Legal · Safety & Privacy

Children’s Privacy Policy

Product: KAI’™ Child Conversational AI App (Ages 6-14)

Last updated: [DATE] | Version: 1.0 · Designed to comply with the GDPR (EU), COPPA (US), the EU AI Act and the DSA (Art. 28).

Pre-launch version. The KAI’™ App and the Zeno™ device are in development and not yet available. This policy describes how they will work at launch and will be finalized after legal review, before any child can use the service.

1. Who We Are

  • Data Controller: ZenoAI Inc., Miami, Florida 33130, United States.
  • General Contact: privacy@zenoai.com
  • Our Service: We provide a secure, pedagogical conversational AI assistant for children, under continuous parental supervision. The service contains no advertising, no commercial profiling and no unmonitored access to the open web.

2. Data Protection Officer (DPO)

For any questions regarding your or your child’s data, you may contact our DPO directly at: dpo@zenoai.com.

3. Scope & Covered Individuals

  • Parents / Legal Guardians: Account holders, subscribers and supervisors of their child’s use of the service.
  • Children (Ages 6-14): Users of the KAI’™ conversational interface, through a profile created and supervised by their parent.

4. What Data We Collect & Process

A. Parent Data

Stored in the parent’s region: within the European Union for EU residents, and within the United States for US residents.

  • Registration email, password (stored in encrypted form) and connection logs, retained for 6 months.
  • Verifiable parental consent record: date, time and type of verification confirming that the account holder is an adult.
  • Account settings and pedagogical preferences chosen by the parent.

B. Child Data (Pseudonymized)

  • Pseudonymous Identifier: Each child profile is linked to a pseudonymous identifier generated through a regional key management system. Keys for EU residents are held in the European Union; keys for North American residents are held in the United States. No directly identifying information is linked to this identifier.
  • Minimized Demographics: Region, language and age band (6-9 or 10-14). We never request or store a child’s exact date of birth.
  • Nickname: Chosen by the parent (for example, “AstroLion”). The child’s real first name is never requested.
  • Learning Preferences: Non-identifying preferences (for example, favorite topics) used to keep continuity between learning sessions, without behavioral tracking.
  • Conversation History: Text histories of the child’s conversations, accessible only to the parent through the secure parental dashboard.

C. Data We Do Not Collect

Before any content reaches the AI, our filtering system detects and blocks personal information such as physical addresses, phone numbers, school names, photographs, precise geolocation, biometric data, government identifiers and sensitive data (GDPR Art. 9). Blocked content is rejected and never stored.

5. Purposes & Legal Bases of Processing

  • Purpose: Providing a pedagogical AI companion to children under parental supervision, and keeping the service safe and secure.
  • Legal Bases (EU): Parental consent under GDPR Art. 6(1)(a) and Art. 8, and our legitimate interest in ensuring child safety and service security under GDPR Art. 6(1)(f).
  • Legal Basis (US): Verifiable parental consent under COPPA.
  • No Profiling: In line with DSA Article 28, we do not use children’s data for profiling-based advertising or algorithmic targeting, and we never sell data.

6. Verifiable Parental Consent (VPC)

Every child profile is created by a parent. Before it is activated, the parent must complete verifiable parental consent through a specialized verification partner, using methods recognized by the FTC under COPPA, such as payment card verification or government ID verification. Records confirming consent are retained for 5 years after account deletion, for compliance purposes.

7. How KAI’™ Processes Conversations

  • Model-Agnostic Design: KAI’™ uses AI models as interchangeable components, operated on infrastructure under our control. Children’s data is never used to train AI models and is never shared with AI companies for their own purposes.
  • Real-Time Processing: Conversation content and voice inputs are processed in memory to generate responses and are not retained on processing servers once the session ends.
  • Voice: The child’s voice is converted to text in real time and the audio is deleted immediately. AI voice responses are generated and streamed in real time. No audio recordings are stored.
  • Safety & Transparency: In line with the EU AI Act, KAI’™ tells children that they are talking to an AI, never presents itself as a human or as a substitute for an adult, and encourages children to talk to their parents or a trusted adult when appropriate.

8. Data Retention & Deletion

In line with the GDPR storage limitation principle (Art. 5(1)(e)) and COPPA data retention requirements:

  • Conversation Processing: Not retained after the response is generated.
  • Conversation History (Parental Dashboard): Automatically deleted after 30 days by default, or up to 90 days if the parent chooses.
  • Pseudonymous Identifier: Kept until the parent account is deleted.
  • Technical Logs: Kept for 30 days and never contain conversation content.
  • Deletion on Request: Parents can delete their child’s history at any time from the parental dashboard. Deletion is completed on our production systems within 24 hours, and backups are overwritten within 30 days.

9. International Data Transfers

Data of EU residents is stored and processed within the European Union. Where a limited transfer outside the European Union is necessary, it is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (GDPR Art. 46), supported by a transfer impact assessment where required.

10. Data Recipients

  • Internal: Access limited to authorized support and engineering staff and the DPO, on a strict need-to-know basis.
  • Service Providers: Carefully selected providers acting only on our instructions, such as cloud hosting, email delivery, payment and identity verification, all bound by data protection agreements.
  • Third Parties: We never sell, rent or trade data with advertisers, data brokers or AI companies.

11. Your Parental Rights

Under the GDPR (Articles 15-21) and COPPA (§312.6), parents can exercise the following rights at any time through the parental dashboard or by contacting dpo@zenoai.com:

  • Review: Access and view your child’s conversation history.
  • Withdraw & Delete: Withdraw your consent at any time, which closes your child’s profile and deletes their data within 24 hours.
  • Restrict & Object: Change your child’s settings or disable features at any time.

We respond to all requests within one month. If you believe your rights have not been respected, you may lodge a complaint with the CNIL (France, www.cnil.fr), the FTC (United States) or your local data protection authority.

12. Changes to This Policy

We will inform parents of any material change to this policy before it takes effect and, where required, ask for their consent again.

13. Contact

ZenoAI Inc., Miami, Florida 33130, United States · privacy@zenoai.com · DPO: dpo@zenoai.com