← Back to home

Privacy Policy

Version: 2.0  |  Effective date: 2026-09-21  |  App: Kalbeja (Android)

This privacy policy explains how the "Kalbeja" app handles your and your child's data. The policy complies with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

This is an English translation of the Lithuanian privacy policy (privatumo politika). In case of any discrepancy, the Lithuanian version prevails.

1. Data controller

The data controller of the "Kalbeja" app is:

• Name: UAB „Kalbeja"
• Company code: 308056840
• Address: Perkūnkiemio g. 47-81, LT-12101 Vilnius, Lithuania
• Email: info@kalbeja.com

When the app is used by an educational or other institution (a kindergarten, school or support centre), the controller of the children's data on the institution's tablet is the institution itself. UAB „Kalbeja" does not receive this data and has no access to it — it stays on the institution's device.

2. Purposes of data processing

Data is processed for these specific purposes:

• To provide the child with personal augmentative and alternative communication (AAC) using photo and audio cards created by the parents or guardians;
• To present usage statistics to the parents so they can follow the child's communication progress;
• To guide the parents through the built-in methodology lessons that help use the app effectively;
• To activate and verify the "Kalbeja Pro" licence and to deliver app updates (technical data only — see section 4).

3. Legal basis

Data is processed on the basis of the parent's / guardian's consent under Article 6(1)(a) of the GDPR and Article 8 (a child's consent in relation to information society services).

In the Republic of Lithuania the age of consent is set at 14. For children under 14, consent is given by a parent or guardian. Consent is collected when the app is first launched, on a separate consent screen before any personal data is entered.

Licence activation and verification data is processed for the performance of a contract (GDPR Article 6(1)(b)), and — to protect against unauthorised use of a licence and to deliver app updates — on the basis of legitimate interest (GDPR Article 6(1)(f)). This data is not the child's data.

4. What data is collected

The app collects only the data that parents enter themselves or that is generated by the child's interaction with the app. Nothing is collected without the parents' knowledge.

Technical data sent over the internet

All the child's and family's data listed above stays on the device. Only the following technical data is sent over the internet — it contains no child's name, photos, audio recordings, cards or usage statistics:

The device identifier is a random number created inside the app. It is not an advertising ID, phone number, IMEI or any other hardware number; it is deleted when the app is uninstalled. While the child uses the communication board no internet connection is needed and no data is sent.

5. Data storage

• All the child's and family's data (cards, photos, audio recordings, profile, statistics) is stored only on the user's device (the tablet).
• This data is not sent to any server — neither ours nor a third party's. The app works offline.
• The database is encrypted with SQLCipher.
• The encryption key is stored in the platform's secure storage (Android Keystore / iOS Keychain) and is not accessible outside the app.
• The licence server stores only the technical licence data described in section 4.

6. Data recipients

The child's and family's data is not shared with anyone. In the app:

• No analytics services are used;
• No advertising networks or advertising identifiers are used;
• Platform crash reports (Google / Apple) are anonymous and contain no personal data.

The technical data described in section 4 is processed on our behalf by these service providers (data processors):

• Fly.io, Inc. — hosting of the licence server (server located in Frankfurt, Germany);
• 650 Industries, Inc. ("Expo") — delivery of app updates;
• Hostinger — hosting of the kalbeja.com website;
• Google — app distribution and, if you buy a subscription, payment processing through Google Play (here Google acts as an independent controller under its own privacy policy).

7. International transfers

The child's and family's data is not transferred anywhere. It does not leave the device, except when the parent or guardian saves or shares it themselves — exports the data to a JSON file, or creates a statistics report or a printable-cards PDF. These files are created on the device and end up only where the user puts them.

The licence server runs in the European Union. The servers of the app-update service ("Expo") and of Google may be located outside the European Economic Area, including the USA. In those cases only the technical data described in section 4 is transferred, and the transfer relies on the safeguards provided for in Chapter V of the GDPR (the EU–US Data Privacy Framework or standard contractual clauses).

8. Retention periods

9. Your rights

Under the GDPR you have the following rights:

10. How to exercise your rights

Most GDPR rights can be exercised directly in the app, without contacting us. All functions are available in the admin mode after entering the PIN.

If you have questions or requests, contact us by email: info@kalbeja.com. We will reply within 30 calendar days.

11. Right to lodge a complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority of the Republic of Lithuania:

• State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI)
• Address: L. Sapiegos g. 17, 10312 Vilnius
• Email: ada@ada.lt
• Website: www.ada.lt

12. Children's privacy

• The app is intended for use by children under the supervision of parents / guardians;
• All personal-data processing actions are controlled by the parent / guardian;
• The child cannot access personal data or settings on their own — the admin mode is protected by a PIN code;
• No child data is collected without parental consent.

13. Automated decision-making

The app performs no automated decision-making or profiling that would have legal effects or significantly affect the user.

The app shows simple, rule-based suggestions (toast messages) to the parent — this is information only and does not replace any decisions.

14. Data security

The app implements the following security measures:

• Local database encryption (SQLCipher);
• PIN hashing (SHA-256, 1000 rounds) with attempt limiting;
• The export file contains no PIN; the file itself is not encrypted, so the parent or guardian must keep it safe;
• Licence confirmations are digitally signed (Ed25519) and connections to the servers are encrypted (HTTPS);
• Operating-system sandbox protection for media files;
• The task switcher shows the app logo, not the content, when the app is in the background.

15. Changes to this policy

The policy version and effective date are shown at the top of this page. An updated policy is delivered through app updates. The parent or guardian will see the changes the next time they launch the app.

For significant changes that alter the purpose or legal basis of processing, we will ask you to renew your consent.

16. Website cookies and analytics

The website kalbeja.com uses the Google Analytics 4 service to collect website traffic statistics. This data helps us understand how visitors find the website and how they use it, so we can improve the content.

Data collected (only with your consent)

• Website pages visited and time of viewing
• General geographic location (country or city level — not an exact address)
• Device type (tablet / phone / computer) and browser information
• The link from which you arrived at the website
• An anonymous visitor identifier (stored in a cookie)

IMPORTANT — the mobile app is separate from the website

The Kalbeja mobile app does not link any child data to Google Analytics or any other external service.

• The child's cards, voices, photos and usage data NEVER leave your device unless you export them yourself.
• The app works offline; it goes online only to check the licence and to receive updates (see section 4) — with no child data at all.
• Website and app data are completely separate.
• The provisions of this section apply only to visitors of the kalbeja.com website, not to users of the app.

Data controller and processor

• Controller: UAB „Kalbeja" (see Section 1)
• Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Google privacy policy: policies.google.com/privacy

Retention period

The default Google Analytics 4 data retention period is 14 months from the last visit. After this period the data is deleted automatically.

Legal basis

Data is processed on the basis of your explicit consent under Article 6(1)(a) of the GDPR and the requirements of Directive 2002/58/EC (ePrivacy).

Consent and its withdrawal

Cookies are set only after your explicit consent, given by clicking "Accept" in the consent banner shown on your first visit to the website.

You can withdraw your consent at any time by clicking the "Cookie settings" link at the bottom of the website. After withdrawal, existing cookies in your browser will remain valid until their natural expiry or until you delete them in your browser settings.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict the processing of, or port your data. To exercise these rights regarding website analytics data, contact: info@kalbeja.com.

← Back to home