Privacy Policy

Last updated: 28 July 2026 Kyklaki is a trading name of H & A Charalampous Life Solutions LTD, a company registered in Cyprus under number HE 88281, VAT CY10088281Y, with its registered office at Georgiou Averof & Georgiou Fragkoudi, 2, Agios Ioannis, 3061, Limassol, Cyprus. You can reach us at support@kyklaki.com. We are the controller of your personal data. For privacy questions, write to privacy@kyklaki.com. 1. WHAT WE COLLECT, AND WHY Account: your name, email address, city, and (if you enable it) your phone number. We need this to give you an account, to verify you are a real person, and to let another parent know who is bringing them an item. Legal basis: performance of our contract with you. Listings: the photos, video, description, category, condition and price of what you list. Legal basis: contract. Safety and moderation: the automated moderation results for your media and text, reports made about you or by you, strikes, and suspensions. Legal basis: legal obligation (Digital Services Act, product safety) and our legitimate interest in keeping children safe on the platform. Swaps and points: your wallet balance, the full points ledger, escrow, disputes and ratings. Legal basis: contract, and legal obligation for accounting records. Payments: none. Kyklaki takes no payments at the moment, so there is no card, no payment record, and no payment provider involved in any of this. If that changes, a payment provider will handle the card, we will never see or store your card details, and we will name them here before the first payment is taken. Delivery: most swaps are a handover in person at a public meeting point, and nothing about you goes anywhere. If the two of you instead choose to send the item with a courier you arrange yourselves, each of you gives the other a first name, a phone number and an address to send to. ONLY THE OTHER PARENT IN THAT SWAP SEES IT, ONLY ONCE YOU HAVE BOTH GIVEN YOURS, AND WE DELETE BOTH AS SOON AS THE SWAP ENDS. We do not book the courier, we do not pay them, we are not told what you paid, and we never send your address to a courier ourselves — you do. Legal basis: performance of our contract with you, at your request. Device and usage: IP address, browser, and which listings you viewed or saved. We use this to make the service work, to rate-limit abuse, and to keep the counters honest. Legal basis: legitimate interest in security and in a working product. Advertising: only if you consent. Legal basis: consent, which you may withdraw at any time. 2. WHAT WE DO NOT DO We do not sell your personal data. We do not use your children's photos to train anyone's AI model. We do not run advertising, analytics or any third-party tracker before you have said yes. 3. WHO SEES IT Only processors who need to, each under a data processing agreement: Supabase (database, authentication and file storage, in the EU), OpenAI (automated moderation of listing text and images, and the price suggestion), Cloudflare (video, and bot protection), our email provider, and Sentry (error monitoring). There is no payment provider and no carrier on that list, because we take no payments and post nothing. Other members see only what you would expect: your first name and the initial of your surname, your area, your rating, and what you listed. There is one exception, and it is the one above: in a swap where you have both chosen a courier you arrange yourselves and you have both filled the details in, the other parent in that swap sees the name, phone number and address you typed, until the swap ends. Nobody else does, we never ask you for an address anywhere else, and we do not keep one on your account. 4. WHERE IT LIVES Your data is stored in the European Union (Frankfurt). Some processors may process data outside the EU under the European Commission's standard contractual clauses. 5. HOW LONG WE KEEP IT Your account data, for as long as you have an account. Delivery details you gave another parent for a courier, only until that swap ends — they are deleted then, and there is nowhere else we keep them. Financial records — the points ledger, payments, disputes — for as long as tax and accounting law requires, even after you delete your account, in a form that no longer identifies you. Moderation records, for as long as we need them to keep the platform safe. Everything else goes when you go. 6. YOUR RIGHTS You can, at any time and from your own account page: • Download everything we hold about you, in one file (right of access and portability). • Delete your account (right to erasure). Your personal details are erased and your photos are deleted. The financial history of past swaps stays, because the law requires it, but it is stripped of anything that identifies you. We cannot delete your account while a swap is open or your points are in escrow — someone else is on the other side of that transaction. You also have the right to correct your data, to object to processing based on legitimate interest, to restrict processing, and to withdraw consent for advertising at any time without it affecting anything else. If you think we have handled your data badly, please tell us first — but you have the right to complain to a supervisory authority: the Office of the Commissioner for Personal Data Protection in Cyprus, or the Hellenic Data Protection Authority in Greece, or the authority where you live. 7. CHILDREN Kyklaki is for adults. You must be 18 or over to have an account. We do not knowingly collect data about children, and we ask you not to include children's faces in listing photos. 8. COOKIES We use only what is strictly necessary to log you in and keep you secure — these need no consent. Anything else, including advertising, loads only after you have said yes in the banner, and you can say no with a single click and lose nothing.