Privacy Policy

Last updated: May 2026

1. Introduction

This Privacy Policy explains who we are, how we collect, share, and use personal information about you, and how you can exercise your privacy rights. It applies to all users of the Fnocki & Docki kids content portal.

2. Data controller

The data controller responsible for your personal information is Fnocki & Docki. You can contact our Data Protection Officer at privacy@fnockidocki.com.

3. Data we collect

  • Account data: email, display name, optional phone number, and hashed password.
  • Child profiles: name, age, preferred language, and interests. This information is provided voluntarily by a parent or guardian and is never shared with third parties.
  • Payment data: processed entirely by Stripe; we store transaction IDs and order history but never store full card numbers or CVV.
  • Usage data: pages visited, content viewed, time spent, playlist interactions, door scans, badge progress, and search queries.
  • Technical data: IP address, browser type and version, device type, operating system, and referral source.
  • Communication data: emails sent and received via our platform (Mailgun) and newsletter subscription status.
  • Cookie data: please see our Cookie Policy.

4. How we use data

We use your data to provide and improve our service, personalize content, process payments, and send communications (marketing communications are sent only with your explicit consent). We also use data for analytics, our badge and gamification system, license key management, and fraud prevention.

5. Legal bases (GDPR Art. 6)

We process your data based on: Consent (for marketing emails, analytics cookies, and newsletters); Contract performance (for account management, service delivery, and payment processing); Legitimate interests (for security, fraud prevention, and service improvement); and Legal obligation (for tax records and responding to law enforcement requests).

6. Children's privacy

CRITICAL: We collect child data ONLY through verified parental accounts. We never collect data directly from children. Child profiles are entirely optional and controlled by parents. We do not serve behavioral advertising to children and we do not sell children's data. Parents can view, edit, or delete child profiles at any time via the dashboard. We strictly comply with GDPR provisions on children's data (Art. 8) and follow COPPA principles.

7. Data sharing

We share data with trusted third parties: Stripe (payment processing, USA, under EU SCCs), Mailgun (email delivery, USA, under EU SCCs), Google Analytics (usage analytics, USA, under EU SCCs), and Floot (hosting infrastructure, EU). We never sell your personal data.

8. Data retention

Account data is kept while the account is active and for 30 days after a deletion request. Payment records are kept for 7 years for tax and legal purposes. Analytics data is anonymized after 26 months. Child profiles are deleted immediately upon parent request.

9. International transfers

Some of our processors are based in the USA. These data transfers are protected by EU Standard Contractual Clauses (SCCs) and/or relevant adequacy decisions.

10. Data security

We protect your data using encryption in transit (TLS) and at rest, hashed passwords (using bcrypt), role-based access controls, and regular security reviews. We do not store sensitive data in plain text.

11. Your rights under GDPR

You have the right of access, rectification, erasure (the "right to be forgotten"), data portability, restriction of processing, objection to processing, and the right to withdraw consent. You also have the right to lodge a complaint with a supervisory authority (the Swedish Authority for Privacy Protection — IMY).

12. How to exercise rights

To exercise your rights, please email us at privacy@fnockidocki.com. Identity verification will be required. We will respond to all requests within 30 days.

13. Automated decision-making

We use basic content personalization based on child profiles (such as age and interests) to improve the user experience. We do not engage in fully automated decision-making that has legal effects on you.

14. Changes to policy

We will notify you of material changes to this policy via email and a website banner. Material changes will require fresh consent where applicable under the law.

15. Contact

For any privacy-related inquiries, please contact privacy@fnockidocki.com, Fnocki & Docki, Sweden.