The controller
Sansa Group AB is the controller for personal data processed in connection with Lulopi and lulopi.my. Lulopi is made by Sansavision, a division of Sansa Group AB. We are established in Sweden, and our lead supervisory authority is IMY, the Swedish Authority for Privacy Protection.
Sansa Group AB (Lulopi is made by Sansavision, a division of Sansa Group AB)
Org. no. 559111-9507
Soldathemsgatan 20, 415 28 Göteborg, Sweden
Questions and privacy requests: support@lulopi.my
We have not appointed a data protection officer, as we are not required to. Our privacy contact is support@lulopi.my.
Data that never reaches us
Most of what makes your kitten yours (their name, state, progress, keepsakes, memories, small things and your settings) is stored only on your device. We don’t receive it, so we can’t access, correct or delete it for you. You stay in control: change it in the app, or delete the app to remove it. If we introduce optional cloud sync, data you choose to sync will be covered by the rights below.
What we process, why, and on what legal basis
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Delivering room clips to the app | IP address, requested file, time, user agent | Legitimate interests (Art. 6(1)(f)): delivering content reliably and securely | Short-lived logs, typically up to 30 days |
| Running and protecting this website | IP address, request details, browser type | Legitimate interests (Art. 6(1)(f)): a working, secure website | Short-lived logs, typically up to 30 days |
| Launch waitlist emails (double opt-in) | Email address, platform choice, sign-up source, consent record, confirmation time | Consent (Art. 6(1)(a)) | Until you unsubscribe, or at most 12 months after launch; unconfirmed sign-ups 7 days |
| Answering your messages | Email address, message contents | Legitimate interests (Art. 6(1)(f)) or contract (Art. 6(1)(b)) | Up to 24 months after the conversation ends |
| In-app purchases and Lulopi Club (when available) | Product, transaction identifier, purchase or renewal status | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for bookkeeping | As long as needed for the purchase; accounting records generally 7 years |
| Optional account and cloud sync (planned) | Sign-in identifier, synced companion data | Contract (Art. 6(1)(b)) | Until you delete the account, plus backup expiry |
| Legal claims and compliance | Relevant records above | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) | As long as the claim or obligation requires |
About legitimate interests
Where we rely on legitimate interests, we have balanced our interest (delivering, securing and supporting our services) against your rights and expectations, and limited the data to what is necessary. You can ask us for details of this assessment and you have the right to object (see below).
Your rights
Under the General Data Protection Regulation (GDPR), and the UK GDPR and Swiss law where they apply, you have the right to:
- Access your personal data and receive a copy (Art. 15).
- Rectification of inaccurate or incomplete data (Art. 16).
- Erasure (“the right to be forgotten”) in certain circumstances (Art. 17).
- Restriction of processing, for example while accuracy is checked (Art. 18).
- Data portability: receive data you gave us, based on consent or contract, in a structured, machine-readable format (Art. 20).
- Object to processing based on legitimate interests (Art. 21). We will stop unless we have compelling legitimate grounds, or need the data for legal claims.
- Withdraw consent at any time, for example by unsubscribing from the waitlist. This doesn’t affect processing that happened before (Art. 7(3)).
- Not be subject to automated decisions with legal or similarly significant effects (Art. 22). We don’t make any such decisions.
How to use your rights
Email support@lulopi.my and tell us which right you’d like to use. It’s free. We may ask for information to confirm your identity, for example by replying from the email address you joined the waitlist with.
We will respond within one month. If a request is complex or we receive many, we may extend this by up to two further months, and we’ll tell you why within the first month. If we can’t do what you ask, we’ll explain why.
Your right to complain to IMY
We’d appreciate the chance to put things right first, but you always have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where an alleged infringement took place. Our lead authority is:
Integritetsskyddsmyndigheten (IMY)
Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
imy.se · imy@imy.se · +46 8 657 61 00
If you live in another EEA country, the UK or Switzerland, you can also contact your local data protection authority.
Recipients
- Cloudflare, Inc.: processor for website hosting, content delivery of room clips from media.lulopi.my, media storage and security, and for the launch waitlist, which Sansa Group AB keeps in a Cloudflare D1 database located in Western Europe and emails through Cloudflare Email Service.
- Apple Inc. / Apple Distribution International and Google LLC / Google Ireland: independent controllers for app distribution and in-app purchases.
- Professional advisers and authorities, where necessary and lawful.
International transfers
Cloudflare runs a global network, so requests to lulopi.my and media.lulopi.my may be processed in data centres outside the EEA, including in the United States. The waitlist database is located in Western Europe, but waitlist requests and emails travel over the same network and may pass through data centres outside the EEA.
When personal data leaves the EEA we make sure it’s protected by:
- an adequacy decision of the European Commission (Art. 45), including the EU–U.S. Data Privacy Framework for recipients certified under it; or
- the European Commission’s Standard Contractual Clauses (Art. 46(2)(c)), with supplementary measures such as encryption in transit where needed.
You can request a copy of the relevant safeguards by emailing support@lulopi.my.
Retention
We keep personal data only as long as needed for the purposes above; the table in legal bases lists each period. When a period ends, we delete or anonymise the data, unless the law requires us to keep it longer.
Children and the age of consent
Lulopi is a general-audience app and is not directed at children. We don’t knowingly process personal data of children below the age at which they can consent to online services in their country (13 in Sweden; between 13 and 16 elsewhere in the EU). If you believe we hold such data, please contact us and we’ll delete it.
More information
For the full picture, read our Privacy Policy. California residents can find their rights in Your California Privacy Rights.