GDPR & UK GDPR notice
Last updated 18 October 2026
Extra detail for families in the European Union, the European Economic Area, the United Kingdom and Switzerland. It adds to our Privacy Policy and doesn't replace it.
1. Controller
The controller is Neobound AI, 804, Tower-19, Plot No. 9, Unitech Habitat, Sec Pi-2, Alpha Greater Noida, Gautam Buddha Nagar, Uttar Pradesh, India – 201310. Email info@neobound.ai. We have not appointed a data protection officer, because Osmo does not process data at the scale that requires one; privacy questions go to the contact above.
2. What we process, why, and our legal basis
| Purpose | Information | Legal basis |
|---|---|---|
| Running the app for the child (stories at the right level, chosen topics, progress, stamps) | Random Osmo ID, session key, nickname, grade, suit colour, topics, language, reads, quiz answers, reactions | Consent given by the parent or guardian (Art. 6(1)(a) and Art. 8 GDPR) |
| Removing unsuitable stories | Stories reported by the child | Consent; and our legitimate interest in keeping children safe (Art. 6(1)(f)) |
| Osmo Plus | Google Play purchase token, plan, renewal status, order ID, expiry | Performance of the subscription contract with the parent (Art. 6(1)(b)) |
| Tax and accounting records | Order ID, plan, amount, date (not linked to a profile after deletion) | Legal obligation (Art. 6(1)(c)) |
| Counting use of features | Daily totals with no identity, and which days a profile was active | Legitimate interest in improving Osmo, with no profiling of children (Art. 6(1)(f)) |
We don't process special categories of data, and we don't make decisions about anyone by automated means that have legal or similarly significant effects (Art. 22). Reading levels come from the grade a grown-up chooses.
3. Children and parental consent
Osmo is made for children under the age of digital consent in every country (13 to 16, depending on the country). So a parent or guardian must confirm they hold parental responsibility and give consent before a profile is created, and only a grown-up can change settings, see the original articles, or buy Plus. We follow the UK Age Appropriate Design Code: high privacy by default, no nudge techniques, no profiling, no geolocation, no sharing.
4. International transfers
Osmo's servers are in India (Google Cloud, Mumbai). When a family in the EU/UK uses Osmo, their information is sent to and stored in India. India does not currently have an EU or UK adequacy decision. We keep the information to the minimum described here and protect it as described in section 7 of the Privacy Policy. Google Cloud hosts it as our processor under its data processing terms. Our AI provider (Microsoft Azure) receives public story text only, never information about a child.
5. How long we keep it
- Child profile and activity: until you delete it in the app, or automatically after 400 days without use.
- Plus purchase status: while the subscription is active, then deleted with the profile.
- Accounting records: as long as Indian tax and accounting law requires, without a link to any profile.
- Server logs: our servers don't record visitors' IP addresses.
6. Your rights
You can ask to access a copy, correct, erase, restrict or object to processing, receive the data in a portable format (portability), and withdraw consent at any time without affecting earlier processing. Most of this you can do yourself in the app under Passport → Grown-ups (change details, or Delete all data). For anything else, email info@neobound.ai with the Osmo ID shown under Grown-ups. We reply within one month. Because Osmo has no accounts, the Osmo ID is how we find a profile; we can't look one up by name.
7. Complaints
Please contact us first. You also have the right to complain to the data protection authority where you live or work, for example the UK Information Commissioner's Office, or any EU authority listed by the European Data Protection Board.