Skip to content
Labugen

Privacy Policy

This policy is effective from September 25, 2026. If you have any questions, contact us at contact@labugen.com.

Advertisement

1. Data Controller

The controller of the personal data of labugen.com Users is Grupa Damian Zięba, ul. Sandomierska 4A, 37-300 Leżajsk, Poland, tax identification number (NIP) 794 172 09 19. For matters concerning personal data, contact us at contact@labugen.com. The Controller has not appointed a Data Protection Officer; please send all enquiries concerning personal data to the email address provided.

2. What Data We Process and Why

  • Public pages: server logs (IP address, time, page address, browser) are retained for up to 30 days for security and diagnostic purposes. Traffic to the website passes through the Cloudflare network, which protects it against attacks; when traffic looks suspicious, Cloudflare stores the cf_clearance cookie. Visit statistics (Google Analytics 4) are collected only after consent is given—see sections 6 and 7. Providing data is voluntary, but you cannot create an account without an email address or buy a plan without billing information.
  • Newsletter: email address, date, time, and IP address when consent is given and confirmed through double opt-in—for the purpose of sending information about new materials until you unsubscribe. Sign-ups that are not confirmed are deleted after 30 days.
  • Parent or Teacher Account: email address, password (stored as a hash), the date and IP address of accepting the Terms of Service and the declaration of legal age, account settings, login history, for Teachers also their first name, surname, and—if provided—phone number, and, for paid services, billing information and payment history—for the purpose of maintaining the account and fulfilling the contract, for the duration of the contract and the applicable limitation period for claims (billing information: 5 years from the end of the tax year).
  • Child Profiles: nickname, year of birth (without day or month), learning stage, exercise results and progress, badges, saved games, and material download history—for the operation of the Learning Zone and reports for the Parent until the profile is deleted. Rankings, the friends' wall, and the child's statistics page are off by default; only the Parent can turn them on—the child's nickname, hero, learning stage, and achievements are then visible to everyone in the rankings, to friends' families on the wall, and on the statistics page to the people with whom the Parent shares the link.
  • Contact form and error reports: first name and surname (if provided), email address, and message content—for the purpose of replying, retained for 12 months, after which messages are deleted automatically. Message content is not passed on to artificial intelligence tools.
  • Cookies and similar technologies are described in our Cookie Policy. Statistics (Google Analytics 4) are activated only after consent is given; Google AdSense ads are displayed in the European Economic Area, the United Kingdom, and Switzerland only after consent—see section 6.

3. Legal Bases

  • Article 6(1)(b) of the GDPR—performance of a contract (account, Learning Zone, paid services);
  • Article 6(1)(a) of the GDPR—consent (newsletter, analytics and advertising cookies); consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal;
  • Article 6(1)(c) of the GDPR—legal obligations (accounting and handling complaints);
  • Article 6(1)(f) of the GDPR—legitimate interests (security and protection against attacks, pursuing claims, replying to messages).

4. Children's Data

A Parent Account may only be created by an adult who declares during registration that they are the child's parent or legal guardian and accepts the Terms of Service on their own behalf and as the child's legal representative. A Child Profile contains only a nickname, year of birth, and learning stage; these data are processed on the basis of the contract for the use of the Learning Zone, which the Parent also concludes on behalf of the child (Article 6(1)(b) of the GDPR). From children using a profile created by a Parent, we do not collect first names or surnames, addresses, photos, or contact details. The Learning Zone (/app addresses) contains no advertising, analytics, or advertising scripts, and on public pages for children only non-personalised ads are shown. Parents can view profile data and delete the profile at any time. Student accounts work differently: a student is invited by a Teacher, who provides the student's first name, surname, email address, and class register number (the Teacher is the source of these data); the student creates an account with a password, and their first name serves as the nickname in the profile. The Teacher can see the student's first name and surname, nickname, hero, and learning statistics, and group reports are sent to the address specified by the Teacher. If the student is under 16, the account should be created or approved by their Parent. Children's privacy in the United States (COPPA). Operator: Grupa Damian Zięba, ul. Sandomierska 4A, 37-300 Leżajsk, Poland; contact@labugen.com; phone: . Labugen is directed to children. For a child profile created by a Parent we collect the nickname, year of birth, learning stage, exercise results, badges, game records and download history; student accounts created at a Teacher's invitation also include the first and last name and class number entered by the Teacher, an email address and a password. We use children's information only to provide learning and progress reports to the Parent or Teacher; we never use it for advertising, never sell it, and share it only with hosting and security providers acting on our behalf. Rankings, the friends' wall and shareable statistics are off by default and only a Parent can turn them on. Outside the EEA, the UK and Switzerland we run no analytics and show only contextual ads; persistent identifiers are used only to support internal operations. We keep a child's data until the Parent or Teacher deletes the profile or account; data deleted from the service disappears from backups within 14 days. A Parent may review the child's information, have it deleted and refuse further collection by writing to contact@labugen.com.

5. Data Recipients

  • the hosting and server infrastructure provider (servers located in the European Union); transactional emails and the newsletter are also sent from our server;
  • Cloudflare, Inc.—content delivery network and protection against attacks; providers of the artificial intelligence tools we use to create and translate content (OpenAI, Anthropic, Google)—they receive only website content; we do not share Users' personal data or children's data with them (contact details and identifiers are replaced with the “[ukryto]” marker before transfer);
  • the payment processor Tpay (Krajowy Integrator Płatności S.A.)—when a plan is purchased;
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland—Google Analytics 4 and Google AdSense (after consent), and Google Search Console (aggregated search impression data). For advertising, Google acts as a separate data controller under its own privacy policy;
  • entities authorised under applicable law.

6. Google AdSense Advertising

We display ads through the Google AdSense programme on the service's public pages. There are no ads in the child's Learning Zone. When ads are displayed, Google, its partners, and its providers may place and read cookies in the User's browser and use web beacons, the IP address, and other identifiers.

Labugen is used by children, their parents, and teachers, so: (1) Google's script with the consent window (a certified consent management platform) loads from the first visit and, before you make a choice, stores only a cookie recording that choice (FCCDCF); in the European Economic Area, the United Kingdom, and Switzerland, ads are displayed only after consent, and outside these areas ads are contextual only and we do not collect statistics; (2) every ad request is sent as a request for a non-personalised ad, and personalised ads are disabled in our AdSense account settings; (3) on pages intended for children (colouring pages, activities, printable materials, generators, games, rankings, the home page, and search), we label ad requests as child-directed using Google's age designation, which also disables calls to third-party ad servers and tracking pixels and enables child ad safeguards; pages for adults (the parent guide, parent and teacher pages, and information pages) do not use this designation; (4) we have blocked advertising categories unsuitable for children, including gambling, alcohol, dating, and supplements. Non-personalised ads also use cookies to limit how often ads are shown, detect abuse, and produce aggregated reports.

7. Consent and Withdrawal

On your first visit from the European Economic Area, the United Kingdom, or Switzerland, we ask for your consent in Google's consent window (a certified consent management platform using the IAB TCF standard); if the window is not displayed, we show our own banner, which asks only about analytics cookies. Refusing consent is just as easy as giving it. We store your decision in the FCCDCF cookie (for up to 13 months) and the labugen_zgoda cookie (for 12 months). You can change or withdraw consent at any time using the “Cookie Settings” link in the footer of every page; details are available in our Cookie Policy.

8. Transfers Outside the European Economic Area

Data may be transferred to third countries in connection with the services of Google and Cloudflare, based on the European Commission's adequacy decision concerning the EU–US Data Privacy Framework or on Standard Contractual Clauses.

9. Retention Period

We retain data for the period specified for each category in section 2, after which we delete or anonymise it; messages, error reports, and unconfirmed newsletter sign-ups are deleted automatically by a daily task. Accounts that remain inactive for 24 months are deleted after prior email notification. Database backups are kept for up to 14 days—data deleted from the service disappears from them no later than after this period.

10. Data Subject Rights

You have the right to access, correct, or delete your data, restrict its processing, receive and transfer it, object to processing based on legitimate interests, and withdraw consent. Requests can be sent to the Controller's email address. You also have the right to lodge a complaint with a supervisory authority—in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland)—or with the supervisory authority in the EU Member State where you live or work (Article 77 of the GDPR).

11. Automated Decision-Making and Profiling

We do not make decisions about Users based solely on automated processing that produce legal effects. We do not profile Users for advertising purposes. Exercise selection in the Learning Zone is based on the child's results and is used solely for learning—this is profiling within the meaning of Article 4(4) of the GDPR, but without legal effects and without any influence on advertising. We create images and some texts with the help of artificial intelligence, which we disclose in the footer of every page; since 25 September 2026, we have saved original images from generators with a label in their metadata (IPTC “trainedAlgorithmicMedia”), while the reduced and converted versions displayed on the pages do not contain this label.

12. Changes to This Policy

We update this policy when the law, our services, or our providers change. The current version is always available at this address; this version is effective from 25 September 2026.

Advertisement