Privacy Policy

Last updated: [DATE] Kyklaki is operated by [LEGAL ENTITY NAME], registration number [COMPANY REGISTRATION NUMBER], VAT [VAT NUMBER], registered at [REGISTERED ADDRESS], [Cyprus / Greece]. You can reach us at support@kyklaki.com. We are the controller of your personal data. For privacy questions, write to privacy@kyklaki.com. 1. WHAT WE COLLECT, AND WHY Account: your name, email address, city, and (if you enable it) your phone number. We need this to give you an account, to verify you are a real person, and to let another parent know who is bringing them an item. Legal basis: performance of our contract with you. Listings: the photos, video, description, category, condition and price of what you list. Legal basis: contract. Safety and moderation: the automated moderation results for your media and text, reports made about you or by you, strikes, and suspensions. Legal basis: legal obligation (Digital Services Act, product safety) and our legitimate interest in keeping children safe on the platform. Swaps and points: your wallet balance, the full points ledger, escrow, disputes and ratings. Legal basis: contract, and legal obligation for accounting records. Payments: if you buy points, Stripe handles the card. We never see or store your card details. We keep the payment record (amount, date, Stripe reference). Legal basis: contract and legal obligation (tax). Delivery: if you use a parcel locker, your name and contact details go to the carrier so they can deliver to you. Legal basis: contract. Device and usage: IP address, browser, and which listings you viewed or saved. We use this to make the service work, to rate-limit abuse, and to keep the counters honest. Legal basis: legitimate interest in security and in a working product. Advertising: only if you consent. Legal basis: consent, which you may withdraw at any time. 2. WHAT WE DO NOT DO We do not sell your personal data. We do not use your children's photos to train anyone's AI model. We do not run advertising, analytics or any third-party tracker before you have said yes. 3. WHO SEES IT Only processors who need to, each under a data processing agreement: Supabase (database, authentication and file storage, in the EU), Stripe (payments), OpenAI (automated moderation of listing text and images, and the price suggestion), Cloudflare (video, and bot protection), BoxNow (delivery, only when you ship), our email provider, and Sentry (error monitoring). Other members see only what you would expect: your first name, city, rating, and what you listed. 4. WHERE IT LIVES Your data is stored in the European Union (Frankfurt). Some processors may process data outside the EU under the European Commission's standard contractual clauses. [LAWYER: confirm the transfer position for OpenAI and Sentry, and whether a transfer impact assessment is needed.] 5. HOW LONG WE KEEP IT Your account data, for as long as you have an account. Financial records — the points ledger, payments, disputes — for as long as tax and accounting law requires, even after you delete your account, in a form that no longer identifies you. Moderation records, for as long as we need them to keep the platform safe. Everything else goes when you go. 6. YOUR RIGHTS You can, at any time and from your own account page: • Download everything we hold about you, in one file (right of access and portability). • Delete your account (right to erasure). Your personal details are erased and your photos are deleted. The financial history of past swaps stays, because the law requires it, but it is stripped of anything that identifies you. We cannot delete your account while a swap is open or your points are in escrow — someone else is on the other side of that transaction. You also have the right to correct your data, to object to processing based on legitimate interest, to restrict processing, and to withdraw consent for advertising at any time without it affecting anything else. If you think we have handled your data badly, please tell us first — but you have the right to complain to a supervisory authority: the Office of the Commissioner for Personal Data Protection in Cyprus, or the Hellenic Data Protection Authority in Greece, or the authority where you live. 7. CHILDREN Kyklaki is for adults. You must be 18 or over to have an account. We do not knowingly collect data about children, and we ask you not to include children's faces in listing photos. 8. COOKIES We use only what is strictly necessary to log you in and keep you secure — these need no consent. Anything else, including advertising, loads only after you have said yes in the banner, and you can say no with a single click and lose nothing.