This Privacy Policy explains how KUKIRRI ("KUKIRRI", "we", "us" or "our") processes personal data in connection with the use of its parental control applications and services (the "Services"). KUKIRRI is committed to protecting the confidentiality, integrity and security of the personal data entrusted to us and to complying with applicable data protection laws, including the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), Spain's Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), and any other applicable local regulations.
1. DATA CONTROLLER
Adsmarket Service SL
Tax ID: ESB56343429
Registered address: Ronda General Mitre 126, 6th floor, 08021 Barcelona, Spain
Contact email: privacidad@kukirri.com
Data Protection Officer (DPO): can be contacted at the same email address.
With regard to data collected from monitored devices (minors), KUKIRRI acts as a data processor, while the parent or legal guardian who contracts and uses the Services acts as the data controller, as they determine the purposes and means of that processing.
2. CATEGORIES OF DATA PROCESSED
2.1. Account and billing data (KUKIRRI as data controller)
- Identification data: first name, last name and email address.
- Login credentials: encrypted password.
- Billing data: where the user subscribes to a paid plan (BASIC or PREMIUM), information required to manage payments.
- Support contact data: emails and communications sent through the application.
- Basic technical data: IP address, browser type, operating system and technical logs used for security and diagnostics.
2.2. Data from monitored devices (parents as data controllers)
Depending on the settings chosen by the parent or legal guardian, the application may collect:
- Technical device identifiers, including model, operating system, version and advertising or device identifiers.
- App usage information, including which apps are used, usage time, access frequency and information about actions performed within the app.
- Internet browsing information, including visited URLs, search history and search queries, where this feature is enabled.
- Approximate or precise device location when enabled by the parent or guardian. A location history entry is stored whenever the parent or guardian requests the device's location.
- Digital activity statistics, including screen time and periods when the device is blocked or unblocked, as well as usage patterns.
- The content of notifications received on the child's device.
3. PURPOSES OF PROCESSING
3.1. Account data
- Create and maintain the user account.
- Provide the parental control Services in accordance with the agreed terms.
- Manage payments, subscriptions and billing.
- Handle support requests and communications.
- Send service-related notifications, including technical notices, updates and security alerts.
3.2. Monitored device data
- Enable parents and guardians to use parental control features.
- Provide usage reports and statistics.
- Block or restrict apps and content according to the settings chosen by the parent or guardian.
- Locate the device when the feature is enabled and display a history of requested locations.
- Collect notification and activity data so it can be viewed by the parent in the app.
KUKIRRI will not use data from monitored devices for purposes unrelated to providing the Service, nor disclose it to third parties except where legally required or expressly instructed by the parent or guardian.
4. LEGAL BASIS FOR PROCESSING
KUKIRRI processes personal data on the legal bases provided for in Article 6 of Regulation (EU) 2016/679 (GDPR), and other applicable data protection laws, depending on the specific purpose of each processing activity.
4.1. Account data and service provision
For data relating to the parent, guardian or legal representative who contracts or uses the Services, the main legal bases are:
Performance of a contract: to create and manage the account, provide the contracted features, manage linked devices, maintain communications required to provide the Service, manage subscriptions and payments, and provide user support.
Compliance with legal obligations: where processing is necessary to comply with tax, accounting, commercial, administrative or other applicable legal obligations.
Legitimate interests: to prevent fraudulent or abusive use, protect accounts and systems, detect and prevent security incidents, maintain the technical integrity and stability of the Services, investigate unlawful or abusive behavior, and establish, exercise or defend KUKIRRI's legal claims and rights, provided that these interests do not override the rights and freedoms of the individuals concerned.
Consent: for processing activities that require consent under applicable law and cannot validly rely on another legal basis, including the use of certain analytics or advertising technologies and, where applicable, marketing communications.
4.2. Analytics and service usage measurement
KUKIRRI may use analytics services, including Firebase Analytics and related Google technologies, to obtain statistical information about how the applications are used and perform, measure events and features, identify issues, assess performance and improve the Services.
Where consent is required for analytics processing, it will be requested beforehand through a dedicated consent mechanism. Consent for analytics is separate from consent for advertising and is not a condition for using the essential features of the Service.
Users may accept or reject analytics processing and later withdraw their consent using the mechanisms provided by KUKIRRI. Where consent is required, KUKIRRI will not activate analytics features that depend on consent until it has been obtained.
4.3. Advertising and ad personalization
KUKIRRI may use Google AdMob and other advertising providers to display ads in certain features or versions of the Services.
Where required, the use of identifiers, information stored on or accessible from the device and other data for ad selection, measurement or personalization will be subject to the user's consent obtained through the applicable consent management mechanism.
Consent to personalized advertising is not a condition for using the essential features of the Service. Where the required consent for personalized advertising has not been provided, non-personalized ads may be shown or certain advertising features may be limited, in accordance with the configuration and applicable policies of the relevant providers.
Where third-party advertising providers are involved, they may process certain data in accordance with their own privacy policies and the consent obtained through the applicable consent management mechanism.
4.4. Data from monitored devices
Data collected from monitored devices is primarily processed to provide the parental control features requested and configured by the responsible parent or guardian.
Where the parent or guardian determines the purposes and means of processing a child's data within the parental control features, KUKIRRI acts as a data processor under the applicable data processing agreement, in accordance with Article 28 of the GDPR.
Where, due to the specific nature of the processing, KUKIRRI independently determines additional purposes and means, the processing will be carried out under the responsibility applicable to KUKIRRI and on the appropriate legal basis.
Parents and guardians must use monitoring features in accordance with applicable law and respect the rights and interests of the child, including their privacy and personal data protection.
4.5. Consent
Where KUKIRRI requests consent, it will be requested for one or more specific purposes through a clear affirmative action and in a manner that is freely given, informed, specific and unambiguous.
Consent for one purpose does not automatically constitute consent for other independent purposes. In particular, consent for analytics is separate from the consent required for personalized advertising.
Users may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and must be as easy as giving consent.
Where necessary, KUKIRRI will retain evidence of consent decisions so that it can demonstrate their existence and scope.
5. DATA RETENTION
KUKIRRI retains personal data for as long as necessary to fulfil the purposes for which it was collected and, afterwards, for the periods required to address potential legal liabilities and comply with applicable legal obligations.
5.1. Account and billing data
Data required to maintain the account will be retained while the contractual relationship with the user remains active.
After the contractual relationship ends, certain data may be retained for periods required by law or necessary to establish, exercise or defend legal claims.
Billing, payment and tax or accounting data will be retained for the periods required by applicable law.
Once these periods have expired, the data will be deleted or, where appropriate, properly anonymized.
5.2. Data from monitored devices
The retention period for data generated by monitored devices depends on the feature used and the retention period associated with the user's plan.
- Free account: up to 1 day.
- Basic account: up to 7 days.
- Premium account: up to 30 days.
These periods apply to historical data stored by KUKIRRI for device features and may differ where a specific feature has its own retention period.
Location history is retained for the period applicable to the user's plan, unless the data controller requests earlier deletion, where technically possible and where no legal obligation prevents it.
Once the retention period has expired, data will be deleted or anonymized using appropriate procedures.
Deleting an account or device may result in the deletion of associated data, without prejudice to data that must be retained for an additional period to comply with legal obligations or address potential liabilities.
6. DATA RECIPIENTS
To provide the Services, KUKIRRI uses certain technology providers that may process personal data on KUKIRRI's behalf or, where applicable, act as independent controllers for specific processing activities.
6.1. Piensa Solutions
KUKIRRI uses hosting and infrastructure services provided by Piensa Solutions, where KUKIRRI's servers and the PostgreSQL database used to provide the Services are hosted.
This infrastructure may store and process user account data, linked device information, activity data, location information, technical logs and other information required to provide the Services.
The infrastructure used by KUKIRRI is located in Spain.
6.2. Firebase and Google services
KUKIRRI uses certain services provided by Google Firebase to support the operation, maintenance, analysis and technical improvement of its applications.
Firebase services may collect certain technical data required for their operation, such as technical identifiers, device information, app version, performance information, errors and data related to push communications.
- Firebase Cloud Messaging (FCM): for sending push notifications and data messages required for communication between KUKIRRI applications and services.
- Firebase Analytics: to obtain statistical information about how the applications are used and perform. In the parent app, an internal user identifier (user_id) may be used to associate certain usage events with an account.
- Firebase Performance: to measure the performance of certain application operations and communications with KUKIRRI servers.
- Firebase Crashlytics: to record and analyze certain technical application errors in order to identify and resolve issues.
- Firebase Remote Config: to manage technical and application configuration parameters without requiring a new app release.
The child app does not use a Firebase Analytics user_id to directly identify the user.
6.3. Google Maps
The parent app uses Google Maps to display location coordinates received from KUKIRRI servers on a map.
In the child app, location coordinates are converted into a readable address using the geocoding service provided by the Android operating system. The resulting address is then sent to KUKIRRI servers.
6.4. Google Analytics
KUKIRRI uses Google Analytics 4 on its web services to obtain statistics about website usage and performance and to improve the user experience.
Processing through Google Analytics is subject to Google's applicable privacy terms and policies.
6.5. Google Ads
KUKIRRI uses Google Ads for advertising and user acquisition campaigns and, where applicable, to measure campaign performance.
Processing through these services is subject to Google's applicable privacy terms and policies and to the user's consent settings where consent is required.
6.6. Google AdMob
The parent app uses Google AdMob to display advertising to users on the Free plan. Basic and Premium users do not receive ads.
Ads may be personalized where the user has provided the consent required for personalization. Where such consent has not been provided, non-personalized advertising mechanisms will be used where applicable.
The child app does not use AdMob or display advertising.
6.7. Redsys
KUKIRRI uses Redsys to process payments and subscriptions.
KUKIRRI does not store the full bank card number or security code (CVV). To manage recurring payments, KUKIRRI may retain a card identifier or token provided by Redsys, together with the transaction identifier and information required to manage the subscription status.
6.8. Email service
KUKIRRI uses the email service hosted on its own server to send communications related to accounts, authentication, access recovery, subscriptions and other communications required to provide the Services.
6.9. Technical and security logs
KUKIRRI generates technical and security logs required to operate, protect and diagnose its systems and Services.
Depending on the operation being logged, these records may contain information such as IP addresses, device identifiers, user identifiers, email addresses, API errors, information about installed apps, authentication tokens and location data.
These logs are used exclusively for technical, security, diagnostic, maintenance and incident management purposes, as well as to establish or defend legal rights where necessary.
6.10. Authorities and legal obligations
Personal data may be disclosed to administrative authorities, public bodies, courts or law enforcement agencies where required by law, pursuant to a court order or in response to a valid request under applicable legislation.
KUKIRRI does not sell users' personal data or commercialize personal data collected from children's devices.
7. INTERNATIONAL DATA TRANSFERS
KUKIRRI maintains its main hosting infrastructure and database in Spain through Piensa Solutions. However, some technology providers used to deliver specific features may process personal data outside the European Economic Area (EEA).
In particular, certain Google and Firebase services used by KUKIRRI may involve the processing of personal data in countries outside the EEA.
Where an international data transfer is necessary, KUKIRRI will seek to ensure that it is carried out in accordance with the requirements of Regulation (EU) 2016/679 (GDPR) and using a legally recognized transfer mechanism.
For certain Google services, international transfers may, where applicable, be covered by adequacy mechanisms recognized by the European Commission or by the relevant contractual and legal safeguards.
KUKIRRI does not directly transfer personal data internationally from its main infrastructure in Spain. Any international transfers arise from the use of specific third-party services required to provide particular application and web service features.
KUKIRRI will select and use providers that offer appropriate safeguards for the processing of personal data in accordance with applicable law.
Users may request additional information about the safeguards applicable to a particular international transfer where they have the right to do so under data protection law.
Depending on the provider, service and destination country, transfers may rely, among other legally applicable mechanisms, on:
- Adequacy decisions adopted by the European Commission where the destination country is recognized as providing an adequate level of protection.
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Other international transfer mechanisms recognized by the GDPR and applicable to the relevant provider and processing activity.
8. DATA SECURITY
KUKIRRI implements appropriate technical and organizational measures, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to individuals' rights and freedoms.
These measures are designed to protect personal data against accidental or unlawful destruction, loss or alteration, as well as unauthorized access, disclosure or processing.
Security measures may include, as appropriate:
KUKIRRI regularly reviews its security measures and may modify or update them when necessary due to technological, operational or security changes.
No system connected to the Internet can guarantee absolute security. Nevertheless, KUKIRRI adopts reasonable and proportionate measures to reduce the risks associated with processing personal data.
If a personal data breach occurs that is likely to pose a risk to individuals' rights and freedoms, KUKIRRI will act in accordance with Articles 33 and 34 of the GDPR and applicable law, including notifying the relevant supervisory authority and affected individuals where required.
- Encryption of communications using secure protocols such as HTTPS/TLS.
- Authentication and authorization systems to control access to the Services.
- Secure management of credentials and access tokens.
- Permission-based access controls and least-privilege principles.
- Protection of systems and servers against unauthorized access.
- Secure storage of certain credentials and secrets on devices.
- Logging and monitoring of relevant technical and security events.
- Backups and mechanisms designed to ensure system availability and recovery.
- Measures to ensure that authorized personnel only access the information required to perform their duties.
9. USER RIGHTS
Users may exercise, where applicable, the rights recognized by data protection law:
- Right of access: to know whether KUKIRRI processes personal data and to obtain access to that data.
- Right to rectification: to request correction of inaccurate or incomplete personal data.
- Right to erasure: to request deletion of personal data where the legal requirements are met.
- Right to restriction of processing: to request that processing be restricted in the circumstances provided by law.
- Right to object: to object to certain processing activities, particularly those based on legitimate interests.
- Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and request its transfer to another controller where the legal requirements are met.
- Right to withdraw consent: to withdraw consent at any time for processing activities based on consent.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Exercising these rights is generally free of charge. KUKIRRI may act in accordance with the GDPR where requests are manifestly unfounded or excessive.
To exercise your rights, you can send a request to:
The request should specify the right you wish to exercise and provide the information needed to identify the requester and process the request correctly.
Where processing is carried out on behalf of a parent, guardian or other data controller, KUKIRRI may assist with exercising rights in accordance with applicable law and the instructions received from the controller.
Individuals also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority, particularly if they believe that the processing of their personal data breaches applicable law.
10. CHILDREN AND MINORS
KUKIRRI Services are designed to allow parents and legal guardians to manage certain monitoring and protection features on devices used by children.
KUKIRRI does not target minors for the purchase of its Services. The main account and purchase of the Services must be carried out by a person with sufficient legal capacity to enter into a contract and, where applicable, by the person exercising parental responsibility, guardianship or legal representation of the child.
The parent or guardian using Kukirri to monitor a child's device is responsible for ensuring that they have the necessary legal authority to carry out the processing and that their use of parental control features complies with applicable law and the child's rights.
In particular, Kukirri's monitoring features should be used proportionately to the intended protection and supervision purposes, taking into account the child's age, maturity and circumstances.
Minors retain their fundamental rights, including their rights to privacy, reputation, image and protection of their personal data.
KUKIRRI provides technical monitoring tools but does not replace the duties and responsibilities of parents, guardians or legal representatives.
Depending on the settings selected by the data controller, available features may include information about apps, device activity, usage restrictions, location and other parental control functions.
These features must only be used for legitimate purposes of protecting, supervising and supporting the child.
KUKIRRI recommends that parents and guardians configure monitoring features proportionately and appropriately for the child's age and maturity, avoiding unnecessary or excessive monitoring.
Where processing is based on consent and applicable law imposes specific age-related requirements, the rules established under Article 7 of Organic Law 3/2018 and the GDPR will apply. In Spain, processing based solely on a minor's consent is subject to the age-related conditions established by law.
11. CHANGES TO THIS PRIVACY POLICY
KUKIRRI may amend this Privacy Policy when necessary to reflect changes in legislation, case law, regulatory requirements, technology, organization or the Services.
The current version will always be published on this page.
Where changes are significant and materially affect users' rights, safeguards or the conditions of data processing, KUKIRRI will take reasonable steps to inform users before or when the changes take effect.
Where applicable law requires renewed consent, KUKIRRI will obtain it before carrying out the relevant processing.
The date of the latest update will be shown at the beginning of this Privacy Policy.
12. GOVERNING LAW AND JURISDICTION
This Privacy Policy is governed by Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, applicable Spanish and European data protection law, legislation governing information society services and consumer protection, and any other applicable legal provisions.
For relationships with consumers, any dispute will be submitted to the courts and tribunals having jurisdiction under mandatory applicable law. Nothing in this clause limits any rights granted to consumers under applicable legislation.
Where legally permitted to establish a different jurisdiction and both parties may validly agree to it, the courts applicable under Spanish law may have jurisdiction.
Nothing in this Privacy Policy limits any rights granted to users by mandatory data protection, consumer protection or other applicable legislation.
privacidad@kukirri.com
Para cualquier consulta relacionada con esta Política de Privacidad, puedes contactar con KUKIRRI mediante la siguiente dirección:
privacidad@kukirri.com