UK Privacy Policy
NODI Privacy Policy (United Kingdom)
Version 1.0, August 2026 · Applies to uk.nodi.kids, the NODI App and the NODI Flip for customers in the United Kingdom.
Part A: The essentials in one page
NODI is built so that we know as little about your family as possible.
- Your child never creates an account. Parents are the only account holders and the only contracting party. Child profiles (first name, optional photo) are created by you inside your account, based on your consent.
- Voice messages are private. They are encrypted in transit and at rest, delivered between approved contacts only, and deleted from our servers automatically after at most 30 days. We never listen to, analyse, transcribe or monetise voice content. Parents cannot listen to message content through the app either; playback happens only on the Flip.
- The Flip is not a surveillance device. The microphone records only while a message is actively being recorded, shown clearly on the display (“Recording…” with a waveform). There is no camera, no GPS, no always-on microphone and no covert listening capability.
- No advertising with your data, ever. We do not sell or share personal data, we do not profile children, and we show children no advertising.
- Maximum privacy by default. Every optional data use (product updates, marketing, app analytics) is off until you switch it on, and you can switch it off again at any time.
- Your data stays in the EU, hosted on EU infrastructure (the UK Government has recognised the EU as providing adequate protection). The few US providers we use are certified under the UK-US Data Bridge or bound by UK transfer safeguards.
Questions? help@nodi.kids. Full details below.
Part B: Full privacy policy
1. Who we are; our UK representative
Controller: NoDi GmbH, c/o Betahaus, Rudi-Dutschke-Straße 23, 10969 Berlin, Germany. Registered with the commercial register of the Amtsgericht Berlin-Charlottenburg, HRB 265239 B. Managing directors: Pascal Leonard Blum, Mathieu Caudal. Contact: help@nodi.kids. We have not appointed a Data Protection Officer; privacy matters are handled by the managing directors and can be raised at any time via help@nodi.kids.
UK representative (Article 27 UK GDPR):
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
- United Kingdom (UK)
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/18089695059
NoDi GmbH is registered with the ICO on tier 1 since 2026 and has been paying the ICO data protection fee.
2. Scope and definitions
This policy covers the uk.nodi.kids web shop, the NODI App (iOS/Android), the NODI Flip device (WiFi and WiFi + LTE) and related services for UK customers. “UK GDPR” means the retained EU General Data Protection Regulation as it forms part of UK law, together with the Data Protection Act 2018. Definitions of account types (parent account, guest account, child profile) follow our Terms and Conditions.
3. Our principles
We process personal data lawfully, fairly and transparently; we collect only what the service needs (data minimisation); we keep it only as long as needed (storage limitation); and we protect it with appropriate technical and organisational measures. We have designed the service in accordance with the ICO’s Age Appropriate Design Code (see Section 6). We never sell personal data and never use children’s data for advertising, profiling or any purpose beyond delivering the service.
4. Hosting and jurisdictions
Our backend runs on Google Cloud/Firebase with data residency in the European Union. The UK has granted adequacy to the EU/EEA, so data flowing from the UK to our EU infrastructure does not require additional safeguards. Server and access logs (IP address, timestamp, endpoint) are kept for security, stability and abuse prevention for, as a rule, 12 months (Article 6(1)(f) UK GDPR) and then deleted automatically.
5. Processing activities in detail
5.1 Website and shop (uk.nodi.kids)
Visiting the site: connection data (IP address, timestamps, requested pages) processed for delivery and security (Article 6(1)(f) UK GDPR); CDN and security by Cloudflare. Cookies and similar technologies: see Section 12 (PECR).
5.2 Account creation and login (NODI App)
Data: email address, display name, role (parent/guest), language; login is passwordless (email sign-in link or Apple/Google Sign-In). At every login attempt with your email address we send the sign-in link only to that address, so no login is possible without access to your mailbox, and you are simultaneously informed of every login attempt. There are no NODI passwords and no factory default passwords. Legal basis: performance of a contract (Article 6(1)(b) UK GDPR). Retention: for the life of the account; immediate deletion on account deletion (no grace period); inactive accounts are deleted after 24 months of inactivity (warning email plus 30 days).
5.3 Child profiles
Data: first name, optional photo, chosen by you. No date of birth, no location, no biometric analysis. Created by the parent inside the parent account on the basis of your consent (Article 6(1)(a) UK GDPR); the child has no account. When creating the profile you confirm via the “Confirm” button, with the consent text displayed directly beneath it, that you are the child’s parent or legal guardian and consent to NODI processing the child’s data to provide the service in accordance with this policy. You can withdraw consent at any time by deleting the profile; all of the child’s data, including all voice messages, is then deleted immediately and permanently.
5.4 Voice messages
The full lifecycle: (1) Recording starts only through active navigation on the device (Voice messages → contact → record) or in the app; the microphone is never permanently active; there is no wake-word or ambient listening; during recording the display clearly shows “Recording…” with an animated waveform. The recording is stored encrypted on the device (OGG). (2) Transmission is TLS-encrypted to our servers. (3) Server storage is encrypted (AES-256) until delivery, for a maximum of 30 days from recording. (4) Deletion: an automatic job removes messages from the server after at most 30 days; if a sender’s access is revoked before delivery, undelivered messages are deleted immediately. (5) On the device: the receiving Flip keeps the last 50 messages encrypted until manually deleted or factory reset.
Transparency notes: transmission and storage are encrypted but not end-to-end encrypted; messages are technically decryptable inside our infrastructure, which we use solely for delivery. We do not listen to, analyse, transcribe or monetise voice messages. Our support has no access to message content. Technical access to stored audio is restricted to the managing directors and the CTO, occurs only in justified sensitive individual cases after your prior confirmation, and is recorded in an auditable access log. Parents cannot listen to message content via the app; the app shows metadata only (sender, timestamp, duration, delivery status); playback happens exclusively on the Flip. Legal basis: Article 6(1)(b) UK GDPR; for the child’s data, parental consent (Articles 6(1)(a) and 8 UK GDPR read with section 9 DPA 2018).
5.5 Device data, telemetry and WiFi credentials
Device telemetry (device ID, firmware version, connectivity status) is processed to operate and update the device (Article 6(1)(b)). Not collected: location data, ambient audio, battery level and WiFi signal strength (these are not transmitted to our servers). WiFi credentials: SSID and password are stored AES-encrypted on the device; only the SSID is stored in the cloud; the WiFi password never leaves the device; its transfer from your phone to the device during setup is encrypted, as is device provisioning itself. Crash logs you choose to share are evaluated only by us and are not passed to third parties. Telemetry is deleted when the device is removed from the app.
5.6 Spotify Connect
If you connect Spotify, we process only track/playlist IDs (encrypted preset link). Your Spotify credentials never reach us; authentication happens with Spotify directly.
5.7 Push notifications
Delivered via Apple (APNs) and Google (FCM); the notification text may contain the child’s first name. Legal basis: Article 6(1)(b).
5.8 Purchases, payment and delivery
Data: name, delivery/billing address, email, order data; payment data is processed directly by the payment providers (Shopify Payments, Stripe); we store no card data beyond the Stripe customer ID, order/subscription data and the last four digits for display. If you use our online withdrawal/cancellation form, we process the data you enter there to handle your cancellation. Recipients: Shopify, Stripe, Byrd and which carriers deliver in the UK. Retention: records required for tax and accounting are kept for the statutory periods (in Germany currently 8 years for accounting records and invoices, 10 years for books and annual accounts; corresponding UK records for HMRC purposes are kept for at least 6 years).
5.9 LTE data plan
Stripe subscription data; connectivity is provided by Giesecke+Devrient Mobile Security TCD Iberia, S.L. (eSIM, EU/Spain), which receives device identifiers and network data only, never your name or address.
5.10 Customer support
Data: name, email, order data, content of your enquiry. Platform: Gorgias (processing in the US and EU). Retention: 24 months after ticket closure; tickets touching children’s data: 6 months. Our support has no access to voice message content. AI assistance: to handle enquiries faster and more accurately we use AI tools from Anthropic (Claude); enquiry content is generally submitted pseudonymised, without full names or email addresses where these are not needed; processing serves solely to handle your enquiry and improve our response quality (Article 6(1)(f)); your data is not used to train AI models.
5.11 Marketing communications and review requests
Marketing emails (product updates, offers) are sent only with your consent (Article 6(1)(a) UK GDPR; regulation 22 PECR); the toggles are off by default and withdrawal is possible at any time via the unsubscribe link or the “Manage consents” page. Review requests: after a purchase we may email you asking for a product review (sent via Klaviyo). We rely on the PECR regulation 22(3) “soft opt-in”: we obtained your email address in the course of the sale, the message concerns our own similar products, and you were given a simple, free opportunity to refuse this use when we collected the address and are given it again in every email. You can opt out at any time.
5.12 App usage analytics (opt-in only)
Firebase Analytics for the NODI App, only with your consent (toggle off by default). Child profile data is never contained in analytics events. Retention: 14 months. Recipient: Google (Firebase Analytics, EU region).
6. Children’s data and the ICO Age Appropriate Design Code
NODI is a product for children that children never sign up to. UK law sets the age at which a child can consent to information society services themselves at 13 (section 9 DPA 2018); we do not rely on the child’s own consent at any age: the NODI Flip is designed for children aged 5 to 12, children never create accounts; parents are the sole account holders; the child’s data (first name, optional photo, voice messages, device data) is processed on the basis of parental consent; we apply data minimisation strictly; we do no profiling and show no advertising; communication is possible only with contacts approved by the parent, including child-to-child (Flip-to-Flip) messaging, which requires approval by the parents of both children via an invitation code created by one family and redeemed by the other, revocable by either family at any time.
How we conform to the 15 standards of the ICO Children’s Code:
| # | Standard | How NODI conforms |
|---|---|---|
| 1 | Best interests of the child | The service is designed around the child’s interest in safe, private communication with family: closed contact circle, no strangers, no content feed, no engagement mechanics. |
| 2 | Data protection impact assessments | A DPIA covering the child-data processing is maintained and available to the ICO via our UK representative. |
| 3 | Age appropriate application | The device is designed for ages 5–12; it requires no reading of policies by the child; all data-relevant choices sit with the parent. |
| 4 | Transparency | This policy is layered (Part A one-pager) and includes a child-friendly annex written to be read aloud to children. |
| 5 | Detrimental use of data | Children’s data is used solely for service delivery; never for advertising, profiling, engagement optimisation or sale. |
| 6 | Policies and community standards | We do what this policy says; declared behaviour is verified against actual device/app traffic in independent testing. |
| 7 | Default settings | Maximum privacy by default: every optional processing is off until the parent enables it. |
| 8 | Data minimisation | First name and optional photo are the only child profile data; no birth date, no school, no location. Voice messages auto-delete after at most 30 days. |
| 9 | Data sharing | No sharing beyond the processors needed to run the service (Section 7); no third party receives voice content; no data sales. |
| 10 | Geolocation | The Flip has no GPS and no location tracking. This standard is met by hardware design. |
| 11 | Parental controls | Parents manage contacts and profiles, but cannot covertly monitor: parents cannot listen to the child’s messages via the app, and any recording is clearly visible on the device. The child can additionally set a device PIN. |
| 12 | Profiling | None. No behavioural profiles of children, no automated decision-making. |
| 13 | Nudge techniques | None. No streaks, no engagement loops, no prompts to share more data. |
| 14 | Connected toys and devices | Recording is hardware-gated and visibly indicated on the device; no always-on microphone; encrypted transport and storage; signed OTA updates; security update commitment of at least five years; conformity with EN 18031 and the UK PSTI Act 2022. |
| 15 | Online tools | Parents exercise all data rights simply in-app (profile deletion, consent management); the child can always turn to the parent, and recording indicators give the child direct awareness. |
7. Recipients and processors
We use the processors listed below under Article 28 UK GDPR data processing agreements: Google Cloud/Firebase (backend, EU); Stripe (subscription billing, US); Shopify (shop, storage EU with ongoing US/Canada transfers); Klaviyo (email marketing and review requests, US); Gorgias (support, US/EU); Anthropic (AI support assistance, pseudonymised content, US); Spotify (track IDs only, EU); Cloudflare (CDN/security, global); Microsoft Clarity, Google Analytics 4, Meta Pixel, Google Ads, Tracklution, Klar Insights (website analytics/marketing, consent-gated only, see Section 12); Apple/Google (push delivery); Giesecke+Devrient Mobile Security TCD Iberia (LTE connectivity, device identifiers and network data only); byrd technologies (Warehouse & logistics management); Schutzwerk (security testing, DE). Apple App Store and Google Play process app-level information (installs, crashes, device model, OS version) as independent controllers; we share no in-app user data with the app stores. If you buy via Amazon, Amazon is independently responsible for the order; we become responsible only upon device registration in the app.
8. International transfers
Our primary data residency is the EU, covered by the UK’s adequacy regulations for the EEA. Transfers to US providers (Stripe, Klaviyo, Microsoft, Anthropic, Google Analytics processing, Meta) rely on the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) where the provider is certified, and otherwise on the ICO’s International Data Transfer Agreement (IDTA) or the EU SCCs with UK Addendum, with supplementary measures assessed where appropriate. Transfers to Canada (Shopify) rely on the UK adequacy regulations for Canada. You can request a copy of the safeguards via help@nodi.kids.
9. Retention at a glance
| Category | Period |
|---|---|
| Voice messages (server) | max. 30 days from recording, then automatic deletion |
| Voice messages (receiving device) | last 50 messages until manual deletion or factory reset |
| Child profile | immediate, permanent deletion when the profile or parent account is deleted |
| Parent/guest account | life of the account; immediate deletion on account deletion |
| Inactive accounts | deleted after 24 months of inactivity (warning email + 30 days) |
| Device telemetry | deleted when the device is removed from the app |
| Support tickets | 24 months after closure; 6 months where children’s data is involved |
| Order/invoice/subscription records | statutory retention periods (Germany: 8/10 years; UK tax records: at least 6 years) |
| Server/access logs | 12 months |
| Consent records | duration of processing plus limitation periods |
10. Your rights
You have the rights of access, rectification, erasure, restriction, data portability and objection (including an unconditional right to object to direct marketing), and the right not to be subject to solely automated decisions with legal effect (we make none). Rights relating to the child’s data are exercised by you as parent or guardian on the child’s behalf. Contact help@nodi.kids, or our UK representative (Section 1); we respond within one month. You can complain to the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113), though we would welcome the chance to resolve any concern first.
11. Withdrawing consent
Every optional consent can be withdrawn at any time under “Manage consents” in the account settings, with immediate effect and without affecting past processing. Consent to the child’s data processing is withdrawn by deleting the child profile (immediate, permanent deletion of all the child’s data).
12. Cookies and tracking on our website (PECR)
This section applies to uk.nodi.kids. The NODI App and the Flip contain no advertising or tracking cookies; app analytics is opt-in only (5.12). We use the consent tool Pandectes: non-essential cookies are set only with your consent (regulation 6 PECR); all non-essential categories are off by default; “Reject all” is as prominent as “Accept all”; you can change or withdraw your choice at any time via the persistent “Cookie settings” control in the footer. Categories: Strictly necessary (Shopify, Pandectes, Cloudflare bot protection, Google Tag Manager as tag loader); Functional (Gorgias chat); Analytics (Google Analytics 4, Microsoft Clarity, Shopify Analytics); Marketing (Meta Pixel, Google Ads, Klaviyo, Tracklution, Klar Insights). The complete, always current cookie table (names and lifetimes) is generated dynamically by Pandectes and available via “Cookie settings”. For bot protection, our platforms use Cloudflare Turnstile and hCaptcha (embedded by Shopify) and Google reCAPTCHA (embedded by our support provider’s contact form), processing technical connection data to distinguish humans from bots (Article 6(1)(f)). There are no child-directed pages on nodi.kids; our website addresses parents, and we deploy no tracking aimed at children.
13. Security
TLS for all transmissions; AES-256 encryption at rest for voice content; passwordless authentication without default passwords; signed and authenticated OTA firmware updates; remote wipe and factory reset; certification of the NODI Flip under the EN 18031 series and compliance with the UK Product Security and Telecommunications Infrastructure Act 2022; independent IT security assessment of device and app by Schutzwerk GmbH (April 2026); security updates guaranteed for at least five years from purchase; 72-hour breach notification processes. Report vulnerabilities to development@nodi.kids; see our Vulnerability Disclosure Policy (uk.nodi.kids/security and nodi.kids/.well-known/security.txt).
14. Provision of data; automated decisions; changes
Providing account and order data is necessary to contract; everything else is optional. We make no solely automated decisions with legal or similarly significant effects. We will notify you of material changes to this policy in advance by email and/or prominently in the app; the current version, with date and version number, is always available at uk.nodi.kids/privacy, printable and saveable.
Annex: NODI explained for children
This part is written for children. Parents: read it together, reading aloud is encouraged!
What happens to your voice messages? When you record a message on your NODI Flip, we send it, safely wrapped up, to the person it is meant for, like Mum, Dad, Grandma or Grandpa. Only people your parents have chosen can send you messages or hear yours.
Does NODI listen to your messages? No. We do not listen, we do not read along, and we never sell anything about you. After 30 days at the latest, our computers delete your messages from our servers automatically.
Is your Flip always listening? No. Your Flip records only while you are recording, and the display shows “Recording…” the whole time. There is no hidden microphone, no camera and no tracking.
What do we know about you? Very little: only what your parents typed in, your first name and, if they want, a picture. Your parents can delete that any time.
More questions? Ask your parents, and if you want to ask us something together, write to help@nodi.kids. We will be happy to answer.