Children's Privacy Notice

• A child cannot sign up. Only a parent or guardian can create a child's profile.
• A child has no email address in BrightPoints. They sign in with a username and PIN that you create.
• We collect the minimum. No photos, no location, no phone number, no contacts, and no date of birth.
• No advertising. Ever. No ads are shown to children and no advertising profile is built.
• Only the family can see it. A child's data is visible to the adults in that child's family, and to nobody else.
• You are in control and can review, correct, or delete everything at any time.

Published by SIA Sneeds, registration number 40203301249, Klusā iela 18–55, Rīga, LV-1013, Latvia.

A parent registers their own account, confirms they are 18 or over, creates a family, and then adds a child. During that step the parent chooses:

• the child's first name or nickname
• an avatar emoji
• an age band
• a username and PIN for the child to sign in with

• Email address or phone number
• Date of birth — only a broad age band, chosen by you
• Photographs, video, or voice recordings
• Location or GPS data
• Contacts, calendar, or files
• Biometric information
• Advertising identifiers, or persistent identifiers used for advertising
• Free-text messages to anyone outside the family — BrightPoints has no chat, no comments, no social feed, and no way for a child to communicate with strangers

Only to run the service for that child's family: showing their behaviours and rewards, recording points, letting a parent approve requests, and displaying the child's own progress.

We do not use it for advertising, marketing, profiling, or automated decision-making, and we do not sell or share it. We do not send marketing messages to children, and we could not if we wanted to: we hold no email address and no phone number for a child. The only notifications BrightPoints sends are approval alerts to a parent who has asked for them.

• The adults who are members of that child's family
• The child themselves, when signed in to their own profile
• Our service providers (hosting, database, authentication), strictly as needed to run the service and under contract
• Any other application you have deliberately connected to your own account — see below

That is the complete list. Other families cannot see your family's data, and this is enforced at the database level rather than merely in the interface.

Applications you connect yourself

BrightPoints lets a parent connect other software to their own account — an AI assistant, for example — so they can check on the family or approve requests without opening the app. This is off unless you set it up, and you are shown a consent screen naming the application before anything is granted.

A connected application can see your children's first names, avatars, points and pending requests, and can approve things on your behalf. It can never see a PIN. If you connect one, that application's own privacy policy governs what it does with what it receives. The full detail is in the Privacy Policy.

As a parent or guardian, you may at any time:

• Review everything we hold about your child — most of it is directly visible in the app
• Correct it — names, emoji, age band, username, and PIN are all editable
• Delete it — removing a child's profile deletes their profile and their sign-in credentials
• Refuse further collection — delete the child's profile or your family, and collection stops
• Request a copy in a portable format
• Withdraw consent for us to hold your child's information

Deleting a child, and editing everything about them, can be done in the app directly. For a portable copy of your child's data, to close your account entirely, or for a written response on anything above, email us at hello@brightpoints.app. We action deletion requests within 30 days and confirm when it is done, and we respond to everything within one month as the GDPR requires.

You do not need to justify any of these requests, and exercising them will never disadvantage you or your child.

For as long as the child's profile exists in your family. When you delete a child, their profile, sign-in credentials, and associated records are removed from our live systems immediately. Residual copies in our providers' backups are overwritten in the normal backup cycle and in any case within 90 days.

We also do not hold a child's information indefinitely for a family that has stopped using BrightPoints. If nobody in a family signs in for 24 months, we email the parent account, and if there is still no sign-in after 30 days we delete the family and its children's profiles.

Under the GDPR, children below the digital age of consent cannot consent to online services themselves — consent must be given or authorised by the holder of parental responsibility. That age is 13 in Latvia, and between 13 and 16 across other EU member states.

Where BrightPoints is used by children under 13 in the United States, we act consistently with the Children's Online Privacy Protection Act:

• We collect only information reasonably necessary for a child to take part in the service.
• We obtain parental consent before any collection — the parent creates the profile themselves, from their own account.
• We do not condition a child's participation on disclosing more information than is necessary.
• We do not disclose children's personal information to third parties for those parties' own purposes.
• We give parents the ability to review, delete, and refuse further collection, as set out above.

If we change how we handle children's information in any material way, we will notify parents and, where the law requires it, obtain fresh consent before the change takes effect.

Questions about your child's information:

You may also complain to the Latvian supervisory authority, Datu valsts inspekcija, Elijas iela 17, Rīga, LV-1050, Latvia — www.dvi.gov.lv, or to your local supervisory authority if you live elsewhere in the EU.