Your privacy, gently kept.

The short version

• Your kitten lives on your phone. Their name, state, progress, keepsakes, memories and your settings are stored on your device. We don’t receive them.
• No ads, no selling. There is no third-party advertising in Lulopi, and we don’t sell or share your personal information.
• Some technical data is unavoidable. When the app downloads room clips, or you visit this website, our hosting provider Cloudflare processes your IP address and basic request details so the content can reach you securely.
• The waitlist is opt-in. You join it by confirming from an email we send you, and we use your email address only to tell you when Lulopi launches.
• You have rights to access, correct and delete your information, and to complain to a regulator. See GDPR rights and Your California Privacy Rights.

Who we are

Lulopi (the “app”) and lulopi.my (the “website”) are provided by Sansa Group AB, a company registered in Sweden. Lulopi is made by Sansavision, a division of Sansa Group AB. Sansa Group AB is the controller of the personal data described in this policy (“we”, “us”).

We have not appointed a data protection officer. Please send any privacy question or request to support@lulopi.my.

Information that stays on your device

To give your kitten a life of their own, the app keeps the following on your device:

• your companion’s name and state (such as hunger, energy, joy, mood and outfit);
• your progress, keepsakes, memories and any small things you write down;
• your settings and preferences (for example sound, music, haptics and the time-of-day mode);
• the small amount of data your Home Screen and Lock Screen widgets need to show your kitten, shared only between the app and its widgets on the same device.

This information is not sent to us, and we can’t see it. Deleting the app removes it from your device. Your device’s own backup service (such as iCloud or Google backups, if you use them) may include app data under that provider’s terms.

Downloading room clips

Some of Lulopi’s painted room clips are downloaded when the app needs them, from our media service at media.lulopi.my, which runs on Cloudflare’s network and storage.

As with any internet request, this involves processing your IP address, the file requested, the time of the request and basic technical information such as your device’s user agent. We use this only to deliver the content, keep the service secure and fix problems. We do not use it to identify you or build a profile.

Legal basis: our legitimate interest in delivering the app’s content reliably and securely (GDPR Art. 6(1)(f)).

Visiting this website

This website is hosted on Cloudflare. When you visit, Cloudflare processes your IP address and request details (pages and files requested, time, browser type and referring page) to serve the site, protect it against abuse and help us diagnose errors. These logs are kept for a short time, typically no more than 30 days, unless needed to investigate a security incident.

We don’t use advertising or tracking cookies, and we don’t currently use analytics on this website. Our fonts are hosted on our own domain, so loading a page doesn’t contact third-party font services. Cloudflare may set strictly necessary security cookies to protect the site from bots and attacks.

Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f)).

The launch waitlist

If you join the waitlist, we collect your email address, the platform you choose (if any), where on the site you signed up, a record of your consent (the time and the wording you agreed to) and, once you confirm, the time you confirmed.

Double opt-in. Signing up sends you one email with a button to confirm. You’re only on the list once you’ve tapped it. If you don’t confirm within 7 days, we delete the sign-up. If you sign up again with an address that’s already on the list, we send that address a short note saying so, and change nothing.

We use your address for one thing: to email you when Lulopi is available. We won’t add you to other marketing without asking. Every email includes a link to leave the list, or you can write to support@lulopi.my at any time. Leaving deletes your address from the list straight away.

To stop abuse, we briefly keep a keyed hash of your IP address and of your email address (not the addresses themselves) to limit how often sign-ups and emails can be sent. These are deleted within a day.

Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time. Retention: until you unsubscribe, or at the latest 12 months after the app launches on your chosen platform, whichever comes first. Sign-ups that aren’t confirmed are deleted after 7 days.

Where it’s kept. Sansa Group AB keeps the list on Cloudflare: in a Cloudflare D1 database located in Western Europe, with the emails sent through Cloudflare Email Service from support@lulopi.my. Cloudflare, Inc. acts as our processor.

When you contact us

If you email us, we use your email address, your message and anything you choose to include to reply and help. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or taking steps you request in connection with our terms (Art. 6(1)(b)). Retention: up to 24 months after the conversation ends, unless we need it longer to handle a legal claim.

In-app purchases and Lulopi Club

Lulopi is free to download. If you buy something in the app or join the optional Lulopi Club membership, the purchase is handled by Apple’s App Store or Google Play. They process your payment details under their own privacy policies; we never receive your card or bank details.

We receive limited transaction information from the store (such as the product, purchase or renewal status and a transaction identifier) so the app can unlock what you bought, restore purchases and handle questions. Legal basis: performance of our contract with you (Art. 6(1)(b)) and our legal obligations, for example bookkeeping (Art. 6(1)(c)). Retention: for as long as needed to provide what you bought and as required by accounting law (in Sweden, generally seven years).

Optional account and cloud sync (planned)

Lulopi does not currently offer accounts or cloud sync. We plan to offer an optional account later, so you can back up your kitten and use them on more than one device.

If you choose to use it, we would process a sign-in identifier (such as your email address or an identifier from Sign in with Apple or Google), and the companion data you choose to sync. We would use it only to provide the account and sync. Legal basis: performance of our contract with you (Art. 6(1)(b)). You would be able to delete your account and synced data at any time.

Before this feature goes live we will update this policy and tell you in the app. Using Lulopi without an account will remain possible.

Analytics and diagnostics

Lulopi does not currently include third-party analytics, advertising or tracking SDKs, and does not track you across other companies’ apps or websites.

Apple and Google may give us aggregated statistics (for example, download numbers) and crash reports from people who have chosen in their device settings to share diagnostics with app developers. These reports don’t identify you to us.

If we add analytics or crash reporting in the future, we will update this policy first and, where the law requires it, ask for your consent.

Who we share information with

We don’t sell personal information, and we don’t share it for cross-context behavioural advertising. We only share it with:

• Service providers (processors) that act on our instructions under a data processing agreement: Cloudflare, Inc. (website hosting, content delivery, media storage and security, and storing the launch waitlist and sending its emails).
• Apple and Google, which run the app stores and process purchases as independent controllers under their own terms.
• Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
• Authorities, where we are legally required to, or to protect rights, safety and security.
• A successor, if all or part of our business is reorganised, sold or transferred, in which case this policy will continue to protect your information.

International transfers

We are based in Sweden, in the EU. Cloudflare operates a global network, so your request may be handled by a data centre outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework, where the recipient is certified) or the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards. See also GDPR rights.

How long we keep information

• On-device app data: until you delete it or the app. We don’t hold a copy.
• Website and media delivery logs: a short time, typically no more than 30 days.
• Waitlist: until you unsubscribe, or at most 12 months after launch on your chosen platform. Sign-ups that aren’t confirmed: 7 days.
• Support emails: up to 24 months after the conversation ends.
• Purchase records: as long as needed to provide what you bought, and as required by accounting law.
• Optional account (if introduced): until you delete your account, plus a short period for backups to expire.

Security

We use encryption in transit (HTTPS) for the website and media downloads, limit who can access personal data, and choose providers with strong security practices. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent. You can also complain to a data protection authority. In Sweden that is IMY, the Swedish Authority for Privacy Protection.

To use your rights, email support@lulopi.my. Because most app data never leaves your device, the quickest way to remove it is to delete the app or use the options in the app’s Settings.

More detail: GDPR rights (EEA, UK and Switzerland) and Your California Privacy Rights.

Children

Lulopi is a general-audience app. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13 (or under the age of digital consent where you live; in Sweden this is 13). The waitlist is intended for people who are old enough to consent for themselves.

If you believe a child has given us personal information, please contact support@lulopi.my and we will delete it.

Changes to this policy

We’ll update this policy when our practices change, for example before we launch accounts, cloud sync or analytics. We’ll change the date at the top and, for significant changes, tell you in the app or by email if you’re on the waitlist.

Contact