Privacy Policy

1. Who we are

Kibu is operated by Kibu Company, 8098 Hajr, Dhahran 34254, Saudi Arabia. We are the data controller for the personal data described in this policy — meaning we decide what is collected and why.

You can reach our privacy team at [email protected]. If you are in the European Union or the United Kingdom, you may also contact our representative for your region — see section 14.

2. Who this policy covers

Kibu has two kinds of user. A parent or guardian holds the account, pays for the subscription and controls the family's settings. A child uses a separate, limited profile created by that parent.

A child cannot create a Kibu account. Only a parent or guardian can create a child profile, and only after giving the consents described in section 5.

There is a plain-language version of this policy written for children at getkibu.com/privacy-for-kids. Children should read that one.

3. What we collect

We separate this into what we collect about parents and what we collect about children, because the rules and our commitments differ.

4. How we use what we collect

We do not use children's personal data for behavioural advertising, and we do not build advertising profiles. We do not use children's personal data to make automated decisions that produce legal or similarly significant effects.

• To run the app: accounts, sign-in, missions, rewards, chat, notifications.
• To generate a cartoon avatar from a photograph the child takes.
• To produce mission suggestions and a weekly summary for the parent.
• To keep children safe: screening content, handling reports, enforcing our community guidelines.
• To take payment and manage subscriptions.
• To understand how the app is used and improve it — for children, only where a parent has given verified consent.
• To meet our legal obligations and to prove we did.

5. Parental consent

Before we collect anything from a child, we ask the parent for consent — separately, for each distinct purpose, so agreeing to one does not silently agree to another.

We verify that the person consenting is the account holder by reference to the payment transaction on the account. Kibu has no free tier, so every family has a payment on record.

The full text of each consent notice is published at getkibu.com/parental-consent. Each is separately revocable at any time from Settings, and revoking one does not close the account.

6. Analytics, and how we treat children differently

We use a third-party analytics provider to understand how Kibu is used. For adults this runs on our legitimate interest in improving the product, and you can object at any time.

For children it is different, and stricter. If a parent has not given verified consent for analytics, we collect nothing at all about that child — not a reduced set, not an anonymised event. No event is sent.

Where consent has been given, a child's analytics is still limited: a fixed list of permitted fields, no location, no advertising identifier, and no marketing profile. We do not create analytics profiles for children.

We do not rely on the COPPA 'support for internal operations' exception to collect from children without consent.

7. Who else sees this data

8. Artificial intelligence

Kibu uses AI in four places, all described in full at getkibu.com/ai. In summary: generating a cartoon avatar from a photograph; screening what a child types before it is used; suggesting missions to a parent; and writing the parent's weekly summary.

No AI provider is permitted to train on your family's data. Children cannot converse with an AI. The avatar is AI-generated imagery and is labelled as such in the app.

9. Photographs of children

This is the most sensitive thing we handle, so we are specific about it.

When a child creates an avatar, they take a photograph. It is sent once to our AI provider, used to generate a cartoon, and then deleted. We do not keep the original photograph. If the child wants a different avatar later, they take a new photograph.

Mission photographs and post photographs are kept for the periods in our retention policy and are deleted when that period ends, when the parent deletes them, or when the account is deleted.

We do not use facial recognition. We do not create or store faceprints or facial templates. We do not attempt to identify anyone from a photograph.

Photographs are stored encrypted and are not publicly accessible. Access requires an authenticated request from the family the photograph belongs to, or from our support staff under the access controls in our security programme.

10. How long we keep it

We do not keep children's personal data indefinitely. Every category has a defined retention period and an automated deletion process.

The full table — what we keep, why we need to keep it, and for how long — is published at getkibu.com/data-retention. It forms part of this policy.

One deliberate exception: records of the consents you gave survive account deletion, because they are the evidence that we collected your child's data lawfully. They contain no content about your child.

11. Your rights and controls

As a parent or guardian you can, at any time and from within the app: review everything we hold about your child; download it as a file; correct it; delete an individual item, the child's profile, or the whole family account; withdraw any consent; and turn the social features off.

Depending on where you live you may also have rights to object to processing, to restrict it, to portability, and to complain to a regulator. How to exercise each, what we need from you, and how quickly we respond is set out at getkibu.com/your-rights.

We never charge for these, and we never require you to create an account or install anything to exercise them.

12. Security

We maintain a written information security programme covering children's personal data, with a named individual responsible for it, regular risk assessments, and annual review. A summary is published at getkibu.com/security.

Data is encrypted in transit and at rest. Access by our staff is limited to those who need it and is logged. We require the same standard in writing from every service provider.

13. International transfers

Kibu is operated from Saudi Arabia and uses service providers located in PROCESSOR_REGIONS. This means personal data may be transferred across borders.

Where data leaves the United Kingdom or the European Economic Area, we rely on TRANSFER_MECHANISM — for example, Standard Contractual Clauses with the UK Addendum — together with technical measures. Where data leaves Saudi Arabia, we comply with the transfer conditions in the Personal Data Protection Law.

You can ask us for a copy of the safeguards that apply to any specific transfer.

14. Our representatives in the UK and EU

Because Kibu is established outside the United Kingdom and the European Union, we have appointed representatives you can contact directly about your data.

European Union: EU_REPRESENTATIVE_NAME, EU_REPRESENTATIVE_ADDRESS, EU_REPRESENTATIVE_EMAIL.

United Kingdom: UK_REPRESENTATIVE_NAME, UK_REPRESENTATIVE_ADDRESS, UK_REPRESENTATIVE_EMAIL.

Contacting a representative has the same effect as contacting us.

15. Complaints

Please contact us first at [email protected] — we would rather fix it. You also have the right to complain directly to a regulator.

Saudi Arabia: the Saudi Data and Artificial Intelligence Authority (SDAIA). United Kingdom: the Information Commissioner's Office (ico.org.uk). European Union: your national supervisory authority. United States: the Federal Trade Commission (ftc.gov), and your State Attorney General.

16. Changes to this policy

If we change how we handle children's personal data in a way that goes beyond what you already agreed to, we will not apply the change to your family until we have asked you again and you have said yes. Silence is never treated as agreement.

For other changes we will tell you in the app and by email at least 30 days beforehand. Every previous version stays available at getkibu.com/privacy-policy/archive.