Politique de confidentialité

The short version for kids

Your pictures stay private unless your grown-up says yes.
Do not put faces, names, school or home in a photo.
If something feels bad, tap Report or tell your grown-up.

Version and effective date

Version: 1.0. Effective date and last updated: 2 November 2026. This Privacy Policy explains how Boomche handles personal data in its child-directed creative service (ages about 5–12).

Who we are (controller)

The data controller is Boomche, the operator of the Boomche app and boomche.ir. Where we offer the service in the EU/EEA, we act in line with the GDPR and, where required, appoint an EU representative whose details we will publish on this page. For all privacy matters, including Data Protection Officer (DPO) questions, contact: Info@boomche.ir. Backend service: app.boomche.ir.

Who this is for

Boomche is a creative and social app for children aged about 5 to 12, used together with a parent or legal guardian. A parent creates and manages child accounts, signs in (for example with OTP), sets a local parent PIN on the device, controls wallet/purchases, and approves sharing to wider audiences. Children do not create accounts alone.

Parental consent (GDPR Article 8)

Because Boomche is directed at children under 13, and EU Member States set the digital-consent age between 13 and 16, we require verified parental consent before processing a child's personal data based on consent. A parent or guardian must create the child account, accept this policy and the Terms, and confirm consent through our parent verification steps (for example OTP to the parent's contact). Parents may withdraw consent at any time; withdrawing may mean we must close the child account. Other processing may rely on other lawful bases described below (for example contract or legal obligation).

What data we collect

Parent account: phone number and/or email (sign-in, OTP, account recovery), parent display details you provide, wallet/purchase records, consent and approval history, and reports you send. Child profile: display name, username, age band or similar age indicator, creations (drawings, photos you upload, AI-enhanced images, AI cartoons/animations), albums, posts, audience choices, reactions, comments, and report metadata. Technical: device/app basics needed to run and secure the service (for example app version, approximate diagnostics), IP address and security logs as needed for safety and abuse prevention. We do not ask children for full legal name, home address, school name, or phone number as profile fields. Please do not put those in pictures or captions.

Lawful bases (GDPR Article 6)

We process data only where a lawful basis applies: (1) Consent (Art. 6(1)(a)) — parental consent for the child's account and related features where required under Art. 8; you may withdraw at any time. (2) Contract (Art. 6(1)(b)) — to provide the service the parent requested (accounts, storing and showing creations to the chosen audience, parental controls, purchases the parent makes). (3) Legal obligation (Art. 6(1)(c)) — for example responding to lawful requests or keeping required purchase records. (4) Legitimate interests (Art. 6(1)(f)) — only where appropriate for adults/parents or strictly necessary security and fraud prevention, and never overriding the child's rights; we do not use legitimate interests to profile children for advertising. We apply GDPR Article 5 principles: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, and accountability.

How we use data

Only to run Boomche safely: sign-in and parent verification; create and manage child profiles; save and display creations and albums; apply audience settings (private / kindergarten / friends / public) with parental approval where required; reactions and comments; moderation, reporting and safety; parent PIN gates on the device; wallet and parent-only purchases; customer support; security and abuse prevention; and to improve reliability in privacy-preserving ways. We do not sell children's personal data. We do not show profiling-based or targeted ads to children.

High privacy by default (Age Appropriate Design)

Default audience is private (child and family). Wider sharing is opt-in per post and, for public/World sharing, needs the parent PIN on this device and may be reviewed before it appears. Geolocation is off by default and not required for core features. We avoid nudge techniques that push children toward weaker privacy or public sharing. Profiles and feeds are designed for child safety, not for advertising reach. DSA Article 28: we do not present ads based on profiling using personal data of minors.

Who can see a child's creations

Each creation has an audience. Private (default): only the child and their family/parent controls. Kindergarten and friends/profile: limited audiences you choose. World (public): needs parent PIN on this device and may be reviewed before publish. Parents can change or remove content and manage the child's account. Moderators may see reported content to keep the community safe.

Photos, camera and safety tips

Photos are taken or uploaded only when someone taps camera or gallery. Uploaded photos are stored with the child's account and follow the chosen audience. Safety tips for kids and parents: do not show faces of the child or others; do not write full names, school names, home address, or phone numbers on or in photos; avoid school uniforms or landmarks that reveal location; prefer drawings and creative scenes over identifiable photos. Parents should review uploads before wider sharing.

AI and your pictures

Boomche uses AI to enhance images and to generate cartoons/animations from inputs you provide. AI-generated or AI-assisted outputs are labelled so children and parents can tell they were made with AI (AI Act transparency). Inputs (for example a drawing or photo you choose to enhance) may be sent to our contracted AI processing provider to produce the result. We do not use emotion recognition on children. We do not use children's content to train public ad systems. Our AI provider processes inputs and outputs only on our instructions under a data processing agreement (DPA) and keeps them only as long as needed to deliver the result. Do not upload photos you are not allowed to use, or photos of other people without a parent's permission.

Cookies and local storage (ePrivacy)

We use only strictly necessary local storage on the device — not advertising cookies. On this device, localStorage may hold: login/session information needed to stay signed in; language preference; a hashed parent PIN (not the PIN in plain text); and a flag that the photo-safety note was dismissed. These are required for the service to work as designed. If we later add non-essential technologies, we will ask for consent first where required.

No profiling for ads; automated decisions

We do not build advertising profiles of children and do not target ads at children based on profiling. We do not make solely automated decisions that produce legal or similarly significant effects about a child (GDPR Art. 22). Safety filters and moderation tools may use automated signals, but significant account actions include human review routes as described in our notice-and-action process.

Processors, sub-processors and international transfers

We use trusted providers to host and run the service, for example hosting and infrastructure providers, AI processing providers, SMS/email one-time-code providers, payment providers, and — only where privacy-preserving and necessary — security tools. A current list of sub-processors is available on request at Info@boomche.ir. When personal data leaves the UK/EEA/Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and any required transfer assessments, unless an adequacy decision applies. Copies of the relevant safeguards are available on request.

How long we keep data (retention — to confirm)

Retention periods: active account data while the account remains open; after parent-requested deletion, we aim to delete or irreversibly anonymise personal data within 30 days, except where law requires longer (for example limited purchase/invoice records for 7 years or the local statutory period, or security logs for 90 days). Backups roll off on a short cycle of up to 30 days. Reports and moderation records may be kept for up to 12 months to handle appeals and legal duties.

Security

We use technical and organisational measures appropriate to a child-directed service: encrypted transport (HTTPS), access controls, hashed local parent PIN on device, least-privilege staff access, and logging for security events. No method is perfect; please keep OTP codes and the parent PIN private. Report suspected account misuse to Info@boomche.ir.

Personal data breaches

If a breach likely risks people's rights and freedoms, we will notify the competent supervisory authority without undue delay and, where required by GDPR, inform affected parents. Contact for urgent security notices: Info@boomche.ir.

Your rights (GDPR Articles 15–22)

Parents (and children where applicable) may request: access to personal data; rectification of inaccurate data; erasure (“right to be forgotten”); restriction of processing; data portability (for data provided to us, where applicable); objection to processing based on legitimate interests; and withdrawal of consent at any time without affecting earlier lawful processing. You may also raise a complaint with the competent authorities of the Islamic Republic of Iran. To exercise rights, contact Info@boomche.ir. We will respond within a reasonable time and within any legally required time limits. We may need to verify the parent's identity before acting.

Account deletion and what happens to content

A parent can ask to delete a child account or the parent account via in-app controls (when available) or Info@boomche.ir. After deletion, creations, reactions and profile data tied to that account are removed or anonymised from live systems within the retention window above, except content we must keep by law or copies already shared publicly that others may still hold, and limited backup/audit copies until they expire. Public posts may remain visible until removal completes. Deleting the app from a device does not by itself delete server data — use account deletion.

Reports, safety and notice-and-action (DSA)

Anyone can report a post or behaviour that seems harmful or against the rules. We review reports and may hide or remove content, limit features, or suspend accounts. Under DSA-style notice-and-action (Arts. 16 and 20), we aim to: acknowledge actionable notices; take proportionate action; give a statement of reasons for significant decisions where required; and offer a complaint/appeal route for users who disagree — send complaints and appeals to Info@boomche.ir. Illegal content will be handled according to applicable law.

Transparency for children (Articles 12–14)

The kid summary at the top uses short sentences meant to be read aloud to ages about 5–8. This parent section gives fuller detail in plain language. If anything is unclear, ask us at Info@boomche.ir.

Changes to this policy

We will notify parents in the app when this policy changes in an important way. For material changes that require new consent, we will ask parents to review and accept again before the child continues with affected features. The version code (LEGAL_VERSION) stored on the device helps us know which text was accepted.

Contact

Privacy and rights requests (including DPO matters): Info@boomche.ir. Website: boomche.ir. Supervisory authority: the competent authorities of the Islamic Republic of Iran.