Privacy Policy

Effective as of November 6, 2026

1. About this Policy

1.1. This Policy explains how personal data is processed in the KiddoPay service: the website https://kiddopay.ru and the KiddoPay mobile apps for iOS and Android (the "Service"). It applies to users worldwide. Section 11 sets out additional rights and information for specific regions.

1.2. The controller (operator) of personal data is Асиненко Александр Александрович; г. Балашиха, обл. Московская; Roskomnadzor register: 77-26-576300 (order № 617 dated October 21, 2026) (the "Operator", "we", "us"), established in the Russian Federation. Email for privacy requests: kiddopay@odinai.pro.

1.3. We collect only the data the Service needs to work. We do not sell personal data and do not share it for advertising, including cross-context behavioural advertising. We do not profile users and do not make decisions based solely on automated processing that produce legal or similarly significant effects. The Service contains no advertising and no third-party analytics or tracking.

1.4. This Policy is available in several languages. For residents of the Russian Federation, the Russian-language edition (https://kiddopay.ru/privacy?lang=ru) prevails. For everyone else, the English edition prevails if translations differ.

2. Purposes of processing

We process personal data only for the following purposes:

registering and authenticating users and restoring access to accounts;
providing the features of the Service: families and groups (a school class, a team, a club, a tutor's students, a camp unit), virtual currency and points, tasks, rewards shop, competitions, loans and transaction history;
creating and maintaining children's profiles: in a family, at the request of the parent or legal guardian; in a group, by the group organizer with the consent of the child's parent or legal guardian (section 3.2.1);
sending service messages: email confirmation, password reset, notifications about events in the family;
keeping the Service secure and complying with the law.

3. Whose data we process and what data

3.1. Adult users (who register themselves)

email address;
name (or nickname) provided at registration;
password — stored only as an irreversible cryptographic hash (Argon2id); we never know the original password;
interface language;
your role in a family or group (for example, "parent", "teacher", "coach") and the label "what children call you";
if you sign in with Apple or Google (where available in your country): your account identifier with that provider and the email address the provider shared with us.

3.2. Children

A child's profile is created by an adult user acting as the child's parent or legal guardian. A child has no email, phone number or password in the Service. We process:

the name or nickname entered by the adult;
optionally, if the adult chooses: a label for the relationship (for example, "daughter"), date of birth and profile picture;
a PIN code for signing in — stored only as a hash.

We do not ask children for any other personal data, and a child cannot disclose personal data publicly through the Service: everything a child sees or enters is visible only within the child's family or group.

3.2.1. Children in groups

A child is added to a group (a class, a team, a club and so on) by the group organizer — a teacher, coach, tutor or camp counselor. The organizer is not the child's legal guardian. Before adding the child, the organizer obtains the consent of a parent or legal guardian using the form in the Rules for Group Organizers (https://kiddopay.ru/organizer-terms) and confirms this in the Service. We may ask the organizer to show this consent.

For a child in a group we process only the name or nickname, a label in the group, the PIN hash and the data of the child's participation: tasks, credits, purchases, contests, transaction history and task proof photos. Birth dates and profile photos of children in groups are not processed: the Service does not allow them. If a child is in both a family and a group, the child has a separate profile in each. The family's adults do not see the child's group profile, and the group's adults do not see the family profile.

3.3. Content users create in the Service

This includes the name and type of the family or group, currency, tasks, rewards, competitions, loans, comments and the history of virtual coin and point transactions. This content is linked to members of the family or group. If a task requires photo proof, we also process the photos uploaded by users. Virtual coins and points are not money.

3.4. Technical data

a device identifier (a random value generated by the Service), platform, app and operating system versions;
session data: a hash of the refresh token, creation date and expiry;
the device push token — only with separate consent (section 6);
the IP address of a request — used at the moment of the request to limit request rates and protect against attacks; we do not store it in the user database;
on the website — strictly necessary cookies and browser local storage entries (see the Cookie Policy).

3.5. What we do not process

We do not process special categories of personal data (such as health, religion or political views) or biometric data. Photos in the Service are not used to identify anyone. We do not collect phone numbers, government ID numbers, postal addresses or geolocation.

4. Legal bases

Your consent, given as a separate document — the "Consent to Personal Data Processing" — at registration. It also covers the storage of your data in the Russian Federation (section 5.2).
For children in a family — the consent of the parent or legal guardian, confirmed each time the adult creates a child's profile.
For children in a group — the consent of the parent or legal guardian, obtained by the group organizer and confirmed by the organizer in the Service (section 3.2.1).
Performance of a contract — the Terms of Use you accept, which we need your data to perform.
Compliance with legal obligations — for example, responding to lawful requests.
Legitimate interests — keeping the Service secure: rate limiting, preventing abuse and logging staff actions.

Section 11 explains how these bases map to the laws of specific regions.

5. How we process data

5.1. Data is processed by automated means. Operations with data include collection, recording, organisation, accumulation, storage, updating and modification, retrieval, use, blocking, erasure and destruction. Data is transferred or disclosed only in the cases described in sections 5.3–5.5 and 6.

5.2. Where data is stored. The Service's servers and databases, including backups, are located in data centres in the Russian Federation. If you use the Service from another country, your data is transferred to and stored in Russia. The Russian Federation has not been recognised by the European Commission or the UK as providing an adequate level of data protection, and Russian authorities may request data under Russian law. We rely on your explicit consent and on the need to perform our contract with you for this transfer, and we protect the data with the measures described in the Security Policy. You can withdraw your consent at any time by deleting your account.

5.3. We engage service providers (processors) that process data on our behalf under a contract requiring confidentiality and security:

hosting of the Service and databases — a hosting provider with a data centre in the Russian Federation;
sending service emails — an email delivery service.

5.4. Within a family or group, data is visible to its members to the extent needed for the Service to work. For example, adult members of a family or group see the children's names, tasks and transactions. A child sees their own data and the names and results of other members in the contests the child takes part in. The adults of a group are the organizer and their assistants. Under the Rules for Group Organizers, parents of the children are not invited as adults of the group, so that they do not see other children's data.

5.5. Our staff access data only to support users and keep the Service running. Access requires two-factor authentication, and staff actions are recorded in an audit log. We may disclose data to public authorities only when required by applicable law.

6. Push notifications (transfer to the USA)

6.1. Push notifications are delivered through Apple Push Notification service (Apple Inc., USA) and Firebase Cloud Messaging (Google LLC, USA). For delivery, these companies receive the device push token and the text of the notification, which may include the name of a family member. Notifications about a group that is not a family contain only the group name and no names or texts of members; the details are visible inside the Service.

6.2. Push notifications are therefore turned on only with your separate, optional consent — the "Consent to International Data Transfer for Push Notifications". Without it the Service works fully, and notifications remain available inside the Service. You can withdraw this consent in the settings; the push token is then deleted. Children's accounts do not receive push notifications.

6.3. Signing in with Apple or Google is a separate action you take in that company's service under its own terms. We receive only the account identifier and email from the provider. This sign-in method is not available in some countries, including the Russian Federation.

7. Retention and deletion

7.1. Account data and content created in the account are kept until the account is deleted or consent is withdrawn.

7.2. When you delete your account or withdraw your consent, we stop processing immediately. Personal data is destroyed or anonymised within 30 days. The family's transaction history may be kept in anonymised form so that the records stay consistent for other family members.

7.3. Technical session data is deleted when it expires. Expired tokens and link codes are deleted automatically.

7.4. Children's data is kept only as long as the child's profile exists. A parent can delete a child's profile in the family at any time, and it is deleted together with the family. A child's profile in a group is deleted when the organizer removes it, when the parent withdraws consent (by telling the organizer or writing to kiddopay@odinai.pro) or when the group is deleted; the data is then destroyed as described in section 7.2.

7.5. Task confirmation photos are kept for 90 days after they are submitted and are then deleted automatically. The task, its status, comments and awarded coins remain. Deleted photos stay in backups for no more than 30 days.

8. Your rights

You (and, for a child, the child's parent or legal guardian) may exercise the rights below. The parent or legal guardian of a child in a group may contact the group organizer or us directly at kiddopay@odinai.pro. You may:

get information about how your personal data is processed and a copy of it;
ask us to correct, block or delete data that is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed;
withdraw your consent — in the Service settings ("Documents and consents" → "Withdraw consent") or by email to kiddopay@odinai.pro. Withdrawing consent means deleting the account: the Service cannot work without your email and name. Withdrawal does not affect processing carried out before it;
complain to a data protection authority or go to court.

You can change your name yourself in the Service settings. You may exercise additional rights under the law of your region (section 11). We respond to requests within 10 business days; we may extend this by 5 business days and will tell you why. Where local law sets a different deadline, we meet the shorter one. We may ask you to confirm that the request comes from the account holder. We do not charge for requests and will not treat you differently for exercising your rights.

9. Security and incidents

We take legal, organisational and technical measures to protect personal data. They are described in the Security Policy (https://kiddopay.ru/security). If a personal data breach occurs, we notify the competent supervisory authorities within the deadlines set by applicable law (in the Russian Federation — within 24 hours, with the investigation results within 72 hours; in the EU and the UK — within 72 hours) and notify affected users without undue delay where the breach is likely to put their rights at risk.

10. Children's privacy

10.1. The Service is intended for families, as well as for teachers, coaches and tutors who run groups of children. Only adults may create an account. Children use the Service only through a profile created by their parent or legal guardian, or by a group organizer who has obtained the consent of the parent or legal guardian before creating the profile (section 3.2.1).

10.2. The parent can at any time review the child's data in the Service, change it, stop further collection and delete the child's profile together with its data — in the "Family" section or by email to kiddopay@odinai.pro. For a child in a group, the parent contacts the group organizer or writes to kiddopay@odinai.pro.

10.3. We collect from a child only what is needed for the child to take part in family activities (section 3.2 and the tasks, photos and transactions the child creates in the family or group). We do not use children's data for advertising or profiling and do not show children advertising.

10.4. If we learn that we have collected personal data of a child without the consent of the parent or legal guardian, we will delete it.

11. Additional information for specific regions

11.1. European Economic Area, United Kingdom and Switzerland

Controller — see section 1.2.
Legal bases (Art. 6 GDPR / UK GDPR): providing the Service and your account — performance of a contract (Art. 6(1)(b)); service messages — performance of a contract; children's profiles — consent of the holder of parental responsibility (Art. 6(1)(a), Art. 8); push notifications — consent (Art. 6(1)(a)); security and abuse prevention — legitimate interests (Art. 6(1)(f)).
International transfers: data is stored in the Russian Federation, which has no adequacy decision. The transfer is based on your explicit consent after being informed of the possible risks (Art. 49(1)(a)) and on the necessity of performing the contract with you (Art. 49(1)(b)). Push notifications involve a transfer to the USA (section 6).
Your additional rights: data portability; objection to processing based on legitimate interests; restriction of processing; the right to lodge a complaint with the supervisory authority in your country of residence or work, or where an alleged infringement took place. We respond within one month.

11.2. United States

Children (COPPA). Children's profiles are created only by a parent, and a child's data is collected only after the parent gives consent in the adult's account. Parents can review, delete and stop further collection of their child's data at any time (section 10). We keep children's data only as long as reasonably necessary for the purpose it was collected for (section 7) and delete it securely.
State privacy laws (including California). In the last 12 months we have collected the categories of data described in section 3: identifiers (email, name, account and device identifiers), user content and internet activity limited to session data. The sources, purposes and recipients are described in sections 3–6. We do not sell or share personal information and do not use or disclose sensitive personal information for purposes that require a right to limit. You may request to know, access, correct and delete your personal information and to appoint an authorised agent; we will not discriminate against you for doing so. To submit a request, write to kiddopay@odinai.pro. If we deny a request, you may appeal by replying to our decision.

11.3. Brazil (LGPD)

The legal bases are consent (Art. 7, I), performance of a contract (Art. 7, V), compliance with legal obligations (Art. 7, II) and legitimate interest (Art. 7, IX). Children's data is processed in the child's best interests and with specific consent given by at least one parent or legal guardian (Art. 14). You have the rights under Art. 18 LGPD, including confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing and withdrawal of consent, and you may complain to the National Data Protection Authority (ANPD). The international transfer to the Russian Federation is based on your specific consent (Art. 33, VIII).

11.4. Mainland China (PIPL)

Personal information of children under 14 is sensitive personal information; it is processed only with the separate consent of the parent or guardian given when the child's profile is created. Storing your data in the Russian Federation is a cross-border transfer that we carry out with your separate consent; the recipient is the Operator named in section 1.2, and you can exercise your rights against it by email to kiddopay@odinai.pro. You have the rights to know, decide, restrict or refuse processing, access, copy, transfer, correct and delete your personal information and to have the processing rules explained.

11.5. Russian Federation

Processing is governed by Federal Law No. 152-FZ "On Personal Data". Personal data of Russian citizens is recorded, organised, stored and retrieved using databases located in the Russian Federation. For residents of the Russian Federation, the Russian-language edition of this Policy prevails.

11.6. Other countries

If the law of your country gives you additional rights regarding your personal data, we will honour them. Write to kiddopay@odinai.pro.

12. Changes and contacts

12.1. We may update this Policy. The new edition takes effect when it is published at https://kiddopay.ru/privacy. If the purposes of processing or the data we process change, we will ask for your consent again.

12.2. Send questions about personal data to kiddopay@odinai.pro.