Privacy policy

Last updated: 20 October 2026

Drimmlies is an app by Drimmly AI Ltd. This policy explains how we handle your personal data when you use Drimmlies, and it also covers your Drimmly account, which is the same account you use on drimmly.com.

This policy is available in English, Spanish and French.

---

How to read this policy

It is written in layers:

• Layer 1 · One-minute summary. The essentials in one table.
• Layer 2 · Full text. Sections 1 to 19, with all the detail the law requires.

If you have questions, email us at [email protected] or use Settings › Help in the app.

---

Layer 1 · One-minute summary

What we never do:

• sell your data or your children's data;
• show you ads from other companies, or track you across other apps and websites;
• send marketing from Drimmlies to your children, by any channel;
• use your Google Calendar or Gmail data for advertising or to train models;
• use your location, your Wi-Fi or your device's fingerprint, or change your price based on who you are;
• train AI models on your conversations, or let Google or ElevenLabs do so (Google's contract prohibits it; at ElevenLabs we have switched that option off);
• create voiceprints, recognise faces, or infer your age or emotions from your voice or face;
• make automated decisions with legal effects on you.

---

Layer 2 · Full text

---

1. Who we are and how to contact us

• Controller: DRIMMLY AI LTD ("Drimmly", "we", "us"), a private limited company registered in England and Wales under company number 16962658, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
• Our brands:
  • Drimmlies (drimmlies.com): the app for parents and guardians;
  • Drimmly (drimmly.com): the AI study platform for students.
• Privacy contact:
  • email: [email protected];
  • in the app: Settings › Help;
  • by post: Drimmly AI Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom;
  • by phone: +44 7355 612848 (also on WhatsApp).
• Registration with the Information Commission (UK): in progress.
• Data protection officer (DPO): our DPO is the same for Drimmlies and drimmly.com. You can contact them directly at [email protected], or by post at Data Protection Officer, Drimmly AI Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
• Help with the app: [email protected]. Anything else: [email protected].
• How quickly we reply: as soon as possible, usually within 24 hours. Requests to exercise your data protection rights have the time limits in section 13.5.

2. Representative in the European Union

• EU representative: we have appointed Alexis Sanz Fargeas, CEO of Drimmly AI Ltd, domiciled in Spain, as our representative in the European Union under Article 27 of the EU General Data Protection Regulation (GDPR), for users in every EU country where Drimmlies is available. You can contact him at [email protected] about any question about your data, and so can data protection authorities.
• Digital Services Act: because the class circle lets families share dates with each other, he is also our legal representative in the EU under Article 13 of the Digital Services Act (Regulation (EU) 2022/2065), at the same email address. Our single point of contact for users and authorities (Articles 11 and 12 of the Digital Services Act) is [email protected], in English, Spanish or French.
• Supervisory authority: you can always complain to the data protection authority of your country (section 14).

We do not need a UK representative because we are a UK company. In the US, email us at [email protected].

3. What this policy covers

• It covers:
  • the Drimmlies app (iOS and, later, Android);
  • the drimmlies.com website;
  • your Drimmly account, which is the same in the app and on drimmly.com;
  • the reminder emails we send your child on your behalf, the activation page where they turn them on and the page where they reply (section 6.11). Section 6.5 has a short notice written for your child.
• It does not cover:
  • your children's own accounts on drimmly.com. If your child has their own account, their data is governed by the drimmly.com privacy policy (drimmly.com/privacy);
  • what Apple and Google do on their own account (your Apple ID, your Google account, payments in their stores, and your events and emails once they are in Google Calendar or Gmail). Their own policies apply.
• Where: Drimmlies is available on the App Store in the United States, the United Kingdom, Spain, France, Belgium, Luxembourg, Austria, Ireland, Sweden, Denmark and Finland.
• Laws we apply:
  • the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), which apply to everything our company processes;
  • the EU GDPR and, in each EU country, its national data protection and electronic communications law (for example, in Spain, Organic Law 3/2018 (LOPDGDD) and the LSSI; in France, the Loi Informatique et Libertés);
  • the relevant US federal and state laws, because Drimmlies is available there (section 15).

4. What data we use and where it comes from

4.1 Data you give us

• Your account: name, email and, if you sign in with Apple or Google, the identifier they give us. If you register with email on drimmly.com, also your password, which we store as a hash and never in plain text.
• Your profile: your role in the family (parent or guardian), the topics you want help with, the character you choose (Nimbo, Brisa, Cielo or Lumi), your language and your preferences.
• Your declarations and permissions: that you are 18 or over and a parent or legal guardian; your permission to use third-party AI; your explicit consent to talk about health, if you give it; your communication preferences. We keep the version of the text you accepted and the date.
• Your children's profiles: first name (or a nickname), age in years, school system, school year and exams. Optionally, a private note about each child. More in section 6.
• What you share with Nimbo: what you type, what you say by voice (we turn it into text) and the photos you show it.
• Your tasks and reminders.
• Reminders to your child aged 14 or over (if you want, section 6.11): the task, which you write yourself, the day and time and, if you want, a note of up to 140 characters. Your child gives us their email when they turn the reminders on or, if you ask us to email them the invitation on your behalf, you give it to us. We never ask for their phone number.
• Your class circle (if you join): the display name you choose for your family and the dates you share (exams, trips, deadlines). Never grades.
• Invitations: you send invitations to the other parent, to other families and to the circle yourself from your phone, using the share sheet. We do not keep their email or phone number: only a single-use link and whether it was accepted. The invitation to your child to drimmly.com (section 6.7) is a single-use link you send them yourself from your phone (WhatsApp, Messages, Mail or the share sheet) or that we email them on your behalf, if you ask us to: you give us their age range, the country where they live and, only in that case, their email. Never their phone number.
• What you share with Nimbo from other apps ("Share with Nimbo", for example a school circular): we delete the original once Nimbo has read it.
• Google Calendar and Gmail, if you connect them (section 7 bis).
• Support: what you tell us when you contact us.

4.2 Data created when you use the app

• Your conversation history with Nimbo (text, voice transcripts and answers) and Nimbo's memory: the facts it remembers to help you, which you can see and delete.
• Facts derived from your photos: only the subject, level, school system and topic (for example, "Maths · equations · Year 9"). We don't keep the photo (what Google may keep is in section 7.2).
• AI traces: the steps you see while Nimbo works (for example, "checking your tasks for this week").
• Credits, missions, referrals, level and stickers: how many credits you have, how you earned or bought them and whom you invited; your experience, your level and your stickers.
• Notification data: whether notifications are allowed and your device token, your time zone and language, the quiet hours you choose and the times of your reminders. And, unless you object, which days and at what times you use the app and which notification you opened, worked out on our server from the requests the app already makes (section 16).
• Reminders to your child: whether they turned them on, whether each one was sent and your child's reply ("OK 👍" or "Another time"), never whether they opened the email.
• AI usage logs, without content: date, feature, model, number of tokens and cost.
• Technical data: user identifier, your device's push notification token, app version, security logs (with your IP address pseudonymised by hashing, which is still personal data) and server error reports (Sentry), without the content of your conversations.
• Age checks, where the law requires them: only "adult: yes or no", the source (your app store) and the date.

4.3 Data we receive from others

• Apple or Google, if you sign in with them: your identifier, name and email (or Apple's relay email if you choose to hide yours).
• Apple (App Store) and RevenueCat, when you subscribe: your subscription status, plan, country, currency and transaction identifiers. We never see your card.
• drimmly.com, if your child links their account to yours (section 6.7): their progress and their goals, and safety alerts, with an excerpt of what triggered them only where section 6.7 allows it.
• Your child, if you invite them to the reminders: if they turn the reminders on, their email (unless you gave it to us so we could send them the invitation), their "yes", the replies they tap, the replies they send to the reminder email (which we forward to you) and their unsubscribe.
• Google, if you connect Google Calendar or Gmail: only what the permissions you grant allow; free or busy information only if you turn on "Warn me about clashes" or "Time my notifications using my calendar" (section 7 bis).
• Other parents: if the other parent invites you to their family, or another family in your class invites you to a circle.

4.4 Data we do not ask for

We do not ask for your location, contacts or phone number, and we don't ask for health data (section 6.4 explains what happens if you choose to talk about it). We do not read your Wi-Fi network, your Focus status, your movement or the apps you have installed. For your children, we do not ask for surnames, dates of birth, photos, school, location or phone number. We only have your child's email if they are 14 or over: they give it to us when they accept your reminders, or you give it to us so we can email them your invitation (if they don't reply within 7 days, we delete it). It never goes to Nimbo's memory or to the AI.

4.5 Do you have to give us this data?

• Drimmlies requires a subscription (in Spain, with a free welcome week first). Without the AI permission you can use Tasks, the Family tab and the class circle, but not Nimbo.
• To create an account we need your email (or Apple or Google sign-in) and your declaration that you are an adult and a parent or guardian. Without these we cannot provide the service.
• To use Nimbo we need your permission to send your messages to our AI providers.
• Everything else is optional: your children's profiles, the private note, the camera, voice, the circle, invitations, reminders to your child and connecting Google Calendar or Gmail. If you do not use them, Nimbo will help you with less context. "Notifications that fit you" is on, and you can object with one tap: you then get the same notifications at default times (section 16).

5. Why we use data, our lawful basis and how long we keep it

The lawful bases are those in Article 6 of the UK GDPR and the EU GDPR (same numbering). In the table: contract (Article 6(1)(b): we need it to provide the service you ask for), legitimate interests (Article 6(1)(f)), legal obligation (Article 6(1)(c)), consent (Article 6(1)(a)) and explicit consent (Article 9(2)(a), for sensitive data).

Our legitimate interests are: helping you organise your family's school life (including sending your child the reminders you schedule and choosing the time of your notifications), protecting children, keeping the app secure and free from abuse, controlling the cost of AI, and being able to prove that we comply with the law. We only rely on them where they are not overridden by your rights and interests or your children's, bearing in mind that children's interests carry great weight. You can object to any processing based on legitimate interests (section 13).

Your permission to use third-party AI. Before Nimbo sends anything to Google or ElevenLabs, we ask for your express permission, as Apple requires. Using Nimbo is part of the service you sign up for (lawful basis: contract), but you can withdraw that permission at any time in Settings › Privacy › AI: we will stop sending data to AI providers, Nimbo will be switched off and we will disconnect Google Calendar and Gmail. Tasks, reminders to your child (which don't use AI), the Family tab and the class circle keep working. If we ever add another AI provider, we will tell you and ask for your permission again before sending it anything.

Your consent to talk about health. It is separate from the AI permission and we ask for it before your first message to Nimbo, with an unticked box. Section 6.4 explains it.

6. Your children's data

6.1 Profiles you create

Drimmlies is for adults. Your children do not use the app. Drimmlies only writes to your children if they're 14 or over: a single invitation email on your behalf, if you ask us to and confirm it; the reminders, only if they say yes (in the email we send them on your behalf or through the link you send them from your phone; in that case, they then confirm their address with an email they request); and, when they turn 18, an email asking whether they want to continue (section 6.11). If you wish, you can create a profile for each child so Nimbo can help you better:

By creating a profile you confirm that you are the child's parent or legal guardian.

6.2 Why we may use it

We use your children's data on the basis of legitimate interests (Article 6(1)(f)): yours, as a parent or guardian, in supporting their education, and ours in helping you do so. We take into account that they are children and that their interests carry great weight. What protects them:

• we ask for the minimum data;
• we do not use your children's data for advertising or commercial profiling, and we do not sell it. Nimbo's memory does remember context about each child to help you (a form of profiling): you can see it and delete it at any time in Nimbo's memory;
• Google does not train on it (its contract prohibits it);
• you can correct or delete it at any time;
• reminders to your child come with their own safeguards:
  • only for children aged 14 or over whom you declare to be in your care;
  • your child decides: you send them a link from your phone, or ask us to send them a single email on your behalf, and they see who will write to them and why, with the information about their data, and say whether they want reminders. We never send them a reminder without their "yes"; if they don't turn reminders on within 7 days, the link expires and we keep nothing, and if you gave us their email, we delete it. You can try again at most three times in total, and no more than once a month. If they say "No, thanks" or unsubscribe, you won't be able to ask them again through Drimmlies;
  • fixed Drimmlies templates with the task you write, the day and the time and, if you want, a note of yours. Nimbo does not write to your child, and their email never goes to the AI or to Nimbo's memory;
  • service only: no advertising, no links to the App Store or to drimmly.com, no slogans;
  • at most 3 a day and 10 a week, only between 8 am and 8 pm in their local time;
  • no open tracking and no tracked links: we only record the reply they choose to tap;
  • one-click unsubscribe in every email. It is their right to object (Article 21): we apply it straight away and you cannot override it. We tell you in neutral words ("Email reminders to Pablo are turned off");
  • short retention (section 5).

6.3 What Drimmlies never does with your children's data

• Advertising, commercial or marketing profiles, or sale to third parties.
• Sending them marketing, by any channel.
• Using any signal from your child to send you marketing.
• Training artificial intelligence models.
• Showing it to other families: in the class circle, other families only see your family's display name and the dates you share.
• Asking Nimbo to infer or label diagnoses or sensitive traits (for example, "sounds like ADHD").

6.4 Health information and special educational needs

You don't need to tell us about diagnoses, health or special educational needs, whether yours or your children's.

• If you want to talk about these topics with Nimbo, we first ask for separate explicit consent (Article 9(2)(a)): an unticked box, separate from the AI permission, shown before your first message. That consent covers sending what you tell us to our AI providers so Nimbo can answer you (Google and, if you listen to the answer in Nimbo's voice, ElevenLabs, which receives the text of that answer), and keeping it in your history for the period you have chosen, 6 months at most. It also covers the private note about a child under 14.
• If you don't give it, please don't share health or special educational needs information about you or your children with Nimbo. If something slips out, you can delete that message or the conversation at any time (section 13.2).
• Memory is separate. By default, Nimbo does not remember health information. It only does if you turn on "Remember sensitive topics", and only health and special educational needs. It never stores religion, beliefs, sexual orientation, racial or ethnic origin or trade union membership, yours or your children's.
• Your children's information. If your child is under 14, you give consent as their parent or guardian. If they are 14 or over, your consent is not enough: that information is theirs. Please don't tell Nimbo about their health or put it in their note; Nimbo can still give you general ideas without knowing their case. It is the same rule in every country where Drimmlies is available. If there is a serious risk, Nimbo always shows you help resources (section 7.7).
• You can withdraw consent at any time in Settings › Privacy › Sensitive topics. If you do, we stop processing these topics and delete what Nimbo remembered about them and what we kept about them in your history. Please also check your private notes: you can delete anything you want, and your conversations at any time.
• Like all your data, it is encrypted at rest, and we keep it out of our technical logs.

6.5 What does Drimmlies know about you? (for your children)

You can show this text to your children:

Hi. Your mum, dad or guardian uses Drimmlies, an app by Drimmly AI Ltd that helps them organise family life and schoolwork. They have written down your first name (no surname), your age, your school year and your exams. They may also have written a note about you or talked about you with Nimbo, an artificial intelligence that remembers some things (for example, the date of an exam). They can see it and delete it. We don't have photos of you, your address, your school or your phone number. We only use this information to help them help you. We don't send you ads and we don't give your information to anyone so they can. If you want to see what's there, change it or have it deleted, ask them or email us at [email protected]. If the law in your country says you can't ask on your own yet, we'll explain how your parent or guardian can do it. If you live in the US and you're under 13, ask your parent or guardian to contact us for you.

If you're 14 or over, your parent may want to send you reminders by email (for example, "Tomorrow: school trip form"). They'll send you a link, or you'll get a single email from us on their behalf, so you can say whether you want them; if you don't turn them on within 7 days, the link expires and we keep nothing (if they gave us your email, we delete it). Each reminder has two buttons, "OK 👍" and "Another time". If you tap a button, your parent will see your answer, not whether you opened the email. We don't measure whether you open emails. If you reply to the email, your reply reaches your parent too. At most 3 a day, between 8 am and 8 pm. We use your email address to help your family stay organised (legitimate interests). We keep it while you get reminders, only for this, and we never send you ads. They may also invite you to link your drimmly.com account with theirs; it's your choice.

You can say no at any time. Tap "No, thanks" or, later, "Stop these reminders" in any email. Your parent will know you've turned them off, but nobody, not even your parent, can turn them back on for you.

You can see, correct or delete your information. If something doesn't feel right, you can email us at [email protected] or complain to the data protection authority in your country.

6.6 Who exercises your children's rights

• In the UK: a child can exercise their own rights at any age if they are mature enough to understand them (in Scotland this is presumed from 12), and we then deal with them directly. A parent can act for them only with their authorisation or where it is clearly in their best interests. If the child is not mature enough, parents do it for them.
• In Spain: parents or guardians exercise the rights of children under 14 (Article 12.6 LOPDGDD). From 14, the child can ask us themselves to see, correct or delete their data, or object to its use. They can do this from their drimmly.com account, if they have one, or at [email protected].
• Elsewhere: as the law of each country provides.
• Reminders: whatever their age, your child can stop the reminders with one click in any email. That is their own right to object, and a parent cannot undo it. We tell you.
• If a child and their parents disagree (for example, the child wants their profile deleted and the parents do not): if your child is 14 or over (in the UK, if they are mature enough to decide), we answer them and their decision carries more weight, unless there is a compelling reason linked to their own best interests. We reply within one month at most.

6.7 Inviting your child to drimmly.com

• Who and where: you can invite your son or daughter aged 14 or over to link their own drimmly.com account to yours. The invitation exists in the countries where the Family plan is sold: the UK, Spain, France, Belgium, Luxembourg, Austria, Ireland, Sweden, Denmark and Finland. It is not available in the United States. We do not invite children under 14, and an unknown age does not count as 14 or over.
• How it reaches them: you can send them the link yourself from your phone (WhatsApp, Messages, Mail or the share sheet) or ask us to email them on your behalf. If you do, you give us their email address, see the message before it's sent and confirm it. We write to them once, with no advertising, as "your name (via Drimmlies)", with the information about their data, "No, thanks" and one-click unsubscribe; if they don't reply within 7 days, we delete their email address. We never message them by WhatsApp or SMS: only you can, from your phone. You can try again at most three times in total, and no more than once a month. We never keep their phone number.
• What you give us: their age range and the country where they live, which we pass to drimmly.com so it applies their country's rule, and their email only if you ask us to write to them. We never sign them up to marketing, neither when you invite them nor when they accept.
• When you invite them, you confirm that you are their parent or legal guardian and that their age is correct. We keep your authorisation with its version and date.
• Who consents depends on your child's country. The minimum age is the same everywhere: 14. What is needed for their Pro is based on the contract, with your authorisation; this table says who consents to optional features (for example, memory or voice):

You can only invite a child who lives in one of these countries. If your child confirms a different country, we apply the stricter rule of the two; if it's a country outside the table, we can't link you. If we only know that your child is 14 or 15, in countries where the age is 15 we treat them as 14 (you consent; in France, you and your child together).

• Your child decides: even where your consent is the basis in their country, your child accepts the invitation on drimmly.com, with their own account, after reading what you will see. Their account and their conversations are governed by the drimmly.com privacy policy (drimmly.com/privacy), which also names the AI providers drimmly.com uses for students. Recordings of minors are never used to create or train voices.
• The Family plan comes after: you can only buy the Family plan for a child who is already linked, with their age checked.
• If they accept:
  • in your drimmly.com dashboard you'll see their progress and their goals. If a safety alert is triggered in their chat, we'll let you know, with an excerpt of what triggered it only if your child has allowed it. Your child will know this before accepting and will see an icon while you're linked;
  • you can send them email reminders (section 6.11). You'll see their reply if they tap a button, not whether they open the email;
  • if we detect a serious risk to their safety, we will send you a generic notification ("Important notice about your family. Open it in Drimmlies.") and, inside, a safety alert with help resources and, if your child has allowed it, an excerpt of what triggered it. If they haven't, the link and their Pro carry on as before and you get only the general alert. We never alert you if the risk comes from within the family, or about their sexual orientation or private life where there is no risk. Your child knows from the start which alerts exist and when they are sent, and can see on drimmly.com the ones that were sent.
• Either of you can unlink at any time, from Family or from drimmly.com. Your child can do it on their own, without asking you; we'll let you know. If they unlink, their Pro continues until the end of the paid period.

6.8 If a child uses your phone

Drimmlies is for adults only: please don't let your children talk to your Drimmly or use the camera on your behalf.

6.9 Drimmlies is not for children

We do not offer Drimmlies to anyone under 18 and we do not knowingly collect data directly from children through the app. drimmly.com student accounts cannot sign in to Drimmlies. We use the app store's age signal where there is one: if it says the account belongs to someone under 18, the account isn't created. We only keep "adult: yes or no".

One exception, outside the app: if you ask us to email your child aged 14 or over your invitation, we keep their email for 7 days at most if they don't reply; and if they accept your email reminders, we keep their "yes", the reply they tap ("OK 👍" or "Another time"), the reply they write to the email (which we forward to you) and their unsubscribe if they ask for it (section 6.11). We never knowingly write to children under 14: if we learn an email address belongs to a child under 14, we stop writing to it and delete it.

If you believe a child has created an account, or that a child under 14 has given us personal information, email [email protected] and we will delete it.

6.10 Families with two parents

• If you invite the other parent and they accept, you will both see the same children's profiles and the class circle.
• Your conversations with Nimbo are yours: the other parent cannot see them.
• Either parent can correct or delete a child's profile. If you disagree, we don't decide who is right: in the meantime we restrict the disputed data (we hide it or pause the reminders), without deleting it unless you both ask, and the law provides for a court to settle the disagreement.
• If there is a court or administrative order limiting contact or access to their information, send it to [email protected]: after checking that it is genuine and in force, we apply it within 72 hours and unlink that parent from the child's profile and reminders. We tell that parent that we have applied it, without giving them any information about you or your child.

6.11 Email reminders to your child

If you want, Drimmlies can email your child aged 14 or over the reminders you schedule (for example, "Tomorrow: school trip form"). This is how it works:

We apply the UK Children's Code (Age Appropriate Design Code) standards to these emails and to the reply page for every child, wherever they live.

7. Nimbo and artificial intelligence

7.1 Nimbo is AI

Nimbo (or Brisa, Cielo or Lumi, depending on the character you choose) is an artificial intelligence system, not a person. We tell you so at the start, and an "AI" label is always shown next to its name. In voice mode it says so at the start of each session ("I'm Nimbo, an AI, not a person") and reminds you every 3 hours of conversation. Nimbo is designed to always tell you it is an AI if you ask.

Nimbo can make mistakes. It is not a doctor, psychologist, lawyer, financial adviser or teacher and does not replace a professional. Check anything important.

7.2 What we send to AI providers, and to whom

To answer you, we send our AI providers, only at the moment of answering:

• what you type or say to Nimbo;
• the photos you show it, after your phone has removed location and other metadata;
• the context you have entered and Nimbo needs: your children's first names, ages, school systems, school years and exams, your tasks and reminders, the private note and what Nimbo's memory holds;
• what you share with Nimbo from other apps, to pick out dates, amounts and materials (section 5);
• for the emails Nimbo helps you write, the draft and the recipient's name;
• if you have connected Google and ask Nimbo for it: the events Nimbo created in your "Drimmly · Family" calendar and the email it drafts for you (section 7 bis). Your free or busy times never go to the AI.

Reminders to your child do not use AI: they are fixed templates, and your note is checked with a word filter, without generative AI. We do not send your or your children's surnames, dates of birth, your children's email, your email, your location or your account identifier.

Both act as our processors: they may only use your data to provide their service to us and for the limited security purposes their contract allows (Article 28). They are Drimmlies' only AI providers. If we ever add another AI provider, we will tell you and ask for your permission again before sending it anything.

7.3 Voice

• We only record while the microphone is on, and you turn it on (by holding it, or with one tap to start and another to stop). There is no wake word.
• While you speak, the live text you see on screen is produced by Apple's speech recognition on your own phone: Apple does not receive the audio.
• When you finish, the audio travels encrypted to our server in the EU and to Google (Gemini, in the EU), which turns it into text. It is processed in memory. We do not keep it; what Google may keep is explained in section 7.2. We keep only the text, as part of the conversation, for the period you have chosen.
• We do not use your voice to identify you, to estimate your age or to create a voice model.
• Nimbo's voice is synthetic, created with AI (ElevenLabs), and does not imitate any real person.
• If someone speaks nearby while you record (for example, a child), their voice may be picked up. We treat it the same way (we don't keep it), on the basis of our legitimate interest in providing the service. Try to record without other people nearby, and please avoid sharing other people's health details.

7.4 Camera

• Before a photo is sent, your phone removes location and other metadata. On our server we remove metadata again, as a second safeguard. Try to keep faces out of the picture.
• The photo travels encrypted and is only processed in memory, on our EU server and at Google (EU). We do not keep it: it is discarded as soon as Nimbo answers (what Google may keep is in section 7.2).
• We keep only the derived facts (subject, level, school system and topic).
• We tell the AI not to describe people or faces and not to extract names.
• To choose photos from your library we use Apple's picker: we cannot access your other photos.
• Try to keep people, ID documents and health information out of the picture. If someone appears, we treat their image the same way (we don't keep it), on the basis of our legitimate interest in providing the service. Please avoid sharing other people's health details.

7.5 Nimbo's memory and AI traces

• Nimbo remembers some facts to help you better (for example, "Pablo's maths exam on 14 November"). You can see and delete what it remembers in Settings › Privacy › Nimbo's memory.
• You can also choose not to keep a history: Nimbo will answer without remembering previous conversations.
• The traces you see (what Nimbo is doing) show real steps. They do not show internal instructions or other users' data.

7.6 Who can read your conversations

Our staff do not read your conversations unless:

• you ask us to (for example, to solve a problem);
• it is necessary to investigate abuse or a safety risk that has been reported to us; or
• the law requires it.

In those cases, only the fewest possible people have access. We do not use your conversations to train AI models, and Google can't do so under its contract. If we ever wanted to, we would first ask for your express consent, separately.

7.7 Content safety and crisis support

• We use automated filters to help reduce harmful content in Nimbo's answers, and a simple word filter on the note you add to a reminder for your child. No filter is perfect: if you see something inappropriate, tell us at [email protected] or in Settings › Help.
• If a conversation shows a risk to you or to someone else (for example, suicide, self-harm, eating disorders, abuse or violence towards others), Nimbo stops the normal conversation and shows help resources for your device's region: the emergency number and the national helpline we have checked. If we don't know your region, we show 112, 999 and 911 and a link to findahelpline.com. In the countries where Drimmlies is available:

• If someone in our team learns of signs of violence against a child, or of child sexual abuse material on Drimmlies, we report it to the authorities. In some countries, such as Spain, France, the UK and the US, the law requires us to. Nimbo does not read your conversations looking for such signs.
• You can report an answer from Nimbo from within the conversation.
• This section 7.7 is our crisis protocol.
• We keep no more data than necessary for these measures: the count of times help resources are shown is anonymous (date, country and, in the US, approximate state, without keeping your IP address).
• Nimbo is not an emergency service. Companion chatbots may not be suitable for some minors.

7.8 Marking of AI-generated content

Drimmlies complies with Article 50 of the EU AI Act from the day it launches. Because of Nimbo's voice, we also treat ourselves as a provider covered by California's AI Transparency Act. So:

• each answer from Nimbo is stored with a technical mark showing it was generated by AI, and the texts you export carry that mark in their metadata;
• the emails Nimbo helps you write and you send from your Gmail carry a mark in their technical data showing they were written with AI. If you want to check whether a text or an email was generated by Nimbo, email us at [email protected] and we will confirm it;
• the audio of Nimbo's voice can only be heard inside the app: it can't be saved, downloaded or shared;
• reminders to your child are not AI text: they are fixed Drimmlies templates with the task you write (section 6.11);
• in live voice, Nimbo tells you at the start of each session that it is an AI (section 7.1).

We do not remove marks added by our providers.

7.9 What we don't do with AI

• We do not recognise faces or create voiceprints (biometric data).
• We do not infer your age from your voice or face, and we do not infer your emotions or anyone else's from voice or face.
• We do not use your data for advertising by other companies.
• Nimbo does not pressure you to buy or to stay.
• We do not infer your mood, stress or health to decide when to notify you or what to offer you.

7 bis. Google data (Calendar and Gmail)

If you connect your Google account, Drimmlies uses its own access with these permissions and no others:

Limited Use. Drimmlies' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we only use this data for the features you see in the app and ask for;
• we don't use it for advertising, we don't use it to create, train or improve AI models, and we don't sell it;
• no one reads it, unless you ask us to in order to solve a problem, it is needed for security or the law requires it;
• we only transfer it to others when needed to provide those features (to our processors, the minimum), for security, to comply with the law or in a sale of the company, and always on the same terms. To answer you, Nimbo may send Google Gemini (Google Cloud, EU) the events it created and the email it drafts, under a contract that prohibits training on them (section 7.2). Your free or busy times never go to the AI. We never pass Google data to analytics tools, RevenueCat, Mailgun or any marketing tool.

Disconnect: in Settings › Connectors, or in your Google account (Security › Third-party connections). When you disconnect, withdraw the AI permission or delete your account, we revoke access and delete the tokens. What is already in your Google Calendar or your Gmail stays in your Google account.

8. Automated decisions

• We do not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you (Article 22 EU GDPR; Articles 22A to 22D UK GDPR).
• Nimbo suggests ideas, tasks and reminders: you decide.
• The word filter on the note you add to a reminder for your child may block an inappropriate note. If you think it got it wrong, you can rephrase it or email us and a person will review it.
• We do not personalise prices with your personal data or using automated decisions, and we never set prices or offers based on how likely you are to leave. We don't run price experiments or segment by data about your family. In each country, the price is the same for everyone.
• "Notifications that fit you" only chooses the time of your notifications. It decides nothing else, has no legal or similarly significant effect on you, and you can object with one tap (section 16).

9. Who we share data with

1. Providers that work for us (processors). They only process data to provide their service to us, under a contract that meets Article 28 GDPR, and for the limited security purposes that contract allows. Each of them is contractually bound to give your data the same or equal protection as described in this policy.

If you would like the list with the data each provider receives, its location, the transfer mechanism and its contract, ask us at [email protected]. We will tell you before adding a provider that significantly changes how we process your data.

1. Apple and Google as independent controllers. When you sign in with Apple (Sign in with Apple) or Google, pay in the App Store or receive notifications on an iPhone (Apple Push Notification service), they process your data on their own account and under their own policies. Apple charges your subscription and top-ups and decides on refunds: we don't see your card. If you connect Google Calendar or Gmail, Google holds your calendar and your emails under its own policy (section 7 bis).

1. People you choose:
   • the other parent, if you invite them and they accept (section 6.10);
   • your child, aged 14 or over, who receives your invitation by email on your behalf, if you ask us to, and the reminders you schedule if they turn them on (section 6.11) and, if you link your accounts, sees on drimmly.com what you share with them;
   • drimmly.com, which receives your child's age range and country to link your accounts (section 6.7);
   • the people you email from your Gmail with Nimbo's help;
   • the families in your class circle, who see your family's display name and the dates you share.

1. Authorities, when the law requires it or when it is necessary to protect someone in danger, for example if there are signs of violence against a child (section 7.7).

1. If the company changes hands (merger or sale), your data would pass to the new controller, who would remain bound by this policy. We would tell you beforehand.

We do not sell your data, share it with advertising networks or data brokers, or track you across other apps or websites.

10. International transfers

• United Kingdom. Drimmly AI Ltd is in the UK. We apply the EU GDPR to the data of our users in the EU. When you give us your data directly, there is no "transfer" in the legal sense; in addition, the European Commission recognises that the UK protects personal data adequately, and the UK recognises the European Economic Area as adequate, so data can also flow from us to providers in the EU.
• Within Europe where we can:
  • Google's AI (Gemini) runs in the European Union;
  • our servers (Render) and our database (Neon) are in Frankfurt, Germany;
  • emails (Mailgun) and error reports (Sentry) are processed in each provider's EU region.

Even so, some US-based providers may access data held in the EU for support or to run their infrastructure: Cloudflare, Google (Google Cloud and Google Workspace), Neon (and its sub-processor Grafana Labs), Mailgun (support from the US), Sentry (organisation accounts and metadata) and Render.

• United States. ElevenLabs (Eleven Labs Inc.) and RevenueCat process data in the US, and the providers above may access it from there. For each one we use one of these safeguards:
  • the EU-US Data Privacy Framework and its UK Extension, where the provider is certified; or
  • the European Commission's standard contractual clauses (Decision (EU) 2021/914) for EU users and, for the UK, the International Data Transfer Agreement or the UK Addendum, with a transfer risk assessment and any supplementary measures it requires. RevenueCat is not certified under the Data Privacy Framework: with it we use the standard contractual clauses, with the UK Addendum and a transfer risk assessment, and we only give it an opaque internal identifier, never your email or name.
• You can ask us for a copy of these safeguards at [email protected].

11. How long we keep data

The retention period for each type of data is in the table in section 5. In addition:

• Conversations with Nimbo: 12 months by default, on a rolling basis (you can choose 3 or 6 months, no history, or delete them sooner). It is the same period in this policy, in the Terms and in the app. Anything about health, 6 months at most.
• Reminders to your child: their email, while reminders are active (and deleted with their profile or your account); if they don't turn the reminders on within 7 days, the link expires and we keep nothing (if you gave us their email to invite them, we delete it); the text of each reminder, 30 days; its status and reply, 90 days; after an unsubscribe, only an encoded fingerprint of their email on the suppression list.
• How you use the service and "Notifications that fit you": events, 35 days; daily summary, 90 days; time slots, latest value only, deleted as soon as you object.
• Google: tokens until you disconnect; we keep no copies of your calendar or emails.
• If you delete your account, we delete your data from our systems, including our backups, within 30 days at most, and ask each provider to delete what it holds (for example, your customer record at RevenueCat, the history at ElevenLabs and your contact at Mailgun). In our providers' backups and security logs it can take longer (for example, up to 30 days at ElevenLabs; Mailgun keeps security logs for at least a year), and during that time the data is not used.
• If you create your Drimmlies account and don't subscribe or buy credits, we keep your Drimmlies data for 30 days after your trial or your welcome week ends, in case you come back, and email you before deleting it. Your drimmly.com account is not deleted.
• Inactive accounts: if you don't use Drimmlies or drimmly.com for 24 months, we will email you and, if you don't reply within 30 days, delete your Drimmlies data. Your drimmly.com account is governed by the drimmly.com privacy policy. If you have purchased credits, we keep only your balance and your purchases.
• Children who turn 18: we will ask you to review their profile; if you don't confirm it, we will delete it. If they receive reminders, we will ask them whether they want to continue.
• Restricted data: some data must be kept by law after deletion (for example, Drimmlies billing records, proof of your consents, of mandatory notices or of what we showed you when you subscribed, for 6 years after the contract ends or the account is closed). We keep it restricted, without using it for anything else, only to comply with the law or defend legal claims, and delete it when the period ends. drimmly.com billing records are kept as the drimmly.com privacy policy says.
• Families left without a parent: deleted after 24 hours, with all their content.
• Email sign-in codes and temporary links: 1 day. Closed sessions: 30 days. Log of deleted accounts (hashed, to prevent abuse): 90 days.

12. Security

We apply technical and organisational measures appropriate to the risk (Article 32), including encryption of your data in transit and at rest, access limited to the people who need it, and technical logs that don't contain the content of your conversations, photos or audio.

If a security breach affects your data, we will notify the competent authorities (the UK Information Commission and, in the EU, the relevant authority or authorities) without undue delay and, where feasible, within 72 hours. If there is a high risk to you, we will also tell you without undue delay.

13. Your rights and how to use them

13.1 Your rights

You have the right to:

• access your data and get a copy;
• rectify inaccurate data;
• erase it (the "right to be forgotten");
• restrict its processing;
• object to processing based on legitimate interests and, always, to direct marketing;
• data portability: receive it in a machine-readable format;
• withdraw your consent at any time, without affecting what we did before;
• not be subject to automated decisions with legal effects (section 8).

13.2 In the app (the quickest way)

In Settings › Privacy › Your data you can:

• download your data (in a readable format and in JSON): account, profile, children, tasks, reminders to your children and their replies, conversations, Nimbo's memory, consents, credits and top-ups, and invitations;
• see what Nimbo knows about you (section 16) and change it;
• correct your profile and your children's;
• delete a message, a conversation, your whole history, Nimbo's memory, a child (with their email) or the family;
• switch off history, the AI permission, sensitive topics, reminders to a child and marketing communications, and object to "Notifications that fit you" and to the analytics worked out on our server (also in Settings › Notifications);
• disconnect Google Calendar and Gmail;
• leave a class circle;
• make a privacy complaint (section 14).

13.3 Deleting your account

• In the app: Settings › Account › Delete account. If your device has Face ID, Touch ID or a passcode turned on, we will ask for it to confirm it's you.
• Without the app: at drimmlies.com/delete-account, or by emailing [email protected] from your account's email address.
• Before you delete, we offer you "Download my data" (a zip file with everything), without making you do it. You can delete your account at any time, even with an active subscription, and delete it now or schedule the deletion for the end of your paid period.
• What is deleted: your account, your profile, your children's profiles (if there is no other parent in the family), your conversations and Nimbo's memory, your tasks, your children's emails and the reminders sent to them, your circle dates, your plan credits and earned credits, your level and your stickers, and what we worked out for "Notifications that fit you". We also revoke your Sign in with Apple access and your Google connection, and ask our providers (RevenueCat, ElevenLabs and Mailgun) to delete what they hold (section 11).
• Unused purchased credits: before you delete, we tell you how many you have and offer you two options: "Delete only my Drimmlies data", which keeps your account and your balance, or asking Apple to refund those top-ups (we open the request for you). If the law of your country gives you a right to the value of unused purchased credits, you don't lose that right by deleting your account.
• Important: your drimmly.com account is deleted too, because it is the same account. We will remind you before you confirm. If you'd rather keep your drimmly.com account, you can choose "Delete only my Drimmlies data". If you pay for Drimmly Pro by card on drimmly.com, we stop its renewal when your account is deleted: your own Pro ends with your account, and a child's Pro continues until the end of the period already paid.
• Your children's drimmly.com accounts are not deleted, because they belong to them. They will no longer be linked to you, and we will let them know.
• Your Apple subscription is not cancelled automatically: Apple charges it. If you have an active subscription, during deletion we show you a step to manage it ("Manage subscription"), which does not block deletion, and afterwards we email you the steps to cancel it. You can also cancel it in iPhone Settings › your name › Subscriptions or in Drimmlies › Settings › Subscription › Manage subscription.
• How long it takes: at most 30 days, including our backups. We will confirm by email when it is done and tell you what data we keep restricted because the law requires it (section 11).

13.4 By email or post

Email [email protected] or write to Drimmly AI Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. You can also contact our data protection officer ([email protected]) and, if you are in the EU, our EU representative (section 2). Your child can ask us the same about their own data, from 14 in Spain or as the law of their country allows (section 6.6).

13.5 Time limits, cost and verification

• We reply within one month. For complex requests we can extend this by two more months, and we will tell you within the first month. In the UK, the time limit may be paused while we wait for clarification we genuinely need.
• It is free, except for clearly unfounded or excessive requests.
• To protect your data, we check that it is you in a proportionate way (usually through your app session). If you act for someone else (for example, a child under 14 in Spain), we will ask you to show that you can. We will never ask for your password.

13.6 If a user dies

Their heirs or people linked to them may ask us to access, rectify or delete their data, unless the person forbade it (in Spain, Articles 3 and 96 LOPDGDD). If you live in France, you can also give us instructions about what should happen to your data after your death (Article 85 of the Loi Informatique et Libertés). Email [email protected].

14. Complaints

1. Contact us first. You can complain about how we handle your data in Settings › Privacy › Make a complaint (form) or at [email protected]. We confirm that we have received it and reply within 15 days at most, telling you the outcome. If we don't resolve it, we will tell you in writing which authority you can go to.
2. You can also complain to a data protection authority at any time (and so can your child, about their own data):
   • United Kingdom: the Information Commission, which replaced the Information Commissioner's Office on 30 September 2026 and still uses the name "ICO": ico.org.uk/make-a-complaint.
   • European Union: the data protection authority of the country where you live, where you work or where the alleged infringement took place. In the countries where Drimmlies is available:
     • Spain: Agencia Española de Protección de Datos (AEPD), aepd.es, electronic office sedeaepd.gob.es;
     • France: Commission nationale de l'informatique et des libertés (CNIL), cnil.fr/fr/plaintes;
     • Belgium: Data Protection Authority, dataprotectionauthority.be;
     • Luxembourg: Commission nationale pour la protection des données (CNPD), cnpd.public.lu;
     • Austria: Datenschutzbehörde, dsb.gv.at;
     • Ireland: Data Protection Commission, dataprotection.ie;
     • Sweden: Integritetsskyddsmyndigheten (IMY), imy.se;
     • Denmark: Datatilsynet, datatilsynet.dk;
     • Finland: Office of the Data Protection Ombudsman, tietosuoja.fi.

Full list of EU and EEA authorities: edpb.europa.eu.

• United States: the Federal Trade Commission (reportfraud.ftc.gov) or your state attorney general.

15. Notices for US residents

Drimmlies is available on the US App Store, and drimmly.com is already used from the US. In the US we sell the parent plan (Parent Plus) and credit top-ups; the Family plan and inviting your child to drimmly.com are not available in the United States.

• We do not sell or share your personal information, including for cross-context behavioral advertising ("sale" or "sharing" under California and other state laws). We do not engage in targeted advertising or in profiling that produces legal or similarly significant effects.
• We do not personalise prices with your personal data, and we never set prices or offers based on how likely you are to leave. In each country, the price is the same for everyone (section 8).
• Global Privacy Control and Do Not Track: we treat a Global Privacy Control signal as a valid request not to sell or share your personal information. Because we don't sell or share it, there is nothing further to switch off. Drimmlies does not track you across other websites or apps and does not allow third parties to do so on our service, so a Do Not Track signal changes nothing.
• AI companions (California, New York and other states): Nimbo is AI (section 7.1). Our crisis protocol is in section 7.7. Companion chatbots may not be suitable for some minors. Nimbo is designed not to ask you about your emotions unless you have asked it to. We follow the California and New York rules for companion chatbots in every country: Nimbo reminds you it is an AI at the start and every 3 hours of conversation.
• Categories of data and recipients: those in sections 4 and 9. Sources: you, your use of the app, Apple or Google, Google Calendar and Gmail if you connect them, your child if they reply to a reminder, and drimmly.com (section 4.3).
• Reviewing, correcting and deleting your data: as explained in section 13. We do not currently meet the thresholds of the California Consumer Privacy Act (CCPA), but we will honour these requests anyway. If you live in a state with its own privacy law and disagree with our response, you can appeal by emailing [email protected] with the subject "Appeal"; we will respond within the time your state requires.
• Children (COPPA): Drimmlies is not directed to children, and we do not knowingly collect personal information from children under 13 through Drimmlies. Your children's profiles are created by you, an adult (section 6). We never knowingly write to children under 14: if we learn an email address belongs to a child under 14, we stop writing to it and delete it. If you tell us your child is under 14, they can't turn the reminders on.
• Teens (New York, Colorado and other states): if your child aged 14 to 17 receives your reminders, we ask them first, on the activation page, where "No, thanks" comes first and we tell them that saying no doesn't affect anything. They can say no, and unsubscribe with one click at any time.
• Biometric data (Illinois, Texas, Colorado and other states): we do not create voiceprints or face templates and do not use your voice or image to identify you or estimate your age. We do not keep audio or photos (section 7). Don't send photos or audio of other people without their permission, and try to keep faces out of the picture. Before you first use voice or the camera in the US, we ask for your written authorisation, which names Google as the recipient of your voice and photos (ElevenLabs only receives the text of the answers).
• Our retention policy for recordings and images: we process your voice and photos only to answer you (turning your voice into text and understanding the photo); we delete them once we've answered and never keep them; Google may keep them for up to 24 hours in its temporary cache and, if its abuse filters flag them, for up to 90 days (section 7.2); ElevenLabs never receives your voice or photos, only the text of Nimbo's answers. If there is a security incident, we follow section 12. You can ask us to delete your data at any time (section 13).
• Consumer health data (Washington, Nevada and other states): before we collect health information we ask for your explicit consent (section 6.4) and, separately, for consent to share it with our AI providers. Without them, please don't share health information with Nimbo. Those consents don't cover the health of your children aged 14 or over. The health data we process, why, where it comes from, who receives it and your rights are explained in sections 4, 5, 6.4, 9 and 13. We never sell this data.
• Age signals from your app store: in every US state, we ask Apple for your age range when you first open the app, every time you sign in and when Apple tells us it has changed. We use it only to check that you are an adult, do not share it with anyone, delete it once the check is done, and keep only the result ("verified adult") and the date. If Apple tells us an account belongs to someone under 18, or that a parent has withdrawn consent, we block it.
• SMS: we don't send SMS. If we ever add them, we will ask for your prior express written consent for marketing, send them only between 8 am and 8 pm in your local time, and you will be able to stop them by replying STOP or by any other reasonable means.
• California (Shine the Light): we do not share personal information with third parties for their own direct marketing.
• Changes: we will notify you as explained in section 18. Effective date: the date shown at the top of this policy ("Last updated").

16. Cookies, SDKs and similar technologies

This section applies to Drimmlies (the app, its emails and drimmlies.com). drimmly.com's emails and website are governed by the drimmly.com privacy policy.

In the app, without consent (what is strictly necessary for the service you ask for):

• We use no advertising, no third-party analytics tools and no cross-app tracking. We don't use the advertising identifier (IDFA) or your device's fingerprint, and we don't share data with data brokers. That is why we don't show you Apple's tracking prompt (App Tracking Transparency): there is nothing to ask.
• We only store or read on your phone what is strictly necessary:
  • your sign-in session (in your phone's secure keychain);
  • your preferences (language, settings);
  • your notification token and whether notifications are allowed, if you turn them on;
  • your time zone, your quiet hours and the times of your reminders, so the notifications you ask for arrive at your time;
  • the RevenueCat software development kit (SDK), to manage your purchases, without the advertising identifier;
  • the Sign in with Apple and Google Sign-In SDKs, if you use them.
• These uses do not require your consent (in the UK, PECR regulation 6; in Spain, Article 22.2 of the LSSI; in France, Article 82 of the Loi Informatique et Libertés; elsewhere in the EU, the law implementing Article 5(3) of the ePrivacy Directive), but we tell you about them.
• We use no third-party diagnostics tools in the app. If you agree to share data with developers in your iPhone Settings, Apple gives us crash reports without your name. If we ever add a diagnostics tool, in the EU and the UK we will ask for your permission first.

"Notifications that fit you" (legitimate interests; you can object):

• It is on, the same in every country. We tell you the first time: "We choose when to send your notifications based on when you use the app. You can turn this off." You can object with one tap in Settings › Notifications or in Settings › Privacy › What Nimbo knows about you: it stops at once and we delete what we worked out.
• It only uses two things: the time of each request the app already makes to work (by our server's clock) and which notification you opened, deduced from the request the app makes to show it to you. We work it out on our server: we read nothing from your phone for this, there are no analytics tools in the app and the app sends nothing just to measure.
• We use it only to choose the time of the notifications you already get and for internal aggregate statistics. Never for prices, offers or advertising, or to decide whether to send you a notification, and we don't give it to anyone, including the AI. There are no credits or rewards for leaving it on.
• If you object, you get the same notifications at default times.
• Timing your notifications using your Google Calendar is a separate thing: it has its own switch, "Time my notifications using my calendar", in Settings › Connectors › Google, off by default (section 7 bis).
• Never, with or without it: your location, the name of your Wi-Fi, your Focus mode, your movement, your installed apps, your contacts, your iPhone calendar, your mood or health inferred, your children's signals, or prices or offers based on the risk that you cancel.

What Nimbo knows about you: in Settings › Privacy › What Nimbo knows about you you see, in plain words, what we use for your notifications: the service signals above and, in the block "How you use the app (worked out on our server, with no analytics tools on your iPhone)", your time slots and what we infer from them (for example, "you often open the app in the evening"), with a "Don't use this" button that stops using it and deletes what we worked out. You also see your children's contact details for the reminders (their email and its status), which Nimbo doesn't see, and you can delete them.

In Drimmlies emails: no open pixels and no click tracking. The reply buttons in the reminders to your child carry a code that only records the reply they choose (section 6.11).

Our own analytics, with no tools on your phone: we know which days and at what times you use the app from the requests it already makes to work, and we use this only to choose the time of your notifications and for internal statistics. You can object with one tap, and we delete what we worked out. If we ever measure anything on your phone itself, in the EU and the UK we will ask for your consent first. Advertising or advertising measurement, never.

On drimmlies.com: we use no advertising or analytics cookies. The website is hosted by Cloudflare, which may use strictly necessary cookies to keep it secure. The reminders activation page and the page where your child confirms their reply use no tracking cookies and load nothing from third parties.

17. Communications and notifications

One rule for every channel (push, email and the in-app inbox), the same in every country: a service message carries nothing commercial. If a message includes a price, a buy button, an offer or a promotion of a plan or of Drimmly Pro, it is marketing, and we only send it if you have said yes beforehand in that channel. Being a customer is not enough.

• Service messages (always sent, because they are part of the service or the law requires them), without offers: account security, receipts, your reminders, the end of your free trial (on day 5), for the annual plan a dedicated email 35 days and another 17 days before renewal, in Spain also at least 17 days before each monthly renewal, and notices of price or term changes (30 days before). They contain no advertising.
• "You're running low on credits" only informs you, for example: "You have 20% of your credits left. They renew on 3 Nov." with "Open my Box". There is no top-up button in the push, the email or the in-app inbox; top-ups are on the Box screen.
• News and offers: only if you opt in, separately in each channel:
  • push: the "News and offers" switch, off by default, which you can turn off in the app. Never as "Time Sensitive". No credits or missions for turning notifications on;
  • email: an unticked box and a confirmation email (double opt-in).
• "Nimbo's ideas" by push: only if you say yes when you turn notifications on (at most 1 a day).
• "Your week": if you ask for it, a summary of what you have coming up, by notification (you turn it off in Settings › Notifications) and by email only if you turn it on, with one-click unsubscribe.
• In-app cards: sometimes we show you on Home a summary of what Nimbo has done for you (for example, "4 reminders, 1 school circular"). They never include prices or offers, and you can remove them with one tap.
• "Notifications that fit you": on, and you can object with one tap (section 16).
• Unsubscribing: one click in every email (also with your email app's unsubscribe button), and by category in Settings › Notifications.
• Drimmlies never sends marketing to your children, by any channel, even if they ask for it. We only write to them if they're 14 or over: a single invitation email on your behalf, if you ask us to and confirm it, with no advertising; and, if they say yes to your reminders, the reminders (and, if they come through your link, the email confirming their address, which they request). They can unsubscribe with one click (section 6.11).
• Invitations: you send invitations to the other parent, to other families and to the circle yourself from your phone (WhatsApp, Messages, Mail or the share sheet). We do not read your contacts, keep the contact details of the people you invite, or write to them. In the EU, the link comes with a neutral text you can edit. In the UK and the US, the app doesn't suggest a text or ask you to invite anyone, and inviting earns no credits, whether you invite other families or the other parent. You can send your child's invitation the same way or ask us to send them a single email on your behalf, after you see the message and confirm it (sections 6.7 and 6.11); by WhatsApp or SMS, only you can write to them, from your phone.
• SMS and WhatsApp: we do not send them. If we ever add them, we will ask for your consent, send them only between 8 am and 8 pm in your local time, let you stop them by any reasonable means, and update this policy first. For your child, WhatsApp only if they turn it on themselves.

18. Changes to this policy

• If we make material changes, we will tell you in the app and by email at least 30 days before they apply, unless an urgent legal change prevents it.
• We will not use data we already hold in a materially different way (for example, to train AI models) unless you give us your express consent first, asked for separately. Continuing to use the app does not count as consent. We will never change this quietly.
• No app update or change to this policy will switch a privacy setting you've turned off (AI permission, memory, history, sensitive topics or notifications) back on without asking you first. The same applies to "Notifications that fit you" and your Google connection, and we will never turn back on the reminders of a child who has unsubscribed.
• We keep previous versions of this policy and will send you any of them if you ask at [email protected].

19. Language

This policy is available in English, Spanish and French. If the versions differ, the interpretation most favourable to you applies (the same rule as in our Terms). If you live in Spain and ask, we will provide this policy and our Terms in Catalan or Valencian, Galician or Basque within 30 days, and reply to you in writing in that language if you write to us in it.

---

Drimmly AI Ltd · Private limited company registered in England and Wales · Company number 16962658 · Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom · Privacy: [email protected] · Data protection officer: [email protected] · Support: [email protected] · Everything else: [email protected]