outputs may be retained for up to 30 days unless a shorter or zero-data-retention configuration applies. We seek to use privacy-protective configurations where technically and commercially available. Provider-side temporary retention is separate from the saved Hello Moti learning record described below.
After the session, Hello Moti stores only a concise summary, topics covered, progress information, task status, safety or quality flags where necessary, and technical usage records. We do not intentionally store the full word-for-word transcript as part of the child profile.
5. Why we use personal data and our legal bases
| Purpose | Data used | Legal basis where GDPR applies |
|---|---|---|
| Create and secure the adult account | Adult account data, authentication data, technical data. | Performance of the contract with the Account Holder; legitimate interests in account security. |
| Create a child profile and provide voice sessions | Child profile, live voice and session content, usage data. | Parental or guardian consent where required; performance of the service requested by the Account Holder; legitimate interests only where permitted and balanced against the child's rights. |
| Personalise learning and show progress | Saved learning record, age band, language, prior topics and preferences. | Parental or guardian consent where required; performance of the requested service. |
| Process purchases, refunds, and taxes | Purchase and billing data, account data, country or tax information. | Performance of contract; legal obligations; legitimate interests in fraud prevention and financial administration. |
| Keep the Service safe and reliable | Technical logs, session metadata, limited content or safety flags where necessary. | Legitimate interests in security, child safety, misuse prevention, and service integrity; legal obligations where applicable. |
| Provide support and resolve disputes | Account, purchase, support, and relevant session or technical information. | Performance of contract; legitimate interests; establishment, exercise, or defence of legal claims. |
| Use optional analytics or marketing technologies | Only data described in an updated cookie notice and consent interface. | Consent. At the effective date, Hello Moti does not use advertising cookies or behavioural advertising. |
Consent can be withdrawn at any time, but withdrawal does not affect processing already lawfully completed. Because voice and child-profile processing are necessary to provide Hello Moti, withdrawing the relevant consent may require us to stop the child's access and delete the learning record, subject to legal retention duties.
6. Children's privacy and parental consent
We apply heightened privacy protections because Hello Moti is intended for children. The parent or legal guardian must create the account and authorise child use before we intentionally collect child-profile or session data. Where local law requires verifiable parental consent, age assurance, a direct notice, or a specific consent method, we may require additional steps before activation.
- We do not sell children's personal data.
- We do not use children's personal data for targeted or cross-context behavioural advertising.
- We do not create public child profiles or allow children to contact unknown users through the Service.
- We do not intentionally collect precise geolocation, government identifiers, payment-card data from children, or biometric voiceprints.
- We ask for no more child information than reasonably necessary to provide the learning experience.
- Parents can review, correct, download where available, or request deletion of the child profile and saved learning record.
For children under 13 in the United States, the Children's Online Privacy Protection Act and Rule may require clear notice to the parent and verifiable parental consent before collection. A privacy policy or ordinary checkbox alone may not satisfy every consent requirement. The account flow may therefore require a payment-card check, signed consent, identity verification, video verification, or another legally accepted method, depending on how the Service is configured and what data is disclosed to providers.
In Estonia, consent for an information-society service offered directly to a child generally requires parental authorisation when the child is under 13. Other EEA countries may set the threshold between 13 and 16. Hello Moti's adult-account model is intended to obtain consent from the holder of parental responsibility regardless of the child's location.
7. Sensitive information and safety disclosures
Hello Moti is not designed to collect medical records, diagnoses, religious beliefs, political views, sexual information, full school records, precise addresses, or other sensitive personal data. A child may nevertheless mention sensitive information during a natural conversation. We process such content only as needed to respond, apply safety controls, create the limited session summary, and comply with law.
Parents should instruct children not to share passwords, exact addresses, phone numbers, financial data, government identifiers, private information about another person, or information that should instead be discussed with a trusted adult or professional. Hello Moti is not a confidential counselling or emergency service.
8. Automated processing and personalisation
AI systems analyse the child's spoken input, age band, language, preferences, and saved learning record to generate responses and adjust difficulty, tone, pacing, and suggested activities. These decisions support the educational interaction and do not produce legal or similarly significant effects such as school admission, grading, medical diagnosis, credit, employment, or eligibility decisions.
Moti is always presented as an AI system. Parents should review important educational information and may request correction or deletion of inaccurate progress information.
9. When we share data
| Recipient or category | Purpose and data |
|---|---|
| OpenAI | Real-time speech and AI processing, safety, and service delivery. Receives live session inputs and returns AI outputs. Business/API data is not used for model training by default unless the customer opts in. |
| Adult account authentication. Receives and provides identifiers necessary to complete Google sign-in. Google may act independently for its own account and security services. | |
| Stripe | Payment, tax, fraud-prevention, refund, and chargeback processing. Receives payment and transaction information; Avatud receives transaction status and limited billing data. |
| Cloud hosting, database, communications, and security providers | Hosting the application and saved learning records, sending service messages, preventing fraud, monitoring availability, backups, and technical support. |
| Professional advisers and authorities | Legal, accounting, audit, insurance, tax, regulatory, court, law-enforcement, or child-safety obligations where disclosure is lawful and necessary. |
| Business transaction recipients | Due diligence or transfer in a merger, financing, reorganisation, acquisition, or sale, subject to confidentiality and applicable law. |
We do not permit service providers to use child data for their own advertising. We require providers acting on our behalf to process data under contracts, confidentiality, security, and data-protection obligations appropriate to their role.
10. International data transfers
Hello Moti is available internationally, and our providers may process data in the EEA, the United Kingdom, the United States, and other countries. Those countries may have different privacy laws. Where required, we use recognised transfer mechanisms such as adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful safeguard. We also assess providers and apply technical and organisational protections appropriate to the risk.
11. How long we keep data
| Data | Typical retention |
|---|---|
| Adult account and child profile | While the account is active. Deleted or anonymised after account deletion, normally within 30 days, except for backups, security, disputes, or legal duties. |
| Saved session summaries, topics, and progress | Until the parent deletes the child profile or account, or earlier if no longer needed. Residual backup copies are normally overwritten within 30 days. |
| Audio recordings | Not intentionally stored in Hello Moti's application database. AI-provider temporary retention may be up to 30 days depending on the API configuration and legal exceptions. |
| Full transcript | Not intentionally stored as the child's learning record. Limited content may appear temporarily in provider systems, security logs, or a support case when needed to investigate a specific problem. |
| Security and technical logs | Generally up to 12 months, with shorter periods where feasible and longer retention only for a specific security incident, abuse investigation, or legal claim. |
| Support records | Generally up to 24 months after the matter is closed, unless a longer period is needed for an unresolved dispute or legal obligation. |
| Purchase, invoice, tax, refund, and accounting records | At least 7 years where required by Estonian accounting and tax law, or longer if another applicable law requires it. |
| Consent and parental-authority records | For as long as the child profile is active and thereafter as reasonably necessary to demonstrate compliance, resolve disputes, and meet legal limitation periods. |
We may anonymise information so it can no longer reasonably identify a parent or child. Properly anonymised information may be retained for service reliability, statistics, and product improvement.
12. Your and your child's rights
Depending on location and applicable law, the Account Holder and the child may have the right to:
- know whether and how personal data is processed;
- access personal data and receive a copy;
- correct inaccurate or incomplete data;
- delete data or restrict processing;
- object to processing based on legitimate interests;
- withdraw consent;
- receive certain data in a portable format;
- complain to a data-protection authority; and
- not be subject to certain solely automated decisions with legal or similarly significant effects.
The parent may exercise rights for a younger child where legally authorised. An older child may also have independent rights. We may need to verify identity, parental authority, or the scope of a request. We will not discriminate against a person for exercising a privacy right.
To make a request, email team@hellomoti.app. Please use the adult account email and identify the child profile without sending unnecessary identity documents. We will respond within the period required by applicable law.
13. Account deletion and parental controls
The Account Holder may request deletion of an individual child profile or the full account. Deleting a child profile removes the saved learning record from active systems, subject to the retention periods above. Deleting the account does not erase payment and accounting records that we must keep and does not automatically create a refund for unused or expired Moti Time.
A parent may withdraw permission for a child to use the Service at any time. If we learn that child data was collected without required parental authority, we may suspend the profile, ask for verification, and delete the data unless retention is legally required.
14. Security
We use reasonable technical and organisational measures designed for the sensitivity of children's data, including access controls, encryption in transit, provider due diligence, logging, role-based access, data minimisation, and deletion procedures. No online service can guarantee absolute security. The Account Holder should use a secure Google account or password, protect devices, and notify us of suspected unauthorised access.
15. Cookies and similar technologies
We use necessary cookies and similar technologies for authentication, account sessions, security, fraud prevention, and payment flows. At the effective date, we do not use advertising cookies or behavioural advertising. Details are in the Cookie Policy. If optional analytics is introduced, we will update the notice and request consent where required before placing non-essential technologies.
16. Third-party privacy information
You can read more about major providers here: OpenAI enterprise privacy · OpenAI Data Processing Addendum · Google Privacy Policy · Stripe Privacy Policy
Those documents describe each provider's practices. This does not transfer Avatud's responsibilities for the processing it controls.
17. Changes to this Policy
We may update this Policy when the Service, providers, retention, or law changes. The effective date appears at the beginning. We will provide prominent notice or seek renewed parental consent where a material change affects how children's personal data is collected, used, or disclosed.
18. Contact and complaints
Avatud OÜ · Registry code: 12443197 · VAT number: EE101637181 Viru väljak 2, 10111 Tallinn, Estonia Email: team@hellomoti.app · Website: https://hellomoti.app
Estonian Data Protection Inspectorate: www.aki.ee. You may also contact the supervisory authority in the country where you live, work, or believe an infringement occurred.