Privacy policy
BookHero is a family reading app. Parents create the account and add their children. This policy explains what personal data we process, why, for how long and what rights you have. We’ve tried to keep it short and plain.
1. Who is responsible for your data
The data controller is Unimedia Technology S.L.U., Tax ID (NIF) B66934365, registered office at C/ Esteve Terradas, 1, 111A, Parc Mediterrani de la Tecnologia (PMT), 08860 Castelldefels (Barcelona), Spain. Contact: through our contact form or at info@unimedia.tech.
This policy covers the BookHero app for Android (and iOS once available) and the website book-hero.app.
2. Data we process
Parents (account holders). Email address and the login credentials you create, the family settings you choose (token rate, supervised or trusted mode, reading levels) and, if you subscribe, the status of your subscription. We never see your card details: payments are handled by Google Play.
Children. Only what a parent enters: a first name or nickname, birth year, an avatar and an optional PIN. Children don’t have an email address or an account of their own.
Reading activity. Books added (title and ISBN), session times and durations, page numbers, quiz answers, tokens earned and spent, streaks and screen time used.
Page photos. At the end of a session the child photographs the last page read. The photo is used to read the page number and to generate three quiz questions. It is discarded when the session ends and is not kept on the phone or in your account.
Technical data. Device model, operating system and app version, and crash reports when the app fails, so we can fix bugs.
Contact form. If you write to us through the contact form or by email: your name, email address, the topic you choose and your message.
Website. Apart from the contact form, book-hero.app doesn’t ask you for personal data. See our cookie policy.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your family account, reading sessions, quizzes, tokens and timers | Performance of the contract you accept when you sign up (art. 6.1.b) |
| Processing children’s profiles and reading activity | Consent of the parent or legal guardian who adds the child (arts. 6.1.a and 8 GDPR, art. 7 LOPDGDD) |
| Managing subscriptions | Performance of the contract (art. 6.1.b) |
| Crash reports, security and fraud prevention | Our legitimate interest in keeping the service working and safe (art. 6.1.f) |
| Answering your messages and contact form requests | Your consent when you send the form (art. 6.1.a) and our legitimate interest in answering (art. 6.1.f) |
| Keeping records required by tax and consumer law | Legal obligation (art. 6.1.c) |
We don’t sell personal data, we don’t build advertising profiles, and we don’t make decisions with legal effects about anyone based solely on automated processing.
4. Children’s data
BookHero is designed to be used by children under the supervision of a parent or legal guardian. Only an adult (18 or over) can create an account. By adding a child, you confirm you are their parent or legal guardian and consent to the processing described here. Under Spanish law, children under 14 need that consent.
We collect the minimum needed for the app to work, and you can edit or delete a child’s profile at any time from parent mode.
5. How the quiz uses AI
To generate quiz questions, the text of the photographed page is processed by an AI language model running on Amazon Web Services (Amazon Bedrock). Only the page photo is sent, never the child’s name or profile. Under AWS’s terms for this service, the content is not used to train their models. Questions are generated for that session only.
6. Who we share data with
We use service providers who process data on our behalf, under data processing agreements:
- Amazon Web Services EMEA SARL: hosting, database, sign-in, AI quiz generation and delivery of contact form messages. Region: EU (Ireland).
- Google: app distribution and subscription billing through Google Play.
- Functional Software, Inc. (Sentry): crash reporting.
Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses or an adequacy decision, such as the EU-US Data Privacy Framework.
We may also disclose data when required by law or by a competent authority.
7. How long we keep it
- Page photos: only for the duration of the session.
- Account, children’s profiles and reading activity: while your account is active. When you delete your account, we delete this data.
- Crash reports: for a limited period, then deleted.
- Contact messages: as long as needed to answer and follow up on your request, then deleted.
- Billing records: for the periods required by tax law.
8. Your rights
You can ask to access, correct or delete your data and your children’s data, object to or restrict its processing, receive it in a portable format, and withdraw your consent at any time (this doesn’t affect processing already carried out). Send your request through the contact form, choosing “Privacy or data request”. We may ask you to confirm your identity.
If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
9. Security
Data is encrypted in transit and stored with access restricted to the people who need it to run the service. Parent mode is protected by a PIN or fingerprint so children can’t change settings.
10. Changes to this policy
If we make material changes, we’ll tell you in the app before they take effect. The date at the top shows when this policy was last updated.