Privacy policy
Last updated: 13 November 2026
Umali is a storytelling and learning companion for children aged 4 to 12. Children talk with Umali by voice; parents create the account, give consent and stay in control. This policy explains what we collect, why, and the choices parents have. Umali is in its pilot phase and is free.
Who we are
Umali is provided by Artsoft d.o.o., Bosnia and Herzegovina (“we”). We are the controller of the personal data described here. Contact us at emirpasic83@gmail.com.
Children and parental consent
Children use Umali only through a parent's account. Before a child can use Umali, the parent verifies that they are an adult through Kids Web Services (KWS), a parental verification service run by Epic Games. We collect only what Umali needs to work, we never ask a child for more information than that, and parents can review and delete their children's data at any time. We follow the US Children's Online Privacy Protection Act (COPPA) and the EU and UK GDPR rules for children's data.
What we collect and why
| Data | Why |
|---|---|
| Parent account: email address and sign-in method (Google, Apple or email), when the account was created | To sign the parent in and send the consent email |
| Household country (country only, never a region or address), chosen by the parent | KWS needs it to offer the right verification methods; Umali uses it to show the right child helpline |
| Consent record: whether consent is given, when, and KWS's reference number | To show that a parent gave consent |
| Child profiles: a nickname, age band (4–6, 7–9 or 10–12), language, Umali's voice and the parent's topic settings | To make Umali speak at the right level and in the right language, and to respect the parent's choices |
| Session transcripts (what the child and Umali said, as text) and the pictures made in the session; minutes used per day | So parents can see what happened, for the safety checks, and for the daily time limit |
| Server logs: technical records of requests to our servers (for example IP address and time), without transcripts or child details | To keep the service secure and working |
We never store audio. The child's voice is processed in real time to understand and answer them, and then discarded. We do not collect photos, precise location, contacts or voiceprints, and Umali does not recognise who is speaking: children tap their own picture to take a turn.
No ads, no tracking. Umali contains no advertising and no analytics or tracking tools. We do not sell or rent personal data, do not use it for marketing, and do not build profiles of children. We do not use children's data to train AI models.
Safety
Everything Umali hears and says is checked by automatic safety filters as it happens. Umali avoids sensitive topics unless the parent turns them on, steers away from anything unsafe, and never repeats personal details a child shares. If a child says they are being hurt or are unsafe, Umali gives a short, caring reply, may share a child helpline for the household's country, and alerts the parent. These moments are marked in the transcript for the parent. No person at Umali listens to or reads children's sessions.
Who processes data for us
- Google Cloud and Firebase (Google) host Umali, store the data, handle sign-in and run the AI models that understand and answer the child. Data is stored and processed in the European Union (Belgium). Under its terms, Google does not use this data to train its models.
- Kids Web Services (Epic Games) verifies that the parent is an adult. It receives the parent's email address and the household country, keeps the verification evidence itself and tells us only the result. See the KWS privacy policy.
- If a parent signs in with Google or Apple, that company handles the sign-in under its own privacy policy.
We share personal data with no one else, unless the law requires it.
How long we keep data
- Account data, child profiles, transcripts and pictures: while the account is active. Parents can delete any session or story at any time.
- Accounts inactive for 24 months are deleted, after a warning email to the parent.
- When an account is deleted, all of its data, including all child data, is deleted within 30 days.
- Server logs: 30 days.
- Audio: never stored.
Parents' rights
Parents can see their children's profiles and sessions in the app, and can ask us at any time to see, correct, export or delete their own or their children's data, or to stop processing it. Withdrawing consent stops the children's use of Umali and we delete their data. Write to emirpasic83@gmail.com; we answer within 30 days. You can also complain to a data protection authority: in Bosnia and Herzegovina the Personal Data Protection Agency (Agencija za zaštitu ličnih/osobnih podataka u BiH), or the authority where you live.
Security
Data is encrypted in transit and at rest. Only Umali's servers can read the database; the app cannot read or write it directly. Access is limited to what each part of the service needs.
Changes
If we change this policy, we update the date above, and for important changes we tell parents in the app or by email before they take effect.