Privacy Policy

Last updated: 21 July 2026

1. Data Controller

The controller responsible for processing personal data in connection with SHAFA Kids (“Stories & Coloring”) is:

Oleksandr Bilonozhko
Marienwerderstr.11 ,30823 Garbsen, Germany

Email: info@webbrandstudio.com

Website and app: shafa-app.com

In this Privacy Policy, “we”, “us”, “operator” and “SHAFA Kids” refer to the controller identified above.

2. Purpose of the Service

SHAFA Kids is a digital service for parents, legal guardians and families. It provides:

• children’s stories;

• coloring pages;

• story personalization;

• audio features;

• family voice recordings;

• offline access;

• materials for home printing;

• free and Premium mobile app features.

The service is intended for adults. Children may use the app only under the supervision of a parent or another legal guardian.

We do not create separate user accounts for children.

The service contains no third-party advertising. We do not use advertising identifiers to track children and do not create advertising profiles of users.

3. Data We Process

Depending on the features used, we may process the following categories of data.

3.1. Contact Data

• name;

• email address;

• message content;

• customer support requests;

• feedback and messages submitted through contact forms.

3.2. Technical Data

• IP address;

• browser type;

• operating system;

• device type and model;

• device language;

• date and time of requests;

• the requested address or resource;

• app version information;

• server log data;

• information relating to errors, security and service stability;

• technical signals used to protect against automated requests, attacks and misuse.

Where Cloudflare is used to deliver content, protect the service or improve performance, user requests may pass through Cloudflare’s infrastructure. In that case, Cloudflare may process technical connection data required to provide CDN, DNS, caching, traffic filtering and security services.

3.3. Technical Installation Identifier

The app may create a technical installation identifier or app-user identifier.

It may be used to:

• maintain Premium status;

• restore access to purchased features;

• operate family voice features;

• protect the service against misuse;

• provide technical support and diagnostics.

This identifier is not used for advertising and is not an advertising identifier.

3.4. Settings and Usage Data

We may process:

• the selected language;

• selected stories and series;

• reading progress;

• app settings;

• saved offline materials;

• selected characters and avatars;

• technical information about available features.

3.5. Personalization Data

A parent or legal guardian may voluntarily provide:

• a child’s short first name or nickname;

• a selected avatar;

• character gender, where that setting is available;

• an approximate age range;

• other settings necessary to personalize a story.

Please do not provide a child’s surname, address, full date of birth, health information, identity documents, school details or other sensitive information.

3.6. Voice Recordings

When a user activates the voice recording feature, we may process:

• the audio recording;

• technical recording data;

• an invitation identifier;

• the creation date and expiration date of a link;

• recording, delivery and receipt status.

A recording is created only after an active action by the user and after microphone access has been granted to the app.

3.7. Subscriptions and Purchases

When Premium is purchased through the Apple App Store or Google Play, we may receive:

• subscription status;

• purchased product type;

• purchase or renewal date;

• Premium entitlement period;

• cancellation, refund or purchase restoration information;

• purchase history required to manage access;

• a technical app-user identifier.

We do not receive full payment card details, a CVC code or the user’s bank account details.

3.8. Aggregated Service Statistics

We may collect limited statistics concerning operation of the service, such as:

• a page visit;

• a click on a functional button;

• an app launch;

• use of a particular feature.

Such statistics are used to evaluate service stability, understand which features are used and improve the service.

We do not use this data for third-party advertising, cross-service tracking or advertising profiling.

4. Purposes and Legal Bases

Processing is carried out in accordance with the European Union General Data Protection Regulation, or GDPR/DSGVO.

4.1. Performance of a Contract — Article 6(1)(b) GDPR

Processing may be necessary to:

• provide the app;

• save settings;

• personalize stories;

• provide Premium access;

• operate voice features;

• respond to user requests.

4.2. Consent — Article 6(1)(a) GDPR

Consent may be used when a user voluntarily:

• grants microphone access;

• creates a voice recording;

• activates an optional feature;

• accepts optional analytics or marketing technologies, if such technologies are introduced.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.3. Legitimate Interests — Article 6(1)(f) GDPR

Our legitimate interests include:

• maintaining service security;

• preventing misuse;

• diagnosing errors;

• protecting infrastructure;

• improving stability and performance;

• establishing, exercising or defending legal claims.

4.4. Legal Obligations — Article 6(1)(c) GDPR

Certain data may be processed or retained where required by tax, accounting, consumer protection or other applicable laws.

5. Children’s Data

SHAFA Kids is intended to be used by adults on behalf of their families.

We do not:

• create separate accounts for children;

• ask children to register independently;

• display third-party advertising;

• use a child’s data for advertising;

• sell personal data;

• use facial recognition;

• create behavioral profiles of children;

• make automated decisions producing legal or similarly significant effects.

A child’s first name or nickname is entered voluntarily by an adult and is used only to personalize content.

The parent or legal guardian is responsible for deciding what information is entered into the app and for supervising the child’s use of the service.

6. Story Personalization

Personalization is intended solely for family reading.

The provided first name or nickname may be inserted automatically into a story. It is not used for advertising, locating a child through other services or creating an external profile.

Users may remove or change personalization data within the app where the relevant function is available, or contact us by email.

7. Voice Recordings and Family Links

The voice feature is intended for adult family members and people invited by them.

A user should record only:

• their own voice; or

• another person’s voice with that person’s permission.

A family link is intended only for the invited recipient and should not be published publicly or shared with an unrestricted audience.

Recording links and temporary voice files are retained for no longer than 7 days, unless deleted earlier.

Voice recordings are:

• not sold;

• not used for advertising;

• not used to train publicly available artificial intelligence models;

• not published publicly;

• shared only with providers technically necessary to operate the feature.

A user may request early deletion by contacting [info@webbrandstudio.com](mailto:info@webbrandstudio.com).

8. Payments and Subscriptions

No payments are processed on the website or in the PWA.

Paid features are purchased exclusively through:

• the Apple App Store;

• Google Play.

Subscription management and verification of Premium status may be provided through RevenueCat.

Apple, Google and RevenueCat may process purchase information in accordance with their own privacy policies.

We may receive only the data required to:

• verify a purchase;

• provide Premium;

• process a renewal;

• cancel or restore access;

• resolve technical purchase issues.

9. Service Providers and Data Recipients

The service may use the following providers:

• Hostinger for hosting and server infrastructure;

• ALL-INKL for domain and DNS management;

• Supabase for databases, file storage, authentication and other backend infrastructure;

• Cloudflare for DNS, CDN, caching, delivery of images and other media, performance optimization, protection against DDoS attacks, automated requests and other malicious traffic;

• RevenueCat for subscription management and Premium status;

• the Apple App Store and Google Play for purchases, subscriptions and payment processing;

• email providers for handling messages;

• Telegram for internal notifications to the operator where that feature is enabled.

Contact-form messages may be forwarded to the operator by email or through internal Telegram notifications.

We do not intend to include voice files or unnecessary child information in such notifications.

Providers process data only to the extent required to provide the relevant service.

We do not sell users’ personal data.

10. International Data Transfers

Some providers may process data outside the European Union or European Economic Area.

Where applicable, such transfers are based on safeguards recognized under the GDPR, which may include:

• a European Commission adequacy decision;

• European Commission Standard Contractual Clauses;

• other applicable transfer mechanisms;

• supplementary technical and organizational safeguards.

11. Local Storage and Cookies

The app and PWA may use:

• LocalStorage;

• IndexedDB;

• Cache Storage;

• secure mobile-device storage;

• technically necessary cookies.

These technologies may be used for:

• saving settings;

• offline access;

• security;

• authentication;

• stable operation;

• storage of downloaded materials;

• preservation of the app state.

Technically necessary technologies may be used without separate consent where permitted by law.

Optional analytics or marketing tools will be activated only after the required consent has been obtained, if such tools are introduced.

12. Retention Periods

We retain personal data only for as long as necessary for the relevant purpose.

In particular:

• family voice links and temporary voice recordings are retained for no longer than 7 days;

• personalization data is retained until deletion by the user or until it is no longer required;

• a technical installation identifier is retained while necessary to operate Premium and family features;

• support correspondence is retained until the request is resolved and for a reasonable period required to protect legal claims;

• technical logs and security data are retained for a limited period required to protect the service and analyze errors;

• subscription and payment-related data is retained for as long as necessary to provide Premium and comply with legal obligations;

• cached copies of images and media may be retained for a technically necessary period before being automatically refreshed or removed.

After the relevant period expires, data is deleted or anonymized unless continued retention is required by law.

13. Whether Data Is Required

Providing personalization and voice data is voluntary.

Without certain technical data, the app may not function or particular features may be unavailable.

Without purchase information, we may be unable to verify or restore Premium access.

14. User Rights

Where provided by law, users have the right to:

• access their personal data;

• correct inaccurate data;

• request erasure;

• restrict processing;

• receive data in a portable format;

• object to processing;

• withdraw consent;

• lodge a complaint with a supervisory authority.

Requests may be sent to info@webbrandstudio.com

Before fulfilling a request, we may ask for reasonable information to verify the requester’s identity and protect data against unauthorized access.

A user may lodge a complaint with a data protection authority in the country of their residence, workplace or the alleged infringement.

15. Automated Decision-Making

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects for users.

16. Security

We use reasonable technical and organizational safeguards, including:

• secure transmission;

• separation of administrative roles;

• access restrictions;

• system logging;

• temporary links;

• voice-file retention controls;

• caching and network traffic protection;

• protection against DDoS attacks and automated misuse;

• software updates;

• backups and monitoring where applicable.

No method of data transmission or storage can guarantee absolute security.

17. Changes to This Privacy Policy

We may update this Privacy Policy when there are changes to:

• app functions;

• service providers;

• data processing activities;

• applicable law;

• App Store or Google Play requirements.

The current version will be published in the app or on the website.

Users will be additionally informed of material changes where required by law.