KKiddoPay
Sign inStart for free

Personal Data Security Policy

Effective as of November 6, 2026

This document describes the measures the operator of the KiddoPay service (the "Operator") takes to protect personal data in the KiddoPay service. It serves as the Operator's written information security program, including for children's personal data, and follows Articles 18.1 and 19 of Russian Federal Law No. 152-FZ "On Personal Data" and the related government requirements, Article 32 of the GDPR, Article 46 of Brazil's LGPD, and the security requirements of the US Children's Online Privacy Protection Rule (COPPA).

1. Organisational measures

  • a person responsible for personal data processing and security has been appointed — contact: kiddopay@odinai.pro;
  • the Privacy Policy, this Security Policy and an incident response procedure have been adopted;
  • security threats and the required protection level of the information system have been assessed;
  • staff access to personal data is limited to those who need it for their work. Staff are trained in data protection requirements and bound by confidentiality;
  • service providers that process data on our behalf (hosting, sending emails) are bound by contracts requiring confidentiality and security;
  • the Operator reviews its compliance and these measures at least once a year and after significant changes to the Service.

2. Technical measures

Storage. Databases containing personal data are hosted in a data centre in the Russian Federation. Backups are created and kept there as well.

Encryption in transit. All traffic between the apps, the website and the server uses HTTPS (TLS).

Passwords and PINs. Passwords and children's PINs are stored only as Argon2id hashes with a unique salt. We never know the original values. After 5 incorrect PIN attempts, sign-in is temporarily blocked.

Sessions.

  • the access token lives for 15 minutes and is kept only in the app's memory;
  • the refresh token is kept in the device's secure storage (Keychain, EncryptedSharedPreferences) or in an httpOnly cookie that page scripts cannot read;
  • the token is replaced with a new one at every refresh;
  • reuse of an old token is treated as a sign of theft, and all sessions in the chain are ended;
  • users see a list of their sessions and can end any of them.

Access control.

  • each family's data is available only to its members, and the server checks this on every request;
  • permissions within a family depend on the role (owner, adult, child);
  • a child sees their own data, as well as other participants’ names and shared competition results to the extent described in the Privacy Policy.

Staff access. The admin panel is available only to staff with two-factor authentication. All staff actions are recorded in an audit log.

Abuse protection.

  • request rate limiting, including separate limits for sign-in and registration;
  • input validation;
  • security HTTP headers;
  • idempotency of coin operations.

Data minimisation.

  • the Service collects only the data listed in the Privacy Policy;
  • the website has no third-party scripts, counters or advertising cookies; fonts are served from our own server;
  • push notifications, which require a transfer of data abroad, are turned on only with separate consent.

Deletion.

  • after an account is deleted or consent is withdrawn, access to the account is blocked immediately and personal data is anonymised within 30 days;
  • expired tokens and link codes are deleted automatically.

3. Incident response

If personal data is unlawfully or accidentally transferred, disclosed or accessed, the Operator:

  1. eliminates the cause and consequences of the incident;
  2. notifies the Russian data protection authority (Roskomnadzor) within 24 hours of the presumed causes, possible harm, measures taken and a contact person, and reports the results of the internal investigation within 72 hours;
  3. where the incident affects users in the EEA, the UK, Brazil or other countries with breach notification laws, notifies the competent supervisory authorities within the deadlines set by those laws (in the EEA and the UK — within 72 hours of becoming aware of it; in Brazil — the ANPD within 3 business days);
  4. notifies affected users without undue delay if the incident is likely to put their rights at risk, and explains what they can do to protect themselves.

The Operator also cooperates with the Russian state system for detecting and responding to computer attacks (GosSOPKA) as required by Russian law.

4. Reporting a vulnerability

If you find a vulnerability or suspect a data leak, please write to kiddopay@odinai.pro. Do not use the vulnerability to access other people's data. We will confirm receipt of your report and let you know the outcome of our review.

Personal Data Security Policy · KiddoPay