Privacy Policy
2026-07-16 · v1.3
1. Controller
Funtoonia ("we", "us") is operated by Egységmester Kft., 2330 Dunaharaszti, Gyóni Géza köz 8., Hungary, company reg. no. 13-09-162959, tax no. 24291608-2-13 (EU VAT: HU24291608).
Contact: hello@funtoonia.com
We are the data controller under GDPR.
2. What this service is
Funtoonia is a subscription library of educational comics for children aged 4–10. The account holder is always an adult (parent or guardian aged 18+). Children do not register and do not interact directly with the service.
3. Data we collect
| Category | Detail |
|---|---|
| Adult account | Email address, hashed password, language preference |
| Subscription | Stripe customer ID, subscription status. We never see or store full card data — Stripe handles payment. |
| Child profile (data minimisation) | Nickname (free text), age band (4–6 / 7–9), avatar settings (predefined options only). Nothing else. |
| Technical | Essential cookies, server logs (IP, timestamp) for security and operation |
| Marketing & analytics (consent only) | Meta Pixel events for advertising measurement, and self-hosted usage/heatmap analytics on public marketing pages — only after explicit consent, never on child-facing pages |
4. What we deliberately do NOT collect
No child photos, biometrics, full name, birth date, address, voice recordings, or child email address — ever. There is no photo or file upload feature.
5. Legal bases (GDPR Art. 6)
- Performance of contract (Art. 6(1)(b)): account management, subscription, content access.
- Consent (Art. 6(1)(a)): marketing cookies / Meta Pixel — withdrawable at any time.
- Legal obligation (Art. 6(1)(c)): accounting and tax records of payments.
- Legitimate interest (Art. 6(1)(f)): security, fraud prevention, service improvement.
- Legal obligation (Art. 6(1)(c)): handling content reports under the EU Digital Services Act (Art. 16) — the reporter's name, e-mail address and description are collected because the law requires them; for suspected child sexual abuse material a report may be made anonymously.
6. Children's privacy (GDPR Art. 8 / key section)
This section is especially important for our service.
- Accounts are for adults only (18+). Parents or guardians open and control the account. We do not knowingly create accounts for children.
- Child profiles contain only a nickname, age band (4–6 / 7–9), and a predefined avatar. These are held under the parent's account and are not used independently.
- No behavioural or targeted advertising directed at children. The Meta Pixel (marketing consent) is controlled by the adult account holder. Children are never profiled or targeted for advertising purposes.
- Parental control: The parent/guardian can view, edit, or delete any child profile from their account settings at any time. To request deletion of all data related to a child, contact hello@funtoonia.com.
- Digital consent age: Under GDPR Art. 8 and Hungarian law, the digital-consent age is 16. Children under 16 may not consent independently to data processing for online services. Our design enforces adult-only registration.
- If you believe a child has provided personal data without parental consent, please contact us immediately at hello@funtoonia.com so we can delete it promptly.
7. Processors / recipients
- Stripe Payments Europe, Ltd. (payments, billing) — EU processor.
- Hostinger International Ltd. (hosting) — EU data centre.
- Google LLC (Gemini API, comic content generation) — only theme/style inputs are sent; no child data or account data is transmitted.
- Meta Platforms Ireland Ltd. (Facebook Pixel) — only after marketing consent by the adult account holder. Meta processes data under SCCs.
- Self-hosted analytics/heatmap (operated by us on our own EU infrastructure) — measures how visitors use our public marketing pages; loads only after "Accept all" consent and never on child-facing or in-app pages.
Some providers may transfer data outside the EU under appropriate safeguards (EU Standard Contractual Clauses or adequacy decisions).
8. Retention
- Account and child-profile data: kept while your account is active.
- You can delete any child profile (and all its data) at any time from your account settings.
- On account deletion: personal data is removed, except records we must keep by law (e.g., invoices — typically 8 years under Hungarian accounting law).
- Server logs: retained for up to 90 days.
- Content reports (DSA): kept for 3 years from the decision, so that we can demonstrate how the report was handled and deal with any related dispute.
9. Your rights (GDPR Art. 15–22)
You have the right to:
- Access — obtain a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure ("right to be forgotten") — request deletion of your data.
- Restriction — limit processing in certain circumstances.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdrawal of consent — withdraw marketing consent at any time without affecting prior processing.
To exercise any right: hello@funtoonia.com. We will respond within 30 days (GDPR Art. 12).
You may also lodge a complaint with the Hungarian supervisory authority: NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság), www.naih.hu, or with the supervisory authority in your country of residence.
10. International transfers
Where processors outside the EU handle data, we rely on EU Standard Contractual Clauses (SCCs) or EU adequacy decisions as transfer safeguards.
11. Changes
We may update this policy; the effective date and version are shown above. Material changes will be communicated by email or in-app notice.