Privacy Policy

PRIVACY POLICY

Last updated: 7 dec 2025

1 Who we are

This Privacy Policy explains how Y Company ("we", "us", "our") collects and processes personal data in connection with the use of the [APP NAME] web application ("Service").

Controller:

Y Company

CVR-nummer: 33693060

Adresse: C/O Yassin Khedri

Tjoernehaven 328

5240 Odense NOE

Email: mail@khedri.dk

2 What data we collect

2.1 Account and profile data

When you create an account and use the Service, we may process: your name, email address, family or household name, child profile information (such as first name, avatar, routines and tasks), and your preferences and settings inside the app.

2.2 Usage and technical data

When you access the Service, we may process technical data such as IP address, browser type, device and operating system information, timestamps and basic logs needed to operate, secure, and troubleshoot the Service.

2.3 Support and communication data

If you contact us by email or through other channels, we process the information you provide, such as your name, contact details, and the content of your message.

3 For what purposes and on what legal basis

3.1 To provide and operate the Service

We process your data to create and manage your account, store routines and tasks, display child dashboards and family overviews, and provide core functionality of the app.

Legal basis: GDPR art. 6(1)(b) (performance of a contract).

3.2 To maintain security and stability

We process technical and log data to monitor the Service, prevent misuse, detect and fix errors, and protect our systems.

Legal basis: GDPR art. 6(1)(f) (legitimate interest in operating a secure and reliable service).

3.3 To communicate with you

We process your contact details to respond to support requests, notify you of important changes to the Service or to this Privacy Policy, and manage your requests regarding your data.

Legal basis: GDPR art. 6(1)(b) and 6(1)(f).

3.4 To comply with legal obligations

We may process certain data to comply with obligations under applicable law, such as tax or accounting rules.

Legal basis: GDPR art. 6(1)(c).

4 Children and families

The Service is designed to be used by parents or legal guardians to manage routines and chores for their children. The account holder is always an adult, who provides us with limited information about children (for example first name, avatar, routines, tasks, completion status). By adding child data, you confirm that you are the parent or legal guardian and that you are entitled to share this information with us.

5 Supabase and how data is stored

5.1 Supabase as service provider

We currently use Supabase as our main backend and database provider. Personal data you enter into the Service is stored on Supabase's infrastructure on our behalf. Supabase acts as our data processor under GDPR, and we have a data processing agreement in place.

5.2 Storage location and transfers

Your data is stored on Supabase's cloud infrastructure. This may involve transfers of personal data to countries outside your own country. Where such transfers involve countries outside the EU/EEA, we will ensure that appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission, or that another valid transfer mechanism is used.

6 How long we keep your data

We keep your personal data for as long as it is necessary for the purposes described in this Privacy Policy:

Account and profile data are stored while you have an active account.
If you request deletion of your account, we will delete or anonymise personal data within a reasonable period, subject to any legal retention obligations.
Technical logs and backup copies may be retained for a limited time for security, troubleshooting, and backup purposes, after which they are deleted or anonymised.

7 Sharing of personal data

7.1 Service providers

We may share personal data with trusted service providers who help us operate the Service, such as Supabase. These providers act as data processors and may only process personal data based on our instructions and for the purposes described above.

7.2 Legal requirements and business protection

We may disclose personal data if required to do so by law, court order, or regulatory authority, or if necessary to establish, exercise, or defend legal claims, or to detect or prevent fraud or abuse of the Service. We do not sell your personal data.

8 Your rights under GDPR

As a data subject in the EU/EEA, you have the following rights, subject to the conditions and limitations in GDPR:

Right of access: You can request information about whether we process your personal data and receive a copy of the data we process about you.
Right to rectification: You can request correction of inaccurate or incomplete personal data.
Right to erasure: You can request deletion of your personal data, for example when the data is no longer necessary for the purposes for which it was collected.
Right to restriction: You can request that we restrict the processing of your personal data in certain situations.
Right to data portability: You can request to receive certain personal data in a structured, commonly used, and machine-readable format and to have that data transmitted to another controller where technically feasible.
Right to object: You can object to certain processing based on our legitimate interests.

To exercise any of these rights, contact us at mail@khedri.dk

. We may need to verify your identity before handling your request.

You also have the right to lodge a complaint with your local data protection authority. In Denmark, this is Datatilsynet.

9 Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. However, no system can be guaranteed to be completely secure, and you should also take care to protect your login credentials and devices.

10 Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example if we change our Service or our processing activities. When we make material changes, we will notify you within the Service or by email. The updated Privacy Policy applies from the date stated at the top. Your continued use of the Service after changes take effect means you accept the updated Privacy Policy.