Children's Privacy Notice

LUKi is operated by the company below. It is the only operator that collects or keeps information from a child's account.

Name

LAVA ENTERPRISES LTDRegistered in England and Wales, company number 17147950

Address

Flat 7, Carlisle Mansions Carlisle Place London SW1P 1HX United Kingdom

Telephone

+44 7752 809094

Email

privacy@luki-ai.app

We collect nothing from your child before you approve. When a person under 18 asks to use LUKi, their device creates a request and a link to send to you. The request holds a random code, an age range and an expiry date. It holds no name, no email and no other personal detail. If nobody answers, we delete it after 7 days.

With your consent we collect:

• •Their birth month and year. We never ask for the day.
• •The email address and sign-in details of their account, and the name they choose to be called.
• •The messages they send to their Character, and the replies.
• •Memories, only if you turn memory on.
• •The Character and the settings they choose.
• •The technical data every request carries: IP address, device type and app version. We use it to run the service and keep it secure. A push notification token, only if you allow notifications.

We use this information only to provide LUKi to your child: to write replies, to remember what you allowed, to keep the account secure, and to meet our legal duties. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.

• •No advertising.
• •No usage analytics and no crash reports.
• •No public profile. A child cannot make any information public or contact other people through LUKi.
• •No purchases, and no wallet, token or NFT features.
• •No custom Characters, file uploads, voice or Weekly Insight.
• •No romantic or sexual conversation. This applies to every LUKi user.

Your child's messages are sent to our AI provider, DeepInfra, which runs the model that writes replies and the model that checks each reply before your child sees it. This is part of how LUKi works, so it cannot be switched off. We do not send a child's messages to a web search provider.

These companies handle a child's information for us, only to run LUKi:

• •Supabase: the database and sign-in.
• •Railway: our application servers, including the service that stores memories.
• •Vercel: hosting of the LUKi website.
• •Cloudflare: a check on the website that a sign-up or sign-in comes from a person.
• •Resend: account emails, such as email confirmation and password reset.
• •Apple or Google: sign-in, only if your child signs in with one of them.
• •Expo, Apple and Google push services: delivery of notifications, only if you allow notifications.

We do not sell a child's information. We share it with nobody else, unless the law requires it.

You choose at approval whether LUKi keeps memory for your child, and you can change it in Family. With memory on, LUKi saves things your child shares so their Character can recall them in later chats. With memory off, every chat starts fresh. Turning memory off deletes what was saved.

LUKi's Characters are AI, not people, and they say so. Your child sees a reminder of this at the start of each chat and every hour after that. If a message suggests your child may be in danger, the Character gives a crisis helpline, and we email you to say that this happened. The email never says what your child wrote. We keep no record from that check, apart from a marker that stops us emailing you more than once a day.

In Family you can, at any time:

• •Turn memory and notifications on or off.
• •Remove your child. This withdraws your consent and stops all further collection.
• •Delete your child's account and its data.
• •For a child under 13, download a copy of their data.

You can also ask us by email to review, correct or delete your child's information. privacy@luki-ai.app

You approve from your own LUKi account, which must hold a paid plan. For a child under 13 we also confirm a completed payment on that plan. We email you when you approve and again when your child joins. If you did not approve, open Family and remove the child, or write to us.

We keep a child's information while the account is active. When the account is deleted, we delete the information within 30 days, except where the law requires us to keep a record. A request with no answer is deleted after 7 days. An account that loses its parent's approval is deleted after 30 days, or after 7 days for a child under 13.

If we change what we collect from a child's account or how we use it, we will tell you by email and ask for your consent again where the law requires it.