Privacy Policy

Lumiverzum is built for children — which is why we treat data protection not as a formality but as a foundation of the product. Below we explain, plainly and without fine print, which data we process, why, and what your rights are.

The Croatian version of this document is the legally binding one. This translation exists so you can understand what we do, not so it can be interpreted against the original.

1. Who is responsible for your data

The controller of personal data is Marin Vinković, postal address available on request by e-mail. For any privacy question, write to privatnost@lumiverzum.com.

2. Who this policy applies to

To parents or guardians who open an account and to children who use Lumiverzum through a profile created by a parent. Only an adult may open an account; a child profile exists solely with the consent of the holder of parental responsibility (Article 8 of the General Data Protection Regulation).

3. Which data we process

About the parent: the name entered when creating the account, e-mail address, password (stored exclusively in a cryptographically protected form), the time consent was given for the child profile and the version of the terms consented to, and data necessary to communicate with you.

About the child: the first name or nickname chosen by the parent (a nickname is entirely sufficient), a login PIN (stored in a protected form), the school grade, learning data — completed lessons, answers to knowledge checks, points earned, level and learning streak — and the messages the child writes to Lumi together with Lumi's replies (see point 5). We do not ask a child for an e-mail address, phone number, photograph, date of birth, home address or school name.

Technical data: strictly necessary cookies for login (session) and theme choice, plus internal usage statistics that contain no personal data — events such as "lesson completed" are recorded without any content that would reveal identity. During login and form submissions we briefly process the IP address in order to limit the number of attempts; those records are deleted no later than 24 hours after the last attempt.

4. Why and on which legal basis

We do not use the data for advertising, do not profile children for marketing purposes and do not sell it — to anyone, ever.

5. Artificial intelligence: Lumi as a conversation partner

Lumi is not merely a character guiding a lesson — he responds to what the child writes. This is the most sensitive processing in the whole service, so we describe it in full.

5.1. Where the child talks to Lumi

In three places, and nowhere else:

1. Help inside a lesson — the child asks for an explanation of a wrong answer, or writes a question about the step they are stuck on.
2. School Lumi — a conversation on the child's home screen, about learning material and study order.
3. Reading guide — a conversation about the book the child is reading.

5.2. What is sent to the service provider

What is sent is the text the child wrote or the option they selected, the content of the lesson or card in question, and the child's school grade (an explanation for a fifth-grader is written differently than one for an eighth-grader).

What is not sent: the child's name or nickname, e-mail address, or any identifier. The internal reference for a child in our database is a random, meaningless string (a pseudonym) and it never leaves our server. Before sending, the text passes through automatic cleaning that removes anything resembling a phone number or e-mail address, in case the child types one.

5.3. Who the provider is and where the data sits

The provider is Google Cloud, Vertex AI, in European regions (eu and, as a fallback, europe-west1). Google Cloud acts as a processor under a data processing agreement and may use the data only to provide the service, on our instructions.

Google Cloud's terms contain two commitments we rely on explicitly here:

• Training Restriction (Service Specific Terms): Google will not use Customer Data to train or fine-tune machine learning models without the customer's prior permission or instruction. We have not given such permission and will not give it.
• Data Location: for services covered by that commitment, Google stores customer data at rest only within the selected region or multi-region — for us, the European Union.

How long Google keeps messages. Google does not store prompts and responses permanently. It may hold them temporarily in two ways: in a cache, for at most 24 hours, in the data centre that served the request — we have disabled that cache for our project; and in abuse-detection logs, for a limited period set by Google's terms — we have requested an exemption from that logging, because children's messages already pass our own safety check (section 5.5) and do not need a second one.

5.4. What we store on our side

• The full conversation — the child's message and Lumi's reply, exactly as the child saw them — is kept for 90 days, then deleted.
• The position in the book in the reading guide (how far the child has got) is kept for 90 days from the last change.
• Each exchange also carries a safety-classification label — which group the message was sorted into (see 5.5). It is a label, not a judgement of the child.

The parent sees every conversation their child has, in full, in the parent area, along with a weekly summary. If a sensitive topic appears, or a pattern recurs that deserves an adult's attention, it is highlighted for the parent.

5.5. Conversation safety

Every message from the child passes through automatic classification before a reply is produced. For sensitive topics (violence, health, family, sadness and similar) Lumi does not give advice but points the child to a trusted adult. For inappropriate content the conversation is temporarily paused. There is also a daily message limit per child, as a guard against spending too long in conversation and against abuse.

5.6. Transparency and control

Before the first conversation the child is told that they are talking to a computer program, not a person, and that their parents can see the conversations (the notice under Article 50 of the European Union Artificial Intelligence Act).

A parent can switch off conversation with Lumi for each child separately — see point 13.

5.7. What there is none of

No profiling of the child, no advertising, no automated decision-making producing legal effects concerning the child or similarly significantly affecting them. Lumi's answer does not grade the child, does not affect school marks and does not change their progress.

6. Who else may come into contact with the data

Trusted processors without which the service cannot run:

• the server infrastructure provider (hosting of the database and application),
• the transactional e-mail provider (e.g. the password reset message),
• Google Cloud (Vertex AI) — the artificial intelligence service from point 5.

We have data processing agreements with all of them. Where data is transferred outside the European Economic Area, the transfer is protected by standard contractual clauses or another appropriate mechanism.

For the visit analytics in point 10 there is no processor — the tool runs on our own server and the data never leaves it.

7. How long we keep the data

When a parent deletes a child profile or the whole account, all of that child's data is deleted immediately — conversations, statistics, progress and sessions — without waiting for the periods above. Daily backups (including an off-site copy) are kept for at most 8 days; on profile deletion the data disappears from the live database immediately and from the backups as that rotation expires.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent at any time (withdrawal does not affect the lawfulness of earlier processing). Deletion of all of a child's data is available directly in the parent area, in a single request — no letters to write. You can switch off conversation with Lumi without deleting anything (point 13). For anything else write to privatnost@lumiverzum.com; we reply without undue delay and within 30 days at the latest.

If you believe the processing does not comply with the law, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, Zagreb — azop.hr.

9. Cookies

We use strictly necessary cookies only: the login session and remembering the chosen theme. There are no third-party cookies, no advertising networks and no profiling — and therefore no cookie banner to bother you.

We measure visit counts with a tool that sets no cookies and writes nothing at all into your browser; how it works and what it records is described in the next point.

10. Visit analytics

So that we know which pages are actually useful to people, we measure visits with Umami, which we self-host on our own server (stat.lumiverzum.com), inside the European Union. The data stays on the same infrastructure as the rest of the service and is not sent to any third party — there is no Google Analytics or similar service.

What is recorded: the page visited, the page you came from (referrer), a rough device type, browser and language, and the country of the visit.

Addresses are stripped of identifiers before recording. Where an address contains a child reference (e.g. the conversations or summary page), that reference is replaced before sending, so the statistics show only /parent/razgovori/:id — a single aggregate page, not a list of individual children. If that stripping fails for any reason, the visit is not recorded at all.

What is NOT recorded: we set no cookies, write nothing to localStorage or anywhere else in your browser, and create no persistent identifier by which you could be recognised over time. Your IP address is processed only in passing — a daily irreversible digest (hash) is computed from it and the country is determined, after which the address itself is not stored. Because the digest is daily, visits cannot be linked across a day boundary, nor to your account.

⚠️ The children's part of the application is NOT measured by this. The analytics script does not exist on the learning pages, on the child login or in the administration — it is technically restricted to the public pages and the parent area. We track a child's progress solely within our own database, on the basis of your consent, as described in points 3 and 4.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in understanding whether the pages are being used — the processing is cookie-free, profiling-free and without a persistent identifier, so the intrusion into privacy is the smallest possible. You may object to this processing at any time at privatnost@lumiverzum.com.

11. Security

Data travels encrypted (TLS), passwords and PINs are stored exclusively in a cryptographically protected form, access to data is restricted, and on deletion we pseudonymise and anonymise the related statistics.

12. Changes to this policy

We will notify parents of any material change by e-mail or a clear in-app notice before it takes effect. The date of the effective version is always given at the top.

Where a change alters the way we process a child's data — and introducing conversation with Lumi is exactly that — we ask for fresh consent. Until it is given the child does not continue learning, and that is not a punishment but the only honest consequence: without consent there is no basis for processing. A parent settles it with a single checkbox the next time they open the parent area, and progress, points and conversations remain untouched throughout.

13. Switching off conversation with Lumi

In the parent area, next to each child's profile, there is a "Lumi conversation" switch. When you turn it off:

• the child no longer sees any way to start a conversation — neither "I don't understand" in a lesson, nor School Lumi, nor the reading guide;
• no message from the child is sent to the provider from point 5 any more;
• nothing is deleted — the conversations so far remain available to you, clearly marked with the date from which conversation is switched off;
• the service keeps working: lessons, knowledge checks, points, reading and progress do not depend on any model.

You can turn the switch back on at any time. The change takes effect immediately — the child does not have to log in again.