Privacy Policy
This privacy policy explains how the "Kalbeja" app handles your and your child's data. The policy complies with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.
This is an English translation of the Lithuanian privacy policy (privatumo politika). In case of any discrepancy, the Lithuanian version prevails.
- Data controller
- Purposes of data processing
- Legal basis
- What data is collected
- Data storage
- Data recipients
- International transfers
- Retention periods
- Your rights
- How to exercise your rights
- Right to lodge a complaint
- Children's privacy
- Automated decision-making
- Data security
- Changes to this policy
- Website cookies and analytics
1. Data controller
The data controller of the "Kalbeja" app is:
- Name: UAB „Kalbeja"
- Company code: 308056840
- Address: Perkūnkiemio g. 47-81, LT-12101 Vilnius, Lithuania
- Email: info@kalbeja.com
2. Purposes of data processing
Data is processed for these specific purposes:
- To provide the child with personal augmentative and alternative communication (AAC) using photo and audio cards created by the parents or guardians;
- To present usage statistics to the parents so they can follow the child's communication progress;
- To guide the parents through the built-in methodology lessons that help use the app effectively.
3. Legal basis
Data is processed on the basis of the parent's / guardian's consent under Article 6(1)(a) of the GDPR and Article 8 (a child's consent in relation to information society services).
In the Republic of Lithuania the age of consent is set at 14. For children under 14, consent is given by a parent or guardian. Consent is collected when the app is first launched, on a separate consent screen before any personal data is entered.
4. What data is collected
The app collects only the data that parents enter themselves or that is generated by the child's interaction with the app. Nothing is collected without the parents' knowledge.
| Data | Classification | Purpose |
|---|---|---|
| Photos | Critical | Card images for the child's communication |
| Audio recordings | Critical | Played back when a card is tapped |
| Child's name/nickname | High | Profile identification |
| Child's age | High | Presenting age-appropriate content |
| Communication level | High | Adapting the methodology |
| Caregiver relationship | High | Profile context |
| Usage log | High | Statistics for parents |
| Card data | Medium | Labels, categories, positions |
| Learning progress | Medium | Tracking completed lessons |
| Admin PIN (hashed) | Medium | Protecting the admin mode |
5. Data storage
- All data is stored only on the user's device (the tablet).
- No cloud servers, no data transfer beyond the device.
- The database is encrypted with SQLCipher.
- The encryption key is stored in the platform's secure storage (Android Keystore / iOS Keychain) and is not accessible outside the app.
6. Data recipients
Data is not shared with anyone. Specifically:
- No analytics services are used;
- No advertising networks are used;
- Platform crash reports (Google / Apple) are anonymous and contain no personal data.
7. International transfers
Data is not transferred anywhere. It never leaves the device, except when the parent exports it to a JSON file through the app settings.
8. Retention periods
| Data | Retention | Automatic deletion? |
|---|---|---|
| Usage log | 90-day rolling window | Yes — deleted automatically when the app is launched |
| All other data | Until manually deleted | No — only via "Delete all data" in the settings |
9. Your rights
Under the GDPR you have the following rights:
| GDPR right | How to exercise it in the app |
|---|---|
| Right of access | Review all data in the admin mode |
| Right to rectification | Edit any card or profile information |
| Right to erasure | Settings → Delete all data |
| Right to data portability | Settings → Export (a JSON file with all data) |
| Withdrawal of consent | Settings → Delete all data (returns the app to its initial state) |
10. How to exercise your rights
Most GDPR rights can be exercised directly in the app, without contacting us. All functions are available in the admin mode after entering the PIN.
If you have questions or requests, contact us by email: info@kalbeja.com. We will reply within 30 calendar days.
11. Right to lodge a complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority of the Republic of Lithuania:
- State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI)
- Address: L. Sapiegos g. 17, 10312 Vilnius
- Email: ada@ada.lt
- Website: www.ada.lt
12. Children's privacy
- The app is intended for use by children under the supervision of parents / guardians;
- All personal-data processing actions are controlled by the parent / guardian;
- The child cannot access personal data or settings on their own — the admin mode is protected by a PIN code;
- No child data is collected without parental consent.
13. Automated decision-making
The app performs no automated decision-making or profiling that would have legal effects or significantly affect the user.
The app shows simple, rule-based suggestions (toast messages) to the parent — this is information only and does not replace any decisions.
14. Data security
The app implements the following security measures:
- Local database encryption (SQLCipher);
- PIN hashing (SHA-256, 1000 rounds) with attempt limiting;
- Password-protected exports (AES-256);
- Operating-system sandbox protection for media files;
- The task switcher shows the app logo, not the content, when the app is in the background.
15. Changes to this policy
The policy version and effective date are shown at the top of this page. An updated policy is delivered through app updates. The parent or guardian will see the changes the next time they launch the app.
For significant changes that alter the purpose or legal basis of processing, we will ask you to renew your consent.
16. Website cookies and analytics
The website kalbeja.com uses the Google Analytics 4 service to collect website traffic statistics. This data helps us understand how visitors find the website and how they use it, so we can improve the content.
Data collected (only with your consent)
- Website pages visited and time of viewing
- General geographic location (country or city level — not an exact address)
- Device type (tablet / phone / computer) and browser information
- The link from which you arrived at the website
- An anonymous visitor identifier (stored in a cookie)
IMPORTANT — the mobile app is separate from the website
The Kalbeja mobile app does not link any child data to Google Analytics or any other external service.
- The child's cards, voices, photos and usage data NEVER leave your device.
- The app works offline and does not connect to cloud servers.
- Website and app data are completely separate.
- The provisions of this section apply only to visitors of the kalbeja.com website, not to users of the app.
Data controller and processor
- Controller: UAB „Kalbeja" (see Section 1)
- Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Google privacy policy: policies.google.com/privacy
Retention period
The default Google Analytics 4 data retention period is 14 months from the last visit. After this period the data is deleted automatically.
Legal basis
Data is processed on the basis of your explicit consent under Article 6(1)(a) of the GDPR and the requirements of Directive 2002/58/EC (ePrivacy).
Consent and its withdrawal
Cookies are set only after your explicit consent, given by clicking "Accept" in the consent banner shown on your first visit to the website.
You can withdraw your consent at any time by clicking the "Cookie settings" link at the bottom of the website. After withdrawal, existing cookies in your browser will remain valid until their natural expiry or until you delete them in your browser settings.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict the processing of, or port your data. To exercise these rights regarding website analytics data, contact: info@kalbeja.com.