Legal
Privacy Policy
Last updated: 31 August 2026
Lemu Kids is operated by Lemu Labs. This policy explains how we collect, use, and protect personal data from parents and guardians. Child profiles are created only after verified parental consent (COPPA / GDPR-K).
Data controller
Lemu Labs, Agência de Design e Marketing Digital, Lda. (Portugal) is the data controller for Lemu Kids. Contact: hello@lemu-lab.com
What we collect
Parent account: email address for authentication and billing. Family profile: child first name, age, interests, values, screen-time preferences, and approved video plans. Usage: safety scores, approval decisions, and subscription status. We do not sell personal data.
Artificial intelligence & personalisation
We use artificial intelligence (AI) to turn your child's interests and values into a weekly video plan. Our AI provider is Mistral AI (La Plateforme) — a French company; your child's data is processed in the European Union. What this means for your child's data: • We send only what is needed to build a plan: age, interests and values. We replace your child's name with a neutral identifier, so the name is never sent to the AI provider. • The AI never decides alone. Every recommendation passes our safety scoring and only reaches your child's queue after your approval. • The underlying models are mistral-small-latest and mistral-medium-latest, accessed through Mistral's EU platform. Your rights are unchanged: you can export, delete or withdraw consent at any time — see 'Your rights' below.
Sub-processors & international transfers
To run Lemu Kids we work with a small number of service providers: • Mistral AI (La Plateforme) — AI: generates weekly plans and analyses videos. A French company; data is processed in the EU. • Neon — database hosting (EU).
Parental consent
Lemu Kids is parent-managed: children cannot create accounts or sign up on their own. Before any child profile is created, we need verified parental consent. Today, consent is confirmed with a checkbox plus a verified email link. At public launch, we will add a stronger step: a card check via Stripe — a €0 pre-authorisation that never charges you. We ask for this because US and EU law (COPPA and GDPR-K) require a reasonable effort to confirm that the person giving consent is really a parent or guardian, and a card check is a method regulators explicitly accept. We never store your card number: Stripe handles payment data and we only keep a confirmation that verification succeeded. You can withdraw consent at any time, which immediately stops all processing of your child's data.
Your rights (GDPR)
You can exercise your rights directly from your account: • Access & portability — download a complete copy of your family's data (JSON) from Settings → Privacy & your data (/api/account/export). • Correction — update your child's profile at any time in Settings. • Deletion — delete your account and all child data from Settings (/api/account). This cancels your subscription and removes everything we hold. • Withdraw consent — stop all processing of your child's data at any time from Settings (/api/consent). The child's queue is blocked immediately until you consent again. • Complain — you may lodge a complaint with your local data protection authority (in Portugal, the CNPD). You can also exercise any of these rights by emailing hello@lemu-lab.com.
Contact
Privacy questions: hello@lemu-lab.com We aim to respond within 72 hours on business days.