Privacy Policy

Buska is made for families, so privacy isn't a checkbox for us — it's the design. This policy explains what we collect, what we deliberately don't, and the choices you have. Buska is operated by Gray Matters Communications V.O.F. ("Buska," "we," "us").

1. Who this is for

A parent or guardian (at least 18 years old) creates the family account. Children use the app under that account through explorer profiles the grown-up sets up. Buska is not intended for a child to sign up independently.

2. What we collect & legal basis

Under European privacy laws (GDPR), we process your data under the following legal bases:

• Account Data (Contractual Necessity): The parent's email address and password. Passwords are stored hashed and salted by our authentication provider (Supabase); we never see or store plain-text passwords.
• Explorer Profiles (Parental Consent): A display name/nickname, an avatar choice, and (optionally) a birth year the parent enters to tailor game difficulty. You do not have to provide a child's real name or exact birthdate.
• Captures (Contractual Necessity): Photos a child takes within the app and the virtual tiles collected. Photos are stored privately in your family's account. We automatically strip all EXIF and GPS location metadata prior to storing any image.
• Purchases (Contractual Necessity): When you buy a Vacation Pass or physical keepsake, our payment processor (Stripe) handles your payment card details directly. We only receive payment confirmations, billing details, and fulfillment transaction IDs.
• Basic Telemetry & App Logs (Legitimate Interests): Limited technical information (IP addresses, crash logs, device operating system) necessary to secure, maintain, and troubleshoot the service. We do not build advertising or cross-site tracking profiles.

3. What we do NOT do

• No third-party advertising, ad-tracking pixels, or marketing SDKs.
• No selling, renting, or monetization of personal information.
• No behavioral profiling or targeted advertising directed at children or adults.
• No public sharing of a child's photos or game activity by default.

4. Photos & sharing

Captures remain private to your family. Any feature that allows a photo to leave your family's private account requires explicit, affirmative action by the parent behind a Parent Gate. Location metadata is stripped from photos prior to cloud storage. High-resolution photos used to print physical keepsakes remain stored locally on your device until transmitted securely for printing.

5. Children's privacy (COPPA & GDPR-K)

We design specifically to comply with the U.S. Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code (AADC), and European GDPR child protection standards.

• Accounts must be registered by an adult parent or legal guardian.
• We collect only the minimum data required to deliver the game experience.
• Parents can review, edit, or delete a child's profile and photos at any time through the in-app Parent Zone, or request complete account deletion by contacting us.
• Participation is never conditioned on disclosing more data than is strictly necessary.

6. How we use information

We use collected data strictly to deliver and improve Buska: saving family collections across devices, generating physical keepsake books, processing order transactions, securing our infrastructure, and delivering customer support.

7. Service providers (data processors)

We contract with trusted service providers who process data strictly on our behalf under compliant data processing agreements:

• Supabase Inc. — database, user authentication, secure cloud storage
• Stripe, Inc. — payment processing
• Prodigi Group Ltd. — physical keepsake printing and global order fulfillment
• Cloudflare, Inc. — hosting, content delivery, and network security
• Resend, Inc. — transactional email delivery

8. Cookies & local storage

We use only essential session tokens and local device storage required to keep you authenticated and enable offline app functionality. We do not use third-party tracking cookies or advertising identifiers.

9. Data retention & deletion

Account data is retained while your account remains active. Parents can delete specific profiles and photo captures within the app at any time. You may request total deletion of your account and associated personal data by emailing privacy@buskaaruba.com. Deletion requests are processed within 30 days, subject to limited records retained to fulfill legal or tax compliance obligations (e.g., transaction records).

10. Your legal rights

Depending on your location (including the EEA, UK, and select U.S. states), you and your children have rights to access, rectify, delete, restrict, or export your personal data, or object to specific processing. Parents may exercise these rights on behalf of their children without penalty or discrimination by contacting privacy@buskaaruba.com.

11. International data transfers

Buska is operated out of Aruba, with server infrastructure maintained in secure data centers globally (including the United States and EU). Where data is transferred internationally, we ensure appropriate safeguards are implemented, including Standard Contractual Clauses approved by the European Commission.

12. Security

We employ technical and organizational safeguards including end-to-end transport encryption (HTTPS/TLS), restricted infrastructure access controls, private cloud storage buckets, and time-limited signed URLs for rendering media.

13. Changes to this policy

Material changes to this policy will be posted here with an updated effective date. If changes materially impact how child data is handled, we will notify parent account holders directly via email.

14. Contact us

Direct questions or statutory privacy requests to:
Gray Matters Communications V.O.F.
Email: privacy@buskaaruba.com
Address: L.G. Smith Blvd. #142, Oranjestad, Aruba

Read our Kids' Safety commitment →