Privacy Policy
Updated: October 17, 2026
Who is responsible
EmiLab is a service of Vail Holdings LLC, Florida, United States. Contact: hola@emilab.app.
EmiLab is made for families with children aged 1 to 6. Because it is used by children under 13 in the U.S., we follow COPPA (Children’s Online Privacy Protection Act).
What we keep
About the adult: e-mail address, chosen language, and the acceptance of this policy (date and version).
About the child, only: first name, birth month and year (never the day), language, a color, level and progress (lessons, stars, skills) and play time.
We do not keep photos, voice or recordings of the child, location, last names, or any way to contact the child.
Payments (once enabled): Stripe processes the card. EmiLab never sees or stores the card number.
Why we use it
To make the app work: show the level and progress, sync the family’s devices, say the child’s name with a voice, send the sign-in code, handle access requests and, once enabled, charge the subscription.
We do not use data for advertising, we do not build commercial profiles, and we never sell or rent data.
No ads, no trackers
EmiLab has no ads, no advertising cookies, no third-party analytics, and no autoplay videos. We use one first-party functional cookie ("emilab_app") that remembers this browser uses the app.
Service providers that process data for us
Supabase: database and e-mail sign-in (U.S.).
Cloudflare: hosting of the app and the audio files.
ElevenLabs: receives the child’s FIRST NAME, once, to generate the audio with the name. It receives no other data about the child.
Resend: e-mail delivery (sign-in code, invitations, notices).
Stripe: payments, only once enabled.
Each provider uses the data only to provide its service to us. [LAWYER: confirm data processing agreements (DPAs) with each provider.]
How long we keep it
While the account exists. When a parent deletes the account, we immediately delete the family, the children, their progress and the recordings with their names. [LAWYER: period for the providers’ backups.] Anti-spam logs of access requests are deleted after 7 days.
Parents’ rights
See and download everything: Parents’ zone → "Download my data" (JSON file).
Correct: Parents’ zone → edit the child.
Delete everything: Parents’ zone → "Delete my account and all data".
Withdraw consent: by deleting the account or writing to hola@emilab.app. We answer within [LAWYER: period] days.
Parental consent
Before adding the first child, the adult accepts this policy with a checkbox, and we keep the date and the accepted version. [LAWYER: choose the COPPA verifiable consent method; see the options in docs/legal/PREGUNTAS_ABOGADO.md.]
Security
Connections are encrypted (HTTPS). Each family can only see its own data: the database checks it on every request. Service keys are never in the app or in public code.
Changes
If we change this policy, we will notify you by e-mail and in the app before the change applies.