Privacy Notice

Data Controller

The data controller is Alessandro Malizia, Italian VAT number 03204070605, based in Rome, Italy. For privacy questions or to exercise GDPR rights, contact hello@minigenius.ai.

Data subjects and the parent's role

The account is reserved for an adult parent or guardian who gives consent and configures the child's access. A child does not create an independent account. Parents should use a nickname and avoid entering unnecessary identifying information in a profile or request.

Categories of data processed

We process only the categories needed to operate and protect the service:

• Parent data: email, declared name, country, language, consent records, account status, and subscription status.
• Child profile data: nickname, age range, language, avatar colour, limits, and preferences configured by the parent.
• Usage data: account, profile, and session identifiers, timestamps, duration, counts, aggregated topics, session status, and safety indicators.
• Technical and security data: an IP address converted to a hash during consent, user-agent, minimised technical logs, rate-limit results, and safety results.
• Payment data: Stripe processes card details; MiniGenius AI receives the customer and subscription identifiers, plan, status, amounts, and billing events required to manage the service.
• Waitlist and communication data: parent email, indicative age range, language, approximate country-level location derived by the infrastructure without retaining the IP address, consent, confirmation status, and unsubscribe status.

How voice and chat are processed

When a child speaks, audio is sent to the speech-to-text provider to obtain the transcription needed to answer. The text is checked by safety systems and, when a generated response is required, sent to the AI provider. Momo's answer may be sent to the text-to-speech provider. MiniGenius AI does not retain child audio or conversation text as a plain-text transcript. We retain only non-reversible hashes, metadata, counts, normalised topics, and safety events where necessary. Momo's spoken responses, not the child's voice, may be retained in private cache storage.

Purposes of processing

We use data to:

• create, authenticate, and protect the parent account and verify consent;
• provide Momo, voice, games, stories, profiles, daily limits, and session continuity;
• apply moderation, guardrails, abuse prevention, rate limits, and safety alerts;
• manage plans, payments, invoices, support, and privacy requests;
• send OTPs, confirmations, operational messages and, only with separate consent, promotional updates;
• measure reliability, usage, costs, and waitlist performance in a minimised form.

Legal bases

The legal basis depends on the purpose:

• Parent or guardian consent: activation of the child experience and optional promotional communications.
• Performance of a contract and pre-contractual steps: account, requested features, subscription, support, and operational messages.
• Legal obligation: tax and accounting duties, consumer protection, and responses to competent authorities.
• Legitimate interests: service security, fraud and abuse prevention, establishment or defence of legal claims, minimised diagnostics, and reliability improvements, balanced against data-subject rights.

Children's data

MiniGenius AI applies data protection by design and data minimisation. We do not ask children for their real first or last name, address, school, city, telephone number, photograph, or contact details. The 10+ profile changes only difficulty and language, not safety limits. If we become aware of unnecessary personal information, we may restrict its processing or delete it.

Recipients and Service Providers

We use technical providers only for necessary functions. Depending on the service, they act as processors or independent controllers:

• Supabase: database, authentication, and private storage, with the project hosted in the Frankfurt EU region.
• Vercel: application and API hosting in the configured region.
• OpenAI: moderation, response generation, speech-to-text, and text-to-speech when configured.
• ElevenLabs: Momo voice generation when selected as the text-to-speech provider.
• Stripe: checkout, subscriptions, payments, invoices, and customer portal.
• Resend: OTPs, confirmations, operational emails, and authorised communications.
• Cloudflare: DNS and, where enabled, network protection and security services.
• Professional advisers or authorities may receive data only where needed for professional support, legal claims, or compliance with the law.

Transfers outside the European Economic Area

Some providers or their subprocessors may process data outside the European Economic Area. In those cases, we check for an adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses, together with applicable supplementary measures. You can request information about safeguards by contacting hello@minigenius.ai.

Analytics, waitlist, and local technologies

The waitlist uses minimised first-party analytics to connect visits with completed signups. We record events, UTM parameters, language, device category, and referrer domain, without placing email in the event or collecting raw IP, full referrer URL, full user-agent, fingerprint, or child data. A random identifier remains in sessionStorage and ends with the browser session. We do not use this information for behavioural advertising and do not install third-party advertising cookies.

Retention

Different periods or criteria apply depending on the data:

• Account and profiles: for the duration of the relationship and until deletion, except where data is needed for obligations or disputes.
• Child audio and plain-text transcripts: not retained by MiniGenius AI after the request is processed.
• Message logs containing hashes and metadata: normally up to 30 days.
• Safety events: normally up to 12 months, unless an investigation, legal claim, or obligation requires longer retention.
• Contract, payment, and billing data: for the period required by tax, accounting, and legal-claim rules.
• Waitlist and marketing data: until withdrawal, deletion, or the purpose ends; minimised analytics events are periodically reviewed and deleted when no longer needed.
• Momo voice cache: while useful to provide content and reduce latency and cost, with private access and no child voice.

Security measures

We apply proportionate technical and organisational measures, including OTP authentication, environment separation, access controls, Row Level Security, server-only keys, private storage, encryption in transit, rate limits, session locks, minimised logs, and safety controls. No Internet-connected system is risk-free; measures are managed and reviewed as the service evolves.

Artificial intelligence and automated decisions

Momo uses automated systems to transcribe speech, moderate content, generate some answers, and classify metadata. These processes do not make decisions that produce legal or similarly significant effects on a child. Safety controls may block or redirect a request; parents may report an error and request support.

Operational and marketing emails

OTPs, confirmations, safety, support, and billing messages are necessary to provide the service. Promotional or launch emails require separate, optional consent. You can withdraw it using the link in an email or by contacting hello@minigenius.ai without losing access to essential account features.

Your Rights

Where provided by the GDPR, you may:

• obtain confirmation, access, and a copy of personal data;
• request rectification, erasure, or restriction;
• receive data you provided in a portable format where applicable;
• object to processing based on legitimate interests;
• withdraw consent at any time without affecting processing already carried out;
• lodge a complaint with the competent supervisory authority; in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Changes to this notice

We will update this notice when processing, providers, or applicable obligations change. The date and version will be shown on this page. If a change materially affects rights or consent-based processing, we will give appropriate notice and request renewed consent where required.

Privacy contact

To exercise rights or request information, email hello@minigenius.ai and mention MiniGenius AI. We will respond without undue delay and normally within one month. To protect the account, we may request reasonable verification of identity and the relationship with the child profile.