Besty Privacy Policy
1. Who we are and what this covers
Besty is built for children, so we collect as little as we can, never sell data, and parents stay in control of everything their child's Besty knows.
Besty is operated by AWLADNA AI LTD, a company registered in England and Wales (company number 17471150), registered office 20 Wenlock Road, London N1 7GU, United Kingdom ("Besty", "we", "us"). We are the data controller for the personal data described here.
This policy covers:
- the Besty device (the handheld companion your child talks to)
- the Besty parent app on Android and iOS
- our website, besty.life
- the AI service that powers conversations on the device (together, the "Service")
Who this policy is for:
- Parents and guardians. You create the account, set up the device and give consent for your child. This policy is written mainly for you.
- Children. There is a short, plain version for children in section 10. Please read it with them.
Besty is designed for children aged 4 to 12. Children cannot create accounts or use the Service without a parent or legal guardian setting it up and agreeing to this policy.
Where you live affects which laws protect you. We follow the UK GDPR and the UK Data Protection Act 2018 because we are a UK company, and the Saudi Personal Data Protection Law (PDPL) and its regulations for users in Saudi Arabia. Where these laws differ, we apply the stricter standard. We also follow the principles of the UK Age Appropriate Design Code.
The Service is not offered in the United States or the European Union during the current pilot.
2. What we collect
We collect three kinds of data: what you give us as a parent, what your child says to Besty, and basic technical data the device needs to work.
| Category | What it includes | Where it comes from |
|---|---|---|
| Parent account | Name, email, phone number, password (stored encrypted), language, country | You, when you sign up |
| Child profile | First name or nickname, age or age range, preferred language, interests | You, in the parent app |
| Family context | Values, boundaries, personality settings, and any family details you choose to share so Besty can talk naturally (for example, a sibling's name or a pet) | You, in the parent app |
| Voice | Your child's voice while they are talking to Besty | The device microphone, only after the button is pressed or a conversation is active |
| Conversation transcripts | Text versions of what your child said and what Besty replied | Created by our AI service from the voice |
| Memories | Short notes Besty suggests remembering (for example, "loves dinosaurs") | Suggested by the AI, kept only if you approve them |
| Safety flags | Alerts when a conversation suggests your child may be upset, unsafe or asking about something concerning | Created by our AI service and sent to you |
| Device and connection data | Device ID, firmware version, Wi-Fi or SIM connection status, battery level, error logs, usage counts | The device and the parent app |
| Purchase data | Order details, delivery address, payment status | You, and our payment provider. We never see or store full card details. |
| Support messages | Anything you send us when asking for help | You |
What we do not collect:
- Raw voice recordings. Audio is processed in real time to understand your child and is not stored by us.
- Precise location. The device has no GPS, and we do not track where your child is.
- Photos or video. The device has no camera.
- Anything from other apps or the open internet. The device cannot browse.
- Advertising identifiers. There are no ads in Besty.
Guest mode. When another child uses the device in guest mode, Besty does not save transcripts, memories or personal details from that conversation. Safety flags may still be raised to the device owner's parent if a guest says something that suggests they are in danger, without identifying the guest.
Safety flags and sensitive information. A safety flag can reveal something sensitive about your child, such as how they are feeling. We create these only to tell you, the parent, and treat them with the same care as health information.
3. How we use data and why we're allowed to
We use your child's data to run the conversation, keep them safe, and keep you informed. Nothing else.
| Purpose | Data used | Legal basis |
|---|---|---|
| Run conversations on the device | Voice, transcripts, child profile, family context, approved memories | Your consent as parent, and performance of our contract with you |
| Adapt Besty to your child's age and language | Child profile, recent conversation context | Your consent |
| Send you safety flags | Transcripts, safety flags | Your consent, and protecting the child's vital interests in serious cases |
| Show you conversation history in the parent app | Transcripts | Your consent |
| Manage your account, device and subscription | Account, device and purchase data | Performance of our contract with you |
| Fix bugs, prevent abuse, and keep the Service secure | Device and connection data, error logs | Our legitimate interest in a working, secure Service |
| Improve how Besty responds (see below) | De-identified transcript samples | Your separate, optional consent |
| Meet legal and tax duties | Account and purchase data | Legal obligation |
Consent. For anything involving your child, we rely on your consent as their parent or legal guardian. We ask for it during setup in the parent app, before the device is used. You can withdraw it at any time by contacting us or deleting your account. Withdrawing stops the Service from working for your child, because Besty cannot hold a conversation without processing what they say.
Improving Besty. This is off by default. If you turn it on, a small team may review short, de-identified transcript excerpts to improve safety and quality. Names and family details are removed first. You can turn it off any time in the parent app.
What we never do:
- Sell or rent personal data, to anyone
- Use your child's data for advertising or to build a marketing profile
- Let third parties train their AI models on your child's conversations
- Make decisions about your child that have legal or similarly significant effects based only on automated processing
- Use design tricks to keep your child talking longer
4. How the AI works with your child's data
Besty's conversations run on a large language model provided by OpenAI, configured by us with child-safety rules and the values you set.
- When your child speaks, the audio streams securely to OpenAI's API, which turns it into a reply in real time.
- OpenAI acts as our service provider (processor). Under our agreement, it may not use your child's data to train its models, and Zero Data Retention applies, so OpenAI does not keep the content after the response is generated.
- AI can make mistakes. Besty may sometimes say something inaccurate or miss a concern. Our safety rules reduce this but cannot remove it. Safety flags are a support for parents, not an emergency service.
We may move parts of the AI to other providers or to servers we run ourselves. If that changes who processes your child's data, we will update the list below and tell you first.
5. Who we share data with
We share data only with service providers who help us run Besty, under written contracts that limit their use to our instructions.
| Provider | What they do | Data involved | Location |
|---|---|---|---|
| OpenAI, L.L.C. | Runs the AI conversation | Voice, conversation context | United States |
| [Hosting provider] | Stores accounts, transcripts, memories | Account, child profile, transcripts, memories, flags | [Region] |
| [Mobile connectivity provider] | SIM data connection for the device | Device and connection data | [Country] |
| Payoneer [or final payment provider] | Takes payment | Purchase data | [Country] |
| [Analytics or crash tool, if any] | App stability | Device and app data | [Country] |
| Google and Apple | App distribution and push notifications | Basic app and notification data | United States |
We may also share data:
- with authorities, if the law requires it, or if we believe in good faith that a child is at immediate risk of serious harm
- with a buyer or successor company, if Besty is restructured, merged or sold. The new owner must keep this policy's protections, and we will tell you before it happens
International transfers. Your data is processed outside Saudi Arabia, including in the United Kingdom and the United States. We protect these transfers with contractual safeguards required by UK and Saudi law (such as the UK International Data Transfer Addendum and standard contractual clauses) and with encryption in transit and at rest. You can ask us for a copy of the safeguards we use.
6. How long we keep data
We keep data only as long as it is useful to you, then delete it.
| Data | How long |
|---|---|
| Voice audio | Not stored. Discarded once processed. |
| Conversation transcripts | 90 days by default, then deleted. You can shorten this or delete any conversation in the parent app. |
| Safety flags | 90 days, or until you delete them |
| Approved memories | Until you delete them or close your account |
| Child profile and family context | Until you change them or close your account |
| Device and error logs | 90 days |
| Parent account | Until you close it. Deleted within 30 days of closing. |
| Purchase and invoice records | 6 years, because tax law requires it |
Backups are overwritten on a rolling cycle of up to 30 days after deletion.
7. How we protect data
- Encryption in transit (TLS) between the device, app, our servers and our providers
- Encryption at rest for stored data
- Settings changes in the parent app require adult authentication
- Access to production data is limited to named staff who need it, with logging
- We will notify you and the relevant regulator without undue delay if a breach puts your or your child's data at risk, within the time limits the law sets
No system is perfectly secure. If you think your account has been compromised, contact us right away.
8. Your rights
As a parent, you can exercise these rights for yourself and on behalf of your child:
- Access: get a copy of the data we hold
- Correction: fix anything inaccurate
- Deletion: delete conversations, memories, your child's profile or your whole account
- Withdraw consent: at any time, without affecting what was lawful before
- Restriction and objection: ask us to limit or stop certain uses
- Portability: get your data in a common, machine-readable format
- Complain: to the UK Information Commissioner's Office (ico.org.uk) or, in Saudi Arabia, to the Saudi Data and AI Authority (SDAIA)
Most of these you can do yourself in the parent app. For anything else, email privacy@besty.life. We reply within 30 days and may ask you to confirm your identity first. As your child grows, we will respect their own wishes about their data where the law allows.
9. Cookies on our website
besty.life uses only the cookies it needs to work. If we add analytics cookies, we will ask for your consent first and list them here.
10. A short version for children
Read this together.
Besty listens when you talk to it, so it can answer you. It does not keep a recording of your voice. It writes down what you talked about so your mum or dad can see it, and it forgets those notes after a while. Besty only remembers special things about you if your parent says yes. If you say something that sounds like you are sad or not safe, Besty will tell your parent, because they want to help you. Besty never tells strangers about you. If you have a question, ask your parent.
11. Changes to this policy
If we make a meaningful change, we will tell you in the parent app or by email before it takes effect, and ask for fresh consent where the law requires it. This includes a change of the company that runs Besty.
12. Contact us
AWLADNA AI LTD (Besty) 20 Wenlock Road, London N1 7GU, United Kingdom Email: privacy@besty.life Website: besty.life
Last updated: [publication date]