OYQALA Personal Data Processing Policy

1. Who processes the data

The OYQALA app and website belong to AITIZ LTD, Astana, Kazakhstan.

For any questions about data, contact us at +7 771 287 60 50 or aitiz.globall@gmail.com.

2. Who uses the app

OYQALA is a learning app for children aged approximately 8–13.

Children do not create their own accounts. A parent sets up access: they register at oyqala.kz, generate an invitation code and give it to their child. The child enters the code in the app, establishing the parent–child link.

This is how we obtain parental consent: the child has no access without the parent's action.

3. What data we collect

From the child:

- Age group — one of three: 8–10, 11–13 or 14+. We do not ask for an exact date of birth.

- Learning progress — completed tasks, experience points and stars earned, and the dates on which the child studied.

- Installation number — a random number the app creates on its first launch and stores on the device. It lets the parent see which devices the child uses and revoke access.

- Device type — only “iOS” or “Android”, without the model or serial number.

- Time of the last sign-in.

- The child's messages to the NOVA assistant and NOVA's replies — these are saved as a conversation so the parent can read them.

- Commands the child writes to the drone in game scenes — these go to our server so the model can interpret the phrase and return a result.

From the parent: email address and website account details, and subscription information.

4. What we do not collect

We do not ask for or store the child's first or last name, home address, school number, telephone number, photographs, social media links or location.

We do not use the device advertising identifier or IMEI, or access contacts, the calendar, microphone, camera or photo gallery.

The children's app has no advertising, advertising networks or third-party analytics systems.

There are no purchases in the child's app. The parent subscribes on the website.

5. Why we need this data

- Progress — so the child can continue where they left off.

- Installation number and device type — so the parent can see where the child signs in from and revoke access.

- Conversations with NOVA — so the assistant can remember the conversation and the parent can read it.

- Commands in scenes — so the model can interpret the phrase and explain the result to the child.

- Age group — to adjust the difficulty and tone of explanations.

We do not use children's data for advertising and do not sell it to anyone.

6. Who we share data with

Only the providers the app needs to operate:

Supabase — data storage and account sign-in; data shared: account, progress and conversations.

Vercel — website and server-side operation; data shared: requests from the app to the server.

Google (Gemini model) — NOVA replies and command interpretation; data shared: the text of the message or command.

The texts children write are sent to the model to obtain a reply. Our filter is applied before sending and after the reply returns: prohibited topics and any links, addresses and telephone numbers are removed or replaced.

We do not share children's data with anyone else — advertisers, data brokers or analytics companies.

Where the servers are physically located. The database and files are stored with Supabase in the Seoul region, Republic of Korea. The website's server-side services run on Vercel in the Washington region, USA. The model powering NOVA belongs to Google and processes messages on its servers.

This means children's data leaves Kazakhstan. We state this explicitly so parents know.

7. How long we keep data

- Progress and account — until data is deleted at the parent's direct request. Revoking access does not itself delete this data.

- Conversations with NOVA — 90 days, after which they are automatically deleted. Cleanup runs daily on a schedule in the database.

- Message usage records (how many messages were used in a day, needed for the daily limit) — 90 days, after which they are automatically deleted.

Revoking access and deleting data are different actions. When a parent revokes an access code, the child can no longer sign in to the app, but their progress and achievements are kept: the parent can restore access and the child can continue where they left off. Conversations with NOVA remain subject to their own 90-day retention period, as described above.

If a parent wants their child's data deleted, they write to us to request it. We delete the data within 30 days of receiving the request.

8. Parents' rights

In their account at oyqala.kz, a parent can:

- read their child's conversations with NOVA;

- see the devices their child uses to sign in;

- revoke the access code — the child will then be unable to sign in;

- request deletion of all their child's data — write to us and we will delete it within 30 days; revoking the code is not enough, an explicit request is required;

- obtain a copy of their child's data.

We respond to requests within 30 days.

9. Security

Data is transmitted over a secure connection. Only the child and their linked parent have access to the child's records — this is checked at the database level, not only in the app.

Only the server records NOVA assistant replies: the app cannot pass off another message as an assistant reply.

10. Reporting an assistant reply

If NOVA gives an inappropriate reply, there is a “report” button next to its message. We review these cases.

11. Changes

If we change this policy, we will update the date at the bottom of the page and notify the parent by email of significant changes.

12. Contact us

AITIZ LTD, Astana, Kazakhstan

Telephone: +7 771 287 60 50

Email: aitiz.globall@gmail.com

Effective date: 15 September 2026

In the event of any discrepancy, the Russian-language version shall prevail.