Legal
Privacy Policy
Last updated: 15 October 2026
This policy explains how we collect, use, and protect personal data from parents and guardians. Child profiles are created only after verified parental consent (COPPA / GDPR-K).
Data controller
This website is operated by the Lemu Lab business — the brand of a Portuguese sole trader (empresário em nome individual) who is the provider of kids.lemu-lab.com. Privacy requests can be sent to hello@lemu-lab.com.
What we collect
Parent account: email address for authentication and billing. Family profile: child first name, age, interests, values, screen-time preferences, and approved video plans. Usage: safety scores, approval decisions, and subscription status. We do not sell personal data.
Artificial intelligence & personalisation
We use artificial intelligence (AI) to turn your child's interests and values into a weekly video plan. Our AI provider is Mistral AI (La Plateforme) — a French company; your child's data is processed in the European Union. What this means for your child's data: • We send only what is needed to build a plan: age, interests and values. We replace your child's name with a neutral identifier, so the name is never sent to the AI provider. • The AI never decides alone. Every recommendation passes our safety scoring and only reaches your child's queue after your approval. • The underlying models are mistral-small-latest and mistral-medium-latest, accessed through Mistral's EU platform. Your rights are unchanged: you can export, delete or withdraw consent at any time — see 'Your rights' below.
Sub-processors & international transfers
To run Lemu Kids we work with a small number of service providers: • Mistral AI (La Plateforme) — AI: generates weekly plans and analyses videos. A French company; data is processed in the EU. • Neon — database hosting (EU). • Stripe — parent card verification (a €0 pre-authorisation that is never charged) and subscription billing. We do not store card numbers: Stripe processes only a payment token, on the parent's behalf. • Vercel — hosting and delivery of the pages and application (edge). • Resend — email delivery (sign-in links and support). • Google OAuth — sign-in with a Google account (optional; only when enabled). Children's data is processed in the EU (Mistral and Neon). Stripe and Vercel may process data outside the EU for payments and delivery.
Parental consent
Lemu Kids is parent-managed: children cannot create accounts or sign up on their own. Before any child profile is created, we need verified parental consent. Parental consent is confirmed with a checkbox plus a verified email link. For families in the United States, we additionally verify your identity with a card check via Stripe — a €0 pre-authorisation that never charges you. This stronger step is required by US child-protection regulations (COPPA). We never store your card number: Stripe handles payment data and we only keep a confirmation that verification succeeded. The legal basis for processing your card data for this purpose is our legitimate interest in complying with COPPA (GDPR Art. 6(1)(f)). You can withdraw consent at any time, which immediately stops all processing of your child's data.
Your rights (GDPR)
You can exercise your rights directly from your account: • Access & portability — download a complete copy of your family's data (JSON) from Settings → Privacy & your data (/api/account/export). • Correction — update your child's profile at any time in Settings. • Deletion — delete your account and all child data from Settings (/api/account). This cancels your subscription and removes everything we hold. • Withdraw consent — stop all processing of your child's data at any time from Settings (/api/consent). The child's queue is blocked immediately until you consent again. • Complain — you may lodge a complaint with your local data protection authority (in Portugal, the CNPD). You can also exercise any of these rights by emailing hello@lemu-lab.com.
Contact
Privacy questions: hello@lemu-lab.com We aim to respond within 72 hours on business days.