Last updated: 8 October 2026 · Version 4.0
Privacy Notice
Privacy matters especially when a product is used by families and children. Gulino is designed around data minimisation and a local-first approach: information stays on the device when a cloud service is not needed for the feature. This notice explains what actually happens to personal data when you use Gulino.
On this page
1. Who we are
GULO GULO SRL
CUI: 42846715
Trade Register: J2020003193239
contact@gulino.app
GULO GULO SRL is the controller for the processing described here. We have not appointed a Data Protection Officer; privacy questions go to the address above.
2. Who uses Gulino
The parent or legal guardian installs Gulino, creates the account where one is used, accepts the Terms and chooses the people, apps and tools that appear on the child's phone.
The child uses the experience the parent configured. A child does not create an account, does not accept the Terms, and is never asked for credentials of their own. The service relationship is with the adult.
3. What data Gulino handles
Gulino is an application that helps a parent configure a simpler, child-oriented experience on a compatible Android phone. It is not designed as a monitoring product. It does not collect screen time, app-usage statistics, browsing history, continuous location, or a date of birth. There is no advertising identifier, no analytics and no crash-reporting service in the app.
A. Parent account
A Parent account is an identity with our authentication provider, Google Firebase Authentication (see section 7). It holds your email address, a display name, an account identifier and whether the email address has been verified. Used to sign in, to let you recover a forgotten Parent PIN, and to confirm it is you before the account is deleted. Held in the cloud. Alongside it we keep the service identifiers that connect your account to the Gulino setup on your phone (see A2) and, once you subscribe, the subscription information described in I. We do not build a profile about you.
You sign in with an email address and a password you set, held by Firebase Authentication. A forgotten password is reset through the email Firebase sends. That is the only sign-in method Gulino offers.
Signing in to Gulino does not use a Google account. Subscribing does: the subscription is bought through Google Play, with the Google account signed in to Google Play on the phone where you subscribe (see I).
A2. Gulino Space
Every child phone belongs to a Gulino Space: the record that connects your Parent Account to the setup on that phone. It holds service identifiers and timestamps — random identifiers for the setup, the child and the phone, your account identifier, and the app version — and no names, addresses, relationships or anything else about the child or the household. Held in the cloud, in our database in the European Union, and reachable only by the account the setup belongs to. It has a single purpose: to make sure that only a Parent Account connected to this child's setup can sign in on the child's phone. A Space belongs only to the account that created it. It is created during first setup and removed when the account is deleted (see section 9).
B. Child profile
The child's display name or nickname, a randomly generated internal identifier, and the buddy theme they chose. Stored on the phone. The identifier alone — not the name — is also recorded in the Gulino Space (A2), so the phone can be tied to the right child. The child's name is not uploaded to our servers.
C. Approved people
For each contact a parent adds: the name the parent typed, the phone number, the directional permissions (calls in, calls out, messages in, messages out), whether the contact is an SOS contact, and an optional emoji or a picture the parent chose. Stored on the phone. None of this is uploaded to our servers.
When a parent uses contact import, only the entries the parent actually selects are kept.
D. Device configuration
The set of choices a parent has made — the approved contacts, the approved app list (the apps the parent selected), the SOS configuration, and device settings such as whether Child Mode is on. This is stored on the phone only, in Gulino's private storage. It is not uploaded to our servers: we hold no cloud copy of a child's configuration.
E. Location, and only for SOS
Gulino requests location only for SOS. When a child triggers SOS, Gulino reads the most recent position the phone already has and includes a map link in the alert message. Afterwards, for up to the time the parent chose in Gulino (two hours unless changed, and never more than 24 hours), or until a parent stops it, it sends further updates when the child has moved meaningfully.
- Where it goes: by SMS, to the SOS contacts the parent configured. It is not sent to us and is not stored on our servers.
- What we keep: nothing. Gulino does not build a location history, has no map view, and cannot show where a child has been.
- What the child sees: a notification for as long as sharing is active. The child cannot stop it by accident; a parent stops it from Parent Mode.
- What it is not: Gulino does not keep a location history and does not offer general ongoing location tracking. Location is shared only during an active SOS period, with the contacts the parent chose.
F. Calls and messages
Message text is composed and stored on the phone. Gulino does not upload message content. Calls are placed through the phone's own calling. Gulino uses call information on the phone to show missed-call badges and to notice when an SOS call has ended, so that the next SOS contact can be called, and does not copy it anywhere.
G. Photos and video
Pictures the child takes with Gulino's camera are saved to the phone's own gallery, in Gulino folders. Gulino does not upload them. Gulino Photos shows the child only the pictures taken with Gulino's camera; Gulino does not open the other photos and videos on the phone.
H. Website
Standard request and security information handled by our hosting provider, and the session cookie described in section 13. Email you send us is held in our mailbox.
I. Subscription and purchases
Gulino is a paid service, offered as an annual subscription bought through Google Play. Google processes the purchase and the payment. Your card or bank details are given to Google, not to us: Gulino never receives them and never stores them.
To confirm that your Parent account has access, Gulino receives limited purchase and subscription information from Google Play: the subscription's status (for example free trial, active, cancelled or expired), when it renews or ends and whether it renews automatically, which Gulino subscription it is, and Google Play's identifiers for the purchase and the order. Google Play also tells us when that status changes, for example when the subscription renews, is cancelled or ends. We link this information to your Parent account, so that the subscription works for that account and cannot be used by a different one while the account exists. If you delete the account and keep the subscription, it can be linked to a new Gulino account with Restore purchase. To protect this service from abuse, our servers also keep the times of your account's recent requests to confirm a subscription, used only to limit how often an account can ask. Held in the cloud, in our database in the European Union; your account can read its subscription status, and only our servers can change it. It contains nothing about your child.
The phone keeps a copy of the last status our servers confirmed, so that the app knows whether Child Mode can be started, including for a short time without internet. That copy is cleared when you delete your account.
J. Analytics and crash reporting
None. Gulino does not use analytics, crash-reporting or advertising services in the app.
4. What never leaves the phone
Gulino keeps the following on the phone and does not upload it:
- The Parent PIN. It stays on the phone, is not kept in readable form and is not sent to us.
- The child profile, approved people, SOS settings, approved app list and theme. Stored in Gulino's own storage on the phone.
- Message content. Gulino's own messages are on the phone. Message text is not sent to us.
- Photos and videos. Saved to the phone's gallery, and not uploaded by Gulino.
- Contact pictures. The image stays on the device.
- Your acceptance of the Terms and this notice. Recorded on the phone only: which versions were accepted and when. No identifier of you or the phone.
- Card and bank details. Gulino never receives them, on the phone or anywhere else; Google Play handles payment.
Uninstall, clear storage or reset
Gulino keeps information on the phone wherever it can, and for privacy it does not back that information up to the cloud — not to us, and not to the phone owner's Google account. The trade-off is deliberate: if Gulino is uninstalled, its storage is cleared or the phone is reset, those local settings are gone with the app and are configured again after a reinstall. Signing in again restores the Parent account only — not the Parent PIN, the child profile or the approved people. This is intended behaviour, not a backup failure.
5. Why we process it, and our legal basis
Accepting this notice is not a legal basis for anything, and we do not treat it as one. Each purpose has its own basis.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run the parent account | Email, credential, identifier | Performance of a contract (Art 6(1)(b)) |
| Verify a parent before a PIN reset | Account re-authentication | Contract and our legitimate interest in keeping the gate closed (Art 6(1)(b), 6(1)(f)) |
| Hold the child's profile and the parent's configuration | Child name, contacts, app list, settings | Our legitimate interest, and the parent's, in a phone that works as configured (Art 6(1)(f)) |
| Let the child call and message approved people | Contact identifiers, message text | Contract (Art 6(1)(b)) |
| SOS alerting and location follow-up | Child name, SOS numbers, position | Vital interests of the child (Art 6(1)(d)), and our legitimate interest in the feature working (Art 6(1)(f)) |
| Provide the subscription and confirm your access | Subscription status and dates, the subscription bought, Google Play purchase and order identifiers, account identifier | Performance of a contract (Art 6(1)(b)) |
| Make sure a subscription is used only by the account that bought it | Google Play purchase identifiers linked to the account identifier; after an account is deleted, the note that it was deleted | Legitimate interest in preventing misuse of purchases (Art 6(1)(f)) |
| Keep the service secure and prevent abuse | Account and request information | Legitimate interest (Art 6(1)(f)) |
| Meet legal and accounting duties | Whatever the law requires | Legal obligation (Art 6(1)(c)) |
Where we rely on legitimate interests, we have weighed them against the interests of the child and the parent, and we will provide a summary of that assessment on request.
6. Children
Gulino is designed to be configured by a parent or legal guardian for a child's use. Children deserve additional protection, so we have kept their data to the minimum the product needs:
- We do not collect a child's age or date of birth.
- A child cannot create an account with us and is never asked to accept legal terms.
- We do not profile a child, and we do not build behavioural records of what they do.
Because Gulino is not offered directly to a child as an online service — the adult sets it up and holds the relationship — we do not rely on a child's consent for this processing. Where consent is ever the applicable basis for a service offered directly to a child, we apply the parental-authorisation requirements of the applicable law; in Romania that threshold is 16.
7. Who else is involved
| Service | What for | What they handle | Where |
|---|---|---|---|
| Google — Firebase Authentication | Parent sign-in | Email, display name, password, account identifier, connection information | Google infrastructure; not restricted to the EU |
| Google — Cloud Firestore and Cloud Functions for Firebase | Storing the link between your account and your phone's setup, so that sign-in stays restricted to your own setup; confirming subscriptions with Google Play and storing their status | Service identifiers, timestamps and the subscription information described in section 3 I. No names, numbers or settings | European Union |
| Google — Google Play | Selling the subscription and taking payment | Your Google account, your payment method and the purchase. Card and bank details stay with Google | Google infrastructure; not restricted to the EU |
| Cloudflare | Hosting this website | Request and security information, the session cookie | Global edge network |
| Your mobile network operator | Delivering calls and SMS, including SOS alerts | Message content and numbers, as for any SMS | Your carrier |
These providers act on our instructions under data-processing agreements, except your carrier and the contacts a parent chooses, who receive information in their own right, and Google Play, which handles your purchase and payment in its own right under Google Play's terms and privacy policy.
We do not share personal data with anyone else, and we do not hand it to advertisers, data brokers or analytics companies.
8. Advertising and selling data
We do not sell personal data, and we never sell children's personal data.
We do not use children's personal data for behavioural advertising. Gulino uses no advertising, tracking or analytics services in the app.
An app that a parent approves is a separate product with its own privacy practices, which may include advertising. See Safety.
9. How long we keep things
| What | How long |
|---|---|
| Parent account and Gulino Space | Until you delete the account in the app or ask us to, then removed |
| Subscription information (status, dates, Google Play purchase identifiers) | While your Parent account exists; deleted when the account is deleted. Only a note that the account was deleted remains — a one-way code made from the account's identifier and the date, with no email address, name or purchase identifiers — so that a subscription you keep can be linked to a new Gulino account. Google keeps its own records of the purchase under its own policies |
| The child's configuration on the phone | Until you change it, or until Gulino is removed or its storage cleared |
| Contacts a parent removes | Removed when the parent removes them |
| Location | Not retained at all. It is used for the alert and discarded |
| SOS location sharing | Stops after the time the parent chose (two hours unless changed, at most 24 hours), or sooner if a parent stops it |
| Messages, photos and video on the phone | They are yours and stay on the device until you delete them or remove the app |
| Email you send us | While we handle your request and for a reasonable period afterwards |
| Records the law requires us to keep | For the period the law sets; see below |
Deleting your account
You can delete your Parent account in the app: Parent Mode → Account & Security → Delete account. The app shows what will be deleted, then asks you to confirm it is you — not with the Parent PIN, but with the account password — and then for a final confirmation. The same check protects a forgotten Parent PIN: once the app has verified your account, you can set a new PIN; the old PIN is not shown. You can also write to contact@gulino.app from the account's email address with the subject Delete my account; we confirm it is you and aim to complete the request within 30 days. Both routes are described in full at gulino.app/account-deletion.
What deletion removes
From our servers: the Parent account with our authentication provider, and the Gulino Space this phone belongs to, with the service identifiers that linked your account to this setup. The account itself is deleted last, once the rest has been removed; the subscription information linked to it is then deleted by our servers, leaving only the note that the account was deleted (see the table above). On the phone: all of Gulino's private storage — the stored Parent PIN, child profile, approved people, SOS settings, app allowlist, message store, acceptance record, account link and the stored subscription status — and the app returns to its first-run state. Photos and videos in the gallery, Android's SMS storage and other apps are not touched.
Deleting your Gulino account does not cancel a Google Play subscription. Google Play keeps renewing it until you cancel it in Google Play, so cancel it there first if you no longer want it. Google keeps its own records of the purchase under its own policies. How to cancel is explained at gulino.app/account-deletion.
What may remain after deletion
Deleting your account permanently removes your Gulino Parent account and Gulino-controlled active child/device data associated with it. We may retain limited information where required by law, such as accounting records relating to a purchase, or where necessary to establish, exercise or defend legal claims. Such information is restricted to those purposes and is not used as an active Gulino account.
- Accounting records. Google Play sells the subscription and gives us sales and payout reports for our accounts. Where accounting law requires us to keep those records, we keep them for the period it sets — 5 years under Romanian law (Legea contabilității nr. 82/1991, art. 25, as amended by Legea nr. 36/2023). They hold purchase information only — never the child's data — and are not linked to an active Gulino account.
- Legal claims: decided case by case, and only when a real dispute, security incident or legal obligation exists. There is no standing legal hold. Anything held is minimal, kept apart from product data, access-restricted, not used for the product, and released when the reason ends.
- Anything retained for these reasons is kept apart from the product and cannot be used as a Gulino account.
10. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing based on legitimate interests. Where processing is based on consent you can withdraw it at any time, as easily as you gave it, and where it is based on a contract you can ask for your data in a portable form.
Write to contact@gulino.app. We will ask enough to be sure who you are.
Parents may exercise these rights on behalf of their child where the law allows. A person whose number a parent added as a contact can write to us too; we will explain what we can and cannot do.
For questions or concerns about your personal data, contact us at contact@gulino.app. You also have the right to lodge a complaint with the competent supervisory authority.
Erasure. You do not need to write to us to delete your account: the app does it, from Parent Mode → Account & Security → Delete account. What that removes, what it leaves alone and the email alternative are set out at gulino.app/account-deletion.
11. Security
We use appropriate technical and organisational measures to protect the information Gulino handles. In particular:
- connections between the app and our service providers are encrypted;
- access to account information in the cloud is restricted to the account it belongs to;
- your subscription status can be changed only by our servers, after Google Play has confirmed the purchase;
- the child's configuration is kept on the phone, and the Parent PIN stays on the phone in a form we cannot read back;
- the app asks only for the permissions the features you use actually need.
No service can eliminate every security risk, and we do not claim otherwise.
12. International transfers
Our database is located in the European Union. Some provider infrastructure — sign-in and Google Play in particular — operates globally, so personal data may be processed outside the European Economic Area. Where that happens we rely on the transfer mechanisms our providers make available, such as the European Commission's standard contractual clauses or an adequacy decision.
13. Website and cookies
This website currently uses only strictly necessary storage: a session cookie for the site's access control, and the security cookies our hosting provider sets. There is no analytics, no advertising pixel, no third-party script and no tracking of any kind — so there is nothing to consent to and we have not put a banner in your way.
If we ever add anything non-essential, we will ask for your consent before it loads and make it as easy to withdraw.
14. Changes and contact
When we change this notice we update the date at the top. If a change materially affects how we handle your data, we will tell you rather than quietly re-publishing the page.
GULO GULO SRL
CUI: 42846715 · Trade Register: J2020003193239
contact@gulino.app