The Unomundi App Privacy Policy

🌍 Hi, explorer, this part is for you

We made Unomundi for you.

Before you start exploring, we want to tell you, plain and simple, what happens with your stuff while you're here.

This is the short, honest version. The longer one for grown-ups is further down.

What we keep

So Una can guide you and remember where you've been on the map, we keep:

Your nickname (whatever you choose, it does not have to be your real name)
Your age (so Una talks to you the right way; a 7-year-old and an 11-year-old don't want the same thing)
The country you call home
The countries you've explored and how far you've got
Your favourites (things you tap and save as you go through lessons; this is yours, it builds your travelbook)
What you tell Una while you're chatting with her, if your grown-up has switched chat on

That's it. No school. No address. No last name. No phone number.

What we never ask for

Una will never ask you for:

Your school or where you live
Your phone number or email
Your photo
Your full name

If you ever tell her any of these by accident, she won't repeat them. What you say to her is saved for up to 30 days, and longer only if we need it to keep you safe.

About chatting with Una

Una is an AI. She's clever, and she's kind, but she's not a person, and she's not a secret friend. Here's the deal:

Your grown-up has to switch chatting on before you can talk to her. Until they do, the chat is locked.
What you tell Una is not a secret from your grown-up. If something you say sounds like you're not safe, or like you're really sad, our team and your grown-up may see a short summary so they can help. We won't promise to keep things hidden from the people who look after you. That's not us being nosy, that's us looking out for you.
One important exception: if you ever tell Una that someone at home is hurting you, she won't tell that person. She'll help you find another grown-up you trust (a teacher, a grandparent, a friend's parent), and our wellbeing team will help too.

Who sees your stuff

Four groups, and that's it:

You
Your grown-up (the parent or carer who set up your account, the one who is linked to your account)
A small Unomundi team who keep the app safe and working
A few computers we trust who help us to run Unomundi. Your grown-ups can see who these are.

Every person on our team who can see your information has had a background check. That's a special check done by another company to make sure they are a safe, trusted person to look after kids' information. We did this because we wanted to, not because someone made us. Keeping kids safe is the whole point.

We never sell your information. Not to advertisers. Not to anyone. We will never use your favourites, your travelbook, your chats, or anything else about you to send you targeted ads or to build a profile of you for ads. There are no ads inside Unomundi today, and if we ever did add any, they would never be picked just for you.

How long we keep things

While you use Unomundi: we keep your progress so you can pick up where you left off.
After your grown-up closes the account: most of your stuff is gone in 90 days. Some things grown-ups have to keep a bit longer because the law says so. We will list those things clearly in the grown-up section so nothing is hidden.
You can take a break and come back. During those 90 days, if your grown-up changes their mind, your travelbook is still there and they can switch the account back on.

Your rights

As a kid, you have rights about your own information. You can:

See what we have about you
Change things that are wrong
Ask us to delete it (most of it, see the grown-up section for the small list of things we have to keep)
Take a break and come back later

Ask your grown-up to help, they know how to reach us.

Got questions?

You can always ask Una "what do you keep about me?" and she'll tell you, in her own words. Or your grown-up can email us at privacy@unomundi.com.

👨‍👩‍👧 For grown-ups

This section sets out how Unomundi collects, uses, shares, and protects personal data when a child uses our app, and the choices you have as the child's parent or legal guardian.

We have written it to comply with the UK Data Protection Act 2018, the UK GDPR, the ICO Age Appropriate Design Code (Children's Code), the EU GDPR (where applicable extraterritorially under Article 3(2)), COPPA for users in the United States, and the Singapore Personal Data Protection Act and the PDPC's March 2024 Advisory Guidelines on children's data for users in Singapore.

1. Who the controller is

The data controller is Una's World Holding Limited, a UK private limited company (UK Company No. 17032480), registered office 66 Paul Street, London, EC2A 4NA. You can reach us at:

General privacy questions: privacy@unomundi.com
Data Protection Officer: dpo@unomundi.com
Designated Safeguarding Lead: Sonja Keerl, sonja@unomundi.com

Our EU representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact if you live in the European Union.

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/14314064986.

2. Children's data, parental consent.

Unomundi is designed for children aged 6 to 12.

No Explorer profile can exist before a guardian has given verifiable parental consent. A guardian creates the household account first. We send the guardian a notice email setting out what we collect and how it will be used, together with an explicit declaration of legal guardianship for the guardian to confirm, followed by a second, confirmatory email no sooner than 24 hours later, and only once the guardian has completed our consent process, including a store subscription or trial purchase through the App Store or Google Play, is the Explorer profile created. A child never registers, signs in, or uses the app before their guardian has consented. For users in Singapore, every user is treated as under 18, and consent always comes from the guardian.

3. What personal data we collect, and why

We collect only what we need. The full list is below.

Explorer (child) account data

Guardian (adult) account data

What	Why	Lawful Basis
Nickname (chosen name, not necessarily their legal name)	Personalisation, profile continuity	Verifiable parental consent + contractual necessity
Age (integer)	So Una can adapt language and content appropriately	Verifiable parental consent
Country the child calls home	Cultural personalisation	Verifiable parental consent
Countries explored, lessons completed, ambassador progress	To save the child's journey and travelbook	Contractual necessity
Favourites the Explorer selects during lessons	Builds the Explorer's travelbook; gives the child agency over what they collect	Contractual necessity
Una conversation transcripts (for 30 days)	Only if conversational AI is enabled by guardian; needed to provide the conversation, run safety checks, and generate guardian summaries	Verifiable parental consent (separate, opt-in)
Safety signals raised by our system (escalation level L1 to L5 per our Child Safety SOP)	To protect the child	Vital interests + legal obligation (safeguarding)
Reports a child sends from the app (the reason chosen, and the child's profile ID)	To review the report and keep the child safe	Legitimate interests; vital interests and legal obligation where the report raises a safeguarding concern

What	Why	Lawful basis
Guardian's preferred name	Account identification	Contractual necessity
Email address	Account login, verifiable consent flow, account recovery, and (if you opt in) safety summaries	Contractual necessity + consent for summaries
Confirmation of adulthood and legal guardianship	Verifiable consent gate	Legal obligation
Optional: cultural backgrounds, faith preferences, notification preferences, support-mode flag	So Una respects the family's context	Verifiable parental consent
Verifiable parental consent records (timestamps, the version of the notice you saw, your guardianship declaration, and OTP or re-authentication confirmations)	Legal record-keeping	Legal obligation

Technical data

What	Why	Lawful basis
IP address, device model, OS version, app version, crash logs, anonymised usage events	Run the service, fix bugs, prevent abuse	Legitimate interests (limited to what is needed)

What we do not collect. Precise geolocation. Contact lists. Photos. Biometric data. School information. Full legal names of children. Home addresses. Phone numbers. We do not use behavioural advertising. The app is ad-free. We use persistent identifiers, such as a device or profile ID, only to run the service: keeping you signed in, saving progress, fixing bugs and keeping the app safe. We don't use them to track children across other apps or websites, or for advertising. We don't pass persistent identifiers to any third party, including ElevenLabs.

4. Conversational AI (Una)

Una's conversational AI is off by default. A guardian must explicitly enable it and accept a separate set of conversational AI usage terms before any conversation can take place.

When enabled:

Conversations are processed by our vertical AI stack (cultural and developmental layer, child-optimised behaviour engine, safety guardrails). Our current AI conversation provider is ElevenLabs.
What we share with ElevenLabs and what we do not. We share the conversation audio with ElevenLabs so it can be processed for the AI response. We share only the Explorer's nickname, age and country alongside the audio, and never any account-level identifying information. The audio itself is personal data because it is the child's voice. We do not use voice data for biometric identification or voice-print matching, and our agreement with ElevenLabs prohibits any such use. Unomundi does not store audio. Your child's voice is sent to ElevenLabs live so Una can respond. ElevenLabs does not keep the audio; it is deleted immediately after use. We keep only the written transcript of the conversation, for 30 days (see Section 8). A US rule allows an operator to collect a child's voice instead of typed text without full parental consent, but only if the recording is used once and deleted straight away. We treat voice recordings that way: they are used live and deleted immediately. But a conversation is more than the recording. We also keep the written transcript for 30 days for safety review, so we ask for full verifiable parental consent before any conversation takes place.
A short safety summary of each session is generated and may be reviewed by our internal Child Wellbeing Team. Summaries are shared with the guardian if the guardian has opted in to summaries.
Safety classification (Levels L1 to L5) is performed by our Child Safety Agent, which runs through n8n workflows on anonymised data only. These workflows never see the user ID or any data that links a conversation back to a specific Explorer or Guardian. The link is only re-established server-side when a human safeguarding decision needs to be made.
Safeguarding override. If a child discloses abuse by the guardian who would normally be notified, the disclosure is escalated to our internal Child Wellbeing Team only, who follow local mandatory reporting laws. The implicated guardian is not notified.

AI Act compliance.

Una is an AI system regulated under the EU AI Act. Specifically:

First-interaction transparency. Before a child can talk with Una, at the start of every conversation, which is capped to 5 minutes, the app makes clear in age-appropriate language that Una is an AI, not a real person. Una does not claim to have feelings, does not offer herself as a substitute for a trusted adult, and does not act as a therapist. She acknowledges a child's feelings, offers one safe next step, and encourages a trusted adult. A persistent visual indicator confirms this throughout the conversation, in line with Article 50(1) of the AI Act.
No prohibited practices. As set out in Una's Constitution and our product design, we do not use subliminal manipulation, do not exploit age-related vulnerabilities to drive engagement or data sharing, and do not perform emotion recognition in any educational or assessment context. These align with Article 5 of the AI Act.
AI-generated content provenance. Some content in the app, such as stories, audio or visuals, is created with AI in advance and checked by a person before children see it. From 2 August 2026, AI-generated content like this carries machine-readable watermarking and provenance metadata, as required by Article 50(2) of the AI Act. Una's conversations are generated live during the conversation and are not published as content.
AI literacy. Our staff, contractors, and partners who work on or with Una receive AI literacy training appropriate to their role, in line with Article 4 of the AI Act.

5. The Child Wellbeing Team and access controls

Access to children's personal data inside Unomundi is restricted to a small Child Wellbeing Team with a documented safeguarding role. Specifically:

Every person with access to children's data has passed a third-party background check in their country of residence. This is a commitment we have chosen to make. It is not a UK GDPR or ICO Children's Code requirement. We do it because it is the right thing.
The Designated Safeguarding Lead and Deputy DSL hold Level 3 DSL certification, refreshed every two years.
Access is role-based and tiered. Routine safety review (escalation levels L1 to L4A) is restricted to the Child Wellbeing Team. The most sensitive safeguarding logs (escalation levels L4B and L5) are accessible only to the DSL, Deputy DSL, and Board-level Safeguarding Lead.
All access is audit-logged.

6. How we share data

We share personal data only with:

Sub-processors who help us run the service, currently:
- ElevenLabs (conversational AI)
- Supabase (database)
- RevenueCat (payments)
- AWS (hosting infrastructure)
- Sentry (crash reporting and logging)
- n8n (orchestration of the Child Safety Agent, anonymised data only)
- Slack (internal child safety escalations)
- Google (storage of escalated safety transcripts, and the inbox that receives child reports; data held in the EU)
- Vercel (hosting of the internal tool that displays personal data; data held in the EU)

All sub-processors are bound by data processing agreements meeting UK GDPR Article 28 standards. A current list lives at unomundi.com/subprocessors.

Our internal Child Wellbeing Team, for safeguarding purposes.
Authorities, where local mandatory reporting laws require it (for example, credible disclosure of abuse).

No advertisers selecting children. No data brokers. No social media tracking SDKs. No profiling for advertising. Ever. This commitment includes favourites, travelbooks, lesson behaviour, conversations with Una, and every other piece of information we hold about a child or their family. Unomundi is ad-free at this time. If we ever introduce any form of advertising in the future, it will never be behavioural, targeted, or based on profiling of children or their families. That is a hard line.

7. International transfers

Where data leaves the UK, we rely on UK International Data Transfer Agreements (IDTAs), the UK Addendum to the EU SCCs, or applicable adequacy decisions as the transfer mechanism. Where EU GDPR applies, we additionally rely on EU Standard Contractual Clauses. Our main database (Supabase) is held in Singapore, and several sub-processors hold data in the EEA. Some sub-processors (ElevenLabs, AWS, RevenueCat and Sentry) process data in the United States. For ElevenLabs, AWS and Sentry we rely on the UK-US Data Bridge; for RevenueCat we rely on the EU Standard Contractual Clauses with the UK Addendum, and we rely on the same for Supabase in Singapore. Details and copies of transfer mechanisms are available on request. For users in Singapore, every recipient outside Singapore is bound to protect the data to a standard comparable to the Personal Data Protection Act, as its Transfer Limitation Obligation requires.

8. Retention

We keep data only as long as we need it. The table below sets out our defaults. Some categories survive account deletion because we are legally required to keep them; those carve-outs are listed explicitly so nothing is hidden.

90-day soft-delete window.

When a guardian initiates account deletion, the account enters a pending_deletion state for 90 days. During this window the guardian can restore the account and all data is recovered intact. After 90 days, all categories above are purged according to the table, with the exception of the consent records and safeguarding logs, which follow the longer periods set out in the table.

Why those carve-outs exist. UK GDPR Article 17(3)(b) and (e) recognise that the right to erasure does not override legal obligations or processing necessary for safeguarding. We could pretend they don't, but we won't. If a child has ever been the subject of a safeguarding escalation, we are legally required to preserve those specific logs even if the family deletes the account. We tell you this here, in plain language, so the deletion promise is honest.

Where we tell you this. We surface these retention carve-outs in three places: (1) here in the privacy policy, (2) in the account deletion confirmation email sent to the guardian when deletion is initiated, and (3) in our Terms and Conditions. We do this so no guardian is ever surprised, after deletion, by what we have kept and why.

9. Your rights

Under UK GDPR, the child (exercised through the guardian) has the right to:

Access the data we hold (data export available in-app under Settings → Data & Privacy)
Rectify inaccurate data
Erase the data, subject to the carve-outs in Section 8
Restrict or object to processing
Data portability
Withdraw consent at any time

To exercise any of these rights: privacy@unomundi.com. We respond without undue delay, and within one month at the latest.

Not happy with how we've handled your data? Tell us first.

Email privacy@unomundi.com (or use "Contact us" in your guardian dashboard) and let us know what's gone wrong. We'll confirm we've received it within 30 days (we aim for much faster), and get back to you with a proper answer without unnecessary delay, keeping you posted if it's taking a while. Under the UK Data (Use and Access) Act 2025 you can complain to us directly, and the Information Commissioner's Office will normally expect you to have given us the chance to put things right before it looks at a complaint.

If you're still not satisfied once we've responded, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk. Where EU GDPR applies, you may also complain to the relevant EU supervisory authority.

If what you want to raise is about your child's safety rather than their data, something Una said, or a safety concern, please email trust@unomundi.com so it reaches our Child Wellbeing Team directly.

If you believe consent for your child's account was given without your knowledge or authorisation (for example, by another adult in the household, or by the child themselves bypassing our verification), please contact us immediately at trust@unomundi.com. We will investigate, suspend the account pending review, and follow our documented misappropriated-consent policy.

Under COPPA, US-based parents additionally have the right to review the personal information collected from their child, refuse to permit further collection, and request deletion (subject to the same legal-obligation carve-outs above).

10. Security

We use:

Encryption in transit (TLS 1.2+) and at rest (AES-256)
Role-based access controls and audit logging
Multi-factor authentication for all internal access to systems holding children's data
Continuous breach detection and incident response procedures
Third-party background checks for every team member with access to children's data (see Section 5)
Anonymisation of data passed to the Child Safety Agent's n8n workflows (see Section 4)
Regular third-party penetration testing every three months.
A documented data breach response policy aligned with UK GDPR Articles 33 and 34, including 72-hour supervisory authority notification

We have carried out a Data Protection Impact Assessment (DPIA) as required by UK GDPR Article 35, in line with Information Commissioner's Office guidance. If a data breach affects a child in Singapore, we tell the guardian and also tell the child in age-appropriate language.

11. Cookies and similar technologies

We use cookies and similar device-storage technologies sparingly, and only where necessary to operate the service or where you have given explicit consent.

We do not use marketing, advertising, or behavioural tracking cookies in any context where a child may interact with the app. For guardian-only sections of our service, any non-essential cookies require your explicit consent through a compliant consent banner with a "reject all" option on the first layer, granular controls, and an easy withdrawal mechanism.

A full list of the cookies and similar technologies we use, their purposes, and how to manage them, is available in our Cookie Policy. You can withdraw cookie consent at any time from Settings > Privacy & Cookies.

12. Changes to this policy

If we make material changes, particularly any that affect what we collect from children or how we use it, we will notify guardians by email and require renewed consent before the change takes effect.

13. Contact

General privacy questions: privacy@unomundi.com
Data Protection Officer: dpo@unomundi.com
Designated Safeguarding Lead: sonja@unomundi.com
Postal address: Una’s World Holding Limited, 66 Paul Street, London, EC2A 4NA

Unomundi was built on a simple promise: we never compromise children's safety or privacy, no matter the financial gain. This policy is one of the ways we keep that promise.

Data category	While account is active	After deletion or inactivity
Child reports (report emails and the matching Slack notification)	Until handled, then up to 90 days	Hard delete 90 days after the report is handled, unless linked to a safety escalation (then kept with the safeguarding logs: 12 months for L1 to L4A, 7 years for L4B and L5)
Data protection complaints records	Kept while the complaint is open	Kept for 3 years after the complaint is closed, unless a live regulatory matter requires longer
Account identity (guardian email, explorer nickname, age, home country)	While account is active	Hard delete at end of 90-day soft-delete window
Una conversation transcripts (for 30 days)	Only if conversational AI is enabled by guardian; needed to provide the conversation, run safety checks, and generate guardian summaries	Hard delete at 30 days, unless linked to a safety escalation (then kept with the safeguarding logs: 12 months for L1 to L4A, 7 years for L4B and L5, as below)
User-generated content (drawings, texts, favourites)	While account is active	Hard delete at end of 90-day soft-delete window (max 7-day sync buffer thereafter)
Educational progress (lessons, countries, quizzes, ambassador)	While account is active	Hard delete at end of 90-day soft-delete window
Rewards and badges	While account is active	If account is deleted: hard delete at end of 90-day soft-delete window. If account is inactive but not deleted for 12 months: anonymised.
Technical logs (IP, crash, device ID, session)	Rolling 90 days	Auto-purge every 90 days
Verifiable parental consent records	While account is active	Pseudonymised at end of 90-day soft-delete window (email and name removed; timestamp and terms agreed retained). Retained 7 years post-deletion for legal record-keeping (UK GDPR accountability, COPPA), then purged.
Safeguarding logs, levels L1 to L4A	While account is active	12 months for QA
Safeguarding logs, levels L4B and L5	While account is active	Retained 7 years post-deletion for child protection statute of limitations and mandatory reporting obligations. The 7-year period extends if there is an active safeguarding concern or live mandatory-reporting matter at the 7-year mark.