1.Your rights
Under the UK GDPR, everyone in your family has these rights over their personal data:
| Right | What it means | How to use it |
|---|---|---|
| Access | Get a copy of the data we hold about you, and how we use it. | Email privacy@famcho.co.uk |
| Correction | Fix anything that's wrong or incomplete. | Most details can be changed in the app (Settings, Family). For anything else, email us. |
| Erasure | Ask us to delete your data. | Grown-ups can remove members and delete kid profiles in the app. To delete a whole family, email privacy@famcho.co.uk. |
| Restriction | Ask us to pause using your data while a concern is sorted out. | Email privacy@famcho.co.uk |
| Objection | Object to things we do on the basis of legitimate interests. | Email privacy@famcho.co.uk |
| Portability | Get the data you gave us in a machine-readable format (JSON), to take elsewhere. | Email privacy@famcho.co.uk |
| Withdraw consent | Where we rely on consent (such as notifications), withdraw it at any time. | Turn notifications off in your device or browser settings |
Famcho doesn't make automated decisions that have legal or similarly significant effects on anyone. Coins, streaks and trophies are worked out automatically, but they're part of the game your family runs, and a grown-up can always adjust them.
2.Making a request
- Email privacy@famcho.co.uk from the email address on your Famcho account, and tell us which right you'd like to use.
- It's free, and we'll respond within one month. If a request is particularly complex we can extend this by up to two more months, but we'll tell you why within the first month.
- We may ask you to confirm who you are before we act, so that nobody can get at your family's data by pretending to be you.
- When we delete a family, everything goes from the live database within 30 days and from backups as they roll over. The only exception is billing records, which the law requires us to keep (see the Privacy Policy).
Requests about children
A child's data belongs to the child. Parents and carers can make requests on behalf of their children. Older children (usually around 12 and up) who understand what they're asking can make their own. Where it's in the child's best interests, we may check with them or the family before acting.
3.Lawful bases at a glance
- Contract: running the service the grown-up signed up for, and taking payments.
- Legitimate interests: providing the service to the kids the family adds, security and fraud prevention, AI suggestions when asked for, and replying to you.
- Legal obligation: keeping billing and tax records.
- Consent: push notifications.
The detail is in the Privacy Policy. We don't process special category data (such as health information) on purpose. Calm mode is a display preference, and we don't ask why it's turned on.
4.Who helps us run Famcho
These providers (“processors”) handle personal data for us. Each is bound by a data processing agreement and may only use the data to provide its service to Famcho.
| Provider | What they do | Data involved | Where |
|---|---|---|---|
| Neon, Inc. | Database | Everything your family stores in Famcho, including accounts and sign-in details (passwords are stored hashed) | London, UK (AWS eu-west-2) |
| Vercel, Inc. | Hosting, app servers, logs and the AI Gateway | All app data as it passes through; IP addresses and technical logs | USA and global edge network |
| Resend, Inc. | Sign-in emails: invitations and password resets | Email addresses, names, and the email itself (including invite and reset links) | USA |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payments and subscriptions | Grown-up's name, email, card and billing details | Ireland and USA |
| PostHog, Inc. | Product analytics (grown-ups who accept only; never kids or the Family Board) | Usage events, pages visited, device type, a user ID and family ID. No names, emails, chore or reward titles | EU (Frankfurt) |
| OpenAI, L.L.C. (via Vercel AI Gateway) | AI chore and reward suggestions, only when a grown-up asks | The description typed, and family members' display names | USA |
| Apple, Google and Mozilla push services | Delivering notifications to your device | The notification text and a device push address | USA and worldwide |
| Google and Meta | Sign in with Google or Facebook, only if you choose to | Your name, email and profile picture, shared by them with us | USA and worldwide |
We'll update this list before we add or replace a provider. If you'd like to know about changes, email privacy@famcho.co.uk and we'll let you know.
Services you connect yourself
If a grown-up connects Discord, a webhook or an AI assistant (such as Claude, through Famcho's MCP connection), those services aren't our processors. You're choosing to send your family's data to them, and their own terms and privacy policies apply.
5.International transfers
Your family's data is stored in London. Where a provider handles it outside the UK, one of these safeguards applies:
- Adequacy: the UK has recognised the destination as protecting data properly. That covers the EU (including Ireland), and US companies certified to the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”).
- Contracts: otherwise, the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, backed by a transfer risk assessment.
You can ask us for more detail about the safeguard used for any provider at privacy@famcho.co.uk.
6.Contact and complaints
Data protection contact
Famcho is run by [COMPANY NAME] Ltd, a company registered in England and Wales (company number [COMPANY NUMBER]), whose registered office is at [REGISTERED OFFICE ADDRESS].
Email: privacy@famcho.co.uk · ICO registration: [ICO REGISTRATION NUMBER]
We offer Famcho to families in the UK. If you're unhappy with how we've handled your data, please talk to us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.