🛡️ Privacy Protection & Child Safety

Privacy Policy

👶 Our Promise to Parents & Children:

Buukilino was built specifically for children and families. We never sell personal data, display no advertising networks inside the app, and collect only the absolute minimum required to provide the digital friendship book.

1. Privacy at a Glance

The following overview explains what happens to your personal data when you visit our website or use the Buukilino mobile app.

2. Data Controller

The controller responsible for data processing on this website and within the app is:
Ertan Toker
Rembrandtstr. 12
42579 Heiligenhaus
Germany
Email: info [at] buukilino.app

3. Special Protection of Children’s Data (Art. 8 GDPR)

Protecting children is our highest priority:

  • No Ad Trackers in the App: The Buukilino kids app contains zero advertising networks, zero commercial trackers, and zero marketing SDKs.
  • Closed Circle of Friends: Children cannot be searched for publicly or contacted by strangers. Connections happen exclusively via direct invite codes or mutual addition.
  • Privacy-Preserving Accounts: Children’s accounts require no real names and no email addresses to register.
  • Parental Approval for Exports: Book PDF previews are sent directly to parents’ email addresses, ensuring parents remain in full control of all stored memories.

4. What Data Do We Process in the App?

a) Registration & Account: Username, display name, password (securely hashed with bcrypt), favorite color, and avatar emoji.
b) Friendship Book Entries: Answers to questions (e.g. hobbies, favorite animals), digital canvas drawings, and voice recordings.
c) Voice Notes & Sound Stickers: When a voice note is recorded, the audio file is stored encrypted on our secure German servers and is accessible only to the book owner and via the book’s QR code.
d) PDF Orders: Parent’s email address for delivering the digital print file.
e) In-App Purchases (Buukilino Club): Handled securely via Apple In-App Purchase and RevenueCat. No payment or credit card credentials are ever stored on our servers.

5. Printed Book Orders (Production, Delivery & Payment)

When you order a printed friendship book in the app, we process your information to produce the book, handle payment, and ship it to your desired delivery address.

a) Printing, Binding & Shipping

For physical manufacturing and courier delivery, we cooperate with specialized service providers:

  • Print & Production Partners: To print your book, we transmit the print file (the generated PDF containing profiles, drawings, and texts) along with your name and delivery address to specialized book printing partners. They process data solely under our instructions for printing.
  • Logistics & Couriers: For parcel delivery, the recipient’s address is transmitted to postal service providers (e.g. Deutsche Post / DHL). Where available, you will receive tracking numbers by email to follow your package.

Legal Basis: Data transfer occurs strictly for contract fulfillment pursuant to Art. 6 (1) lit. b GDPR.

b) Payment Processing (Stripe)

Payment for printed books is processed via the internationally certified payment service provider:
Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (Parent company: Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA).

Through Stripe, we offer multiple secure payment methods (including credit card, Apple Pay, Google Pay, Klarna).

  • Payment Data Processing: When selecting a payment option, payment details (card numbers, expiration, CVC, invoice amount, IP address) are transmitted directly via encrypted SSL/TLS connections to Stripe. Buukilino never stores complete credit card numbers or bank data on its own servers.
  • Fraud Prevention: Stripe utilizes automated systems to identify and prevent fraudulent transactions.
  • Legal Basis: Processing occurs for contract fulfillment under Art. 6 (1) lit. b GDPR and based on our legitimate interest in secure payment processing under Art. 6 (1) lit. f GDPR.
  • Third-Country Transfers: Stripe is certified under the EU-US Data Privacy Framework (DPF), ensuring an adequate level of data protection comparable to European standards.

6. Cookies & Consent Management on this Website

Our website uses a Cookie Consent tool to obtain your legally required consent for storing cookies or using tracking technologies on your device and to document it in compliance with the GDPR.

The legal basis is Art. 6 (1) lit. c GDPR and German § 25 (2) TDDDG for strictly necessary cookies. You can adjust or withdraw your consent at any time via the button in the website footer.

7. Web Analytics with Google Analytics (Website Only)

If you have granted consent (Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG), this marketing website uses Google Analytics, a web analysis service of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Important Clarification: Google Analytics is loaded strictly on our public marketing website (buukilino.app) upon consent. In the Buukilino Kids Mobile App, Google Analytics is never used.

Google Analytics uses cookies and similar technologies enabling an analysis of website usage. The generated information about website usage is usually transferred to a Google server in the USA and stored there.

  • IP Anonymization: IP anonymization is enabled by default. Your IP address is shortened within Member States of the European Union or other contracting states to the EEA Agreement before transmission.
  • Processing Purpose: Google uses this information on our behalf to evaluate website traffic, compile activity reports, and provide related services.
  • Third-Country Transfers: Google is certified under the EU-US Data Privacy Framework (DPF), guaranteeing a European standard of data privacy.
  • Withdrawal & Opt-Out: You can revoke your consent at any time with future effect by clicking on Cookie Settings and disabling “Analytics & Statistics”.

8. Server Location & Data Retention

All core application data and databases are processed exclusively on secure servers located in Germany / European Union. Data remains stored as long as the user account is active and can be deleted at any time.

9. Your Rights (Access, Rectification, Erasure)

You and your children have the right at any time to:

  • Free information and access to your stored personal data (Art. 15 GDPR).
  • Rectification of incorrect personal data (Art. 16 GDPR).
  • Complete erasure of your account and all friend book entries (Art. 17 GDPR).
  • Restriction of processing and data portability (Art. 18 & 20 GDPR).

To exercise these rights, simply email our support team or use our online form at Delete Account & Data.