Data Rights and Deletion

Effective [[EFFECTIVE_DATE]]

How to see what we hold, correct it, take it with you, or have it deleted. This page is the practical companion to our Privacy Policy.

Using any of these rights never costs you access to Vunali, and we will not ask you why.

---

What there is to delete

Less than you might expect. We hold nothing about any individual child: the app has no child profiles, and reading progress and favourites are kept on your device, not by us. What we can hold is:

• a random identifier for each installation of the app, with its platform, app version and language;
• your account, if you created one: your email address, the stored form of your password if you set one, and any Sign in with Apple or Sign in with Google link;
• your paid-access status (monthly, annual or one-time lifetime purchase);
• your email address on the waiting list, if you joined it on the website.

Delete what is on your device

Deleting the app from a device deletes the reading progress, favourites and downloaded tales stored on it.

Delete your whole account

In the app. Parent room, parent gate, then delete account.

By email. Write to [email protected] from the address on the account.

This removes your email address, the stored form of your password if you set one, any Sign in with Apple or Sign in with Google link, and your paid-access status, and it signs out and unlinks every device that was signed in to the account. We also ask RevenueCat to delete its record of your purchases. Deletion is immediate; copies held in our database's point-in-time recovery expire within 30 days.

Each device keeps only its anonymous installation record, no longer linked to you, so the app goes on working there. That record is deleted once the app has not contacted us for 24 months, or straight away if you ask.

Deleting the account here does not delete your Apple or Google account, and does not by itself stop Apple from relaying mail to you. If you signed in with Apple and used Hide My Email, you can also switch the relay off under your Apple account, in Settings, your name, Sign in with Apple.

Nothing that identifies you survives on our side. Apple and Google keep their own records of what you bought, as the sellers; the payout statements they send us for tax purposes do not identify you.

Deleting your account does not cancel a recurring subscription, because Apple and Google control that. Cancel in the store as well, or you will keep being charged. A one-time lifetime purchase does not renew, but deleting the account removes its Vunali access record; contact [email protected] before deleting if you need help understanding how to restore a store purchase to a different account. Instructions for recurring plans are in section 3.2 of the Terms.

Leave the waiting list

Every email we send to the waiting list has an unsubscribe link. You can also write to [email protected] and we will remove your address.

Get a copy of your data

Write to [email protected] from the account's email address. We will send a machine-readable file containing your account details, your devices and your paid-access status within 30 days.

It will say which sign-in methods are on the account, and will not contain your password: we do not hold it in a form anyone can read, including us.

Correct something

Write to [email protected] and we will correct it.

Object, restrict, or withdraw consent

If you are in the EEA or UK you may object to, or ask us to restrict, processing based on legitimate interests, and withdraw any consent you have given, such as to the waiting list. Withdrawing consent does not affect what was done lawfully before you withdrew it.

If you are in the United States

You may ask us what personal information we hold about you or your child, ask us to delete it, and refuse any further collection. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of, but you may still ask.

Under COPPA, a parent may review any information about their child, have it deleted, and refuse further collection. We do not collect personal information from children (see Children's Privacy), so in practice such a request concerns the parent's own account.

How to reach us, and how fast we answer

Please write from the email address on the account. If you cannot, we may need another way to check the request is genuinely yours, because handing a family's data to the wrong person is the worst thing we could do.

If we get it wrong

Tell us first at [email protected] and we will try to fix it.

You may also complain to a regulator:

• Spain, and our lead authority for the EEA: the Agencia Española de Protección de Datos (AEPD), www.aepd.es
• Elsewhere in the EEA: your national data protection authority
• UK: the Information Commissioner's Office
• United States: the Federal Trade Commission

Who is responsible

The data controller is José Antonio Caballero Martos, NIF [[TAX_ID]], a sole trader established in Spain. Because he is established in the European Union, no EU representative under Article 27 GDPR is required. No data protection officer is appointed, because our processing does not meet the conditions that require one (Article 37 GDPR, Article 34 of Spain's Organic Law 3/2018).