Privacy Policy

HiCobi is an AI chat companion for neurodiverse children and teenagers, operated by Melt Candle Company, LLC, a company registered in the State of Washington, USA under registration number 604-048-603 (Washington UBI), with its registered office at 1022 Diane Ave, Oak Harbor, WA 98277, USA ("HiCobi", "we", "us", "our").

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Melt Candle Company, LLC is the data controller for the personal data described in this Policy. Where we act on the documented instructions of a school, clinic or therapy provider, we act as a processor for that organisation and their own privacy notice applies alongside this one.

This Policy applies to https://www.hicobi.ai, the parent dashboard, and the Cobi chat assistant wherever you reach it — Telegram (@cobi_ai_bot), WhatsApp (+1 510 588 5847), SMS, and email notifications. It is part of, and incorporated into, our Terms of Service.

Privacy questions, data-subject requests and complaints: [email protected].

HiCobi is designed to be used by children, but it is bought, set up and supervised by an adult. Accordingly:

• Only a person aged 18 or over who is the parent or legal guardian of the child (or is otherwise legally authorised to consent on the child's behalf) may create a HiCobi account.
• Children cannot create an account, provide payment details, or set up their own profile. A child's profile, channel (Telegram/WhatsApp), reminders and settings are created and controlled by the parent in the dashboard.
• By creating a child profile you confirm that you are that child's parent or guardian and you give verifiable consent, for the purposes of Article 8 GDPR and the U.S. Children's Online Privacy Protection Act (COPPA), to our collection and use of your child's personal data as described in this Policy. We verify that consent through the account you hold, the payment method you register, and the email address we confirm with you.
• You may withdraw that consent at any time by deleting the child profile in the dashboard or by emailing [email protected]. Withdrawal stops future processing and triggers deletion as described in section 12; it does not affect processing carried out before withdrawal.
• We do not knowingly collect personal data from a child who has not been registered by a parent or guardian, other than the limited "guest" data described in section 4.6. If you believe a child has contacted Cobi without parental involvement, contact [email protected] and we will delete that data promptly.

Children's data is never used for advertising, profiling for marketing, or any form of behavioural targeting.

4.1 Parent account data

• First and last name, email address, and a password (stored only as a salted cryptographic hash — we never store or see your password).
• Optional mobile phone number, if you provide one for SMS/WhatsApp notices.
• Your consent records: whether you accepted these documents and when, and whether you opted in to SMS/WhatsApp messages, with the date, time, the exact wording you agreed to, and the IP address used — we keep this as proof of consent, as messaging regulations require.
• Account role, language preference, login timestamps and session cookies.

4.2 Child profile data (provided by you)

• The child's first name or nickname, pet names they like to be called, and age or year of birth where you provide it.
• Communication style, interests, current goals, challenges, and known triggers or sensitivities.
• Topics you want Cobi to encourage and topics you forbid, plus any additional notes you write.
• Autism support level, and any other information about your child's neurodevelopmental profile that you choose to enter.
• The channel the child uses: Telegram username and chat ID, WhatsApp number, or mobile number.

4.3 Conversations

• The text of messages sent to and from Cobi, the platform they came through, the platform's message identifier, and timestamps.
• Groupings ("clusters") we build from consecutive messages so Cobi can answer a complete thought rather than each fragment.
• Voice notes: if a child sends a voice message on Telegram we download it, transcribe it to text, and use the text. The audio file is processed in memory and is not stored on our servers; the transcript is stored like any other message.
• Voice replies: when Cobi answers a voice note, we generate speech from the reply text and send it to the child. We do not keep the audio.
• Other attachment types (photos, stickers, files) are ignored and not stored.

4.4 Reports and insights we generate

We generate daily summaries for parents: a short narrative of the day's conversations, message counts, key topics, behavioural observations, progress notes and suggestions. These are stored with the child profile and made available to you in the dashboard and, where enabled, by email.

4.5 Technical and usage data

• IP address, browser and device type, operating system, referring page, pages viewed and approximate (city-level) location derived from IP.
• Server logs, error reports, and message-volume counters used for billing limits and abuse prevention.
• Cookies and similar technologies — see section 9.

4.6 "Guest" messages

Anyone can message the Cobi bot before registering, so a curious parent (or a child who found the bot) can try it. In that case we store the platform chat identifier and the message content in order to reply, to apply rate limits, and to keep the service safe. Guest conversations are not linked to any account, are not used to build a profile, and are deleted after 12 months of inactivity — or immediately on request.

4.7 Payment data

Subscriptions are processed by Stripe. We never receive or store your card number. We store the Stripe customer and subscription identifiers, your plan, status, renewal dates and invoice history.

HiCobi is a messaging product, so this section explains exactly what we send, how often, and how to stop it.

6.1 How you opt in

• Telegram: you (or your child, with your set-up) start the conversation by opening @cobi_ai_bot and pressing Start. Telegram requires that first action from the user before any bot can message them.
• WhatsApp: you message our WhatsApp number +1 510 588 5847 first, or you enter your WhatsApp number in the dashboard and confirm that you want Cobi to reach you there.
• SMS: we send SMS only if you tick the separate, optional SMS consent box at sign-up or later enable SMS in your account settings. That box is never pre-ticked, and you can create and use a HiCobi account without ticking it.
• When you enter a child's number or messaging handle, you confirm that you are the parent or guardian and that you consent, on your child's behalf, to Cobi messaging that number.

We record the date, time, wording and source of every opt-in so that we can demonstrate consent.

6.2 What we send and how often

Message frequency varies with your own use of the service. Message and data rates may apply, depending on your mobile plan. Carriers are not liable for delayed or undelivered messages.

6.3 How to stop messages

• SMS and WhatsApp: reply STOP to any message to cancel; reply HELP for help, or email [email protected]. After STOP we send one confirmation and then no further messages to that number. Reply START to opt back in.
• Telegram: use /stop, or block the bot in Telegram.
• Everything at once: turn off a channel in the dashboard, delete the child profile, or delete your account.
• Opting out of marketing does not stop essential service messages (for example billing or security notices) while your account is open.

6.4 What we never do with your number

6.5 Third-party messaging platforms

Telegram, WhatsApp (Meta) and your mobile carrier are independent controllers of the data they hold about you, including metadata about the messages they carry. Their handling of your data is governed by their own policies: Telegram Privacy Policy, WhatsApp Privacy Policy, Twilio Privacy Notice. We are not responsible for their practices.

Because HiCobi is used by children, we do not run it as a black box. Being clear about this matters more to us than sounding fully automated:

• A small number of authorised HiCobi staff can access conversations, and copies of exchanges are routed to a secured internal safety channel, so that we can monitor for distress, self-harm, abuse, grooming or misuse, verify that Cobi is responding appropriately, and fix problems that are reported to us.
• Access is limited to staff who need it for that purpose, is logged, and is subject to written confidentiality obligations.
• If we believe a child is at risk of serious harm, we may contact the parent or guardian on the account and, where we consider it necessary to protect someone's life or physical safety, the relevant authorities.
• As the parent, you can read your child's conversations in the dashboard. We recommend telling your child, in a way that suits them, that a parent can see these conversations and that a safety team may review them — Cobi is a supervised space, not a private diary.

Cobi's replies, transcriptions, voice output and daily summaries are produced with large language models and speech models run by specialist providers on our behalf, under data-processing agreements. To generate a reply, the relevant part of the conversation and the child's profile settings are sent to the model provider.

• We do not use your conversations, your child's profile, or your reports to train AI models, and our providers are contractually prohibited from using content submitted through our API accounts to train or improve their models.
• Providers may retain content for a short period for abuse monitoring, as set out in their enterprise terms, and then delete it.
• When Cobi generates an illustration for a reminder, only a short generated description of the scene is sent to the image provider — no names, no conversation content, no identifiers.
• Cobi's output is generated automatically and can be wrong. We do not make decisions that produce legal or similarly significant effects about you or your child by purely automated means. The daily report is a summary for a parent to interpret — it is not a diagnosis, an assessment or clinical advice.

• Strictly necessary cookies keep you logged in and protect the forms on our site. They cannot be switched off and require no consent.
• Analytics and advertising measurement. Our website uses Google Analytics and Google Tag Manager to understand how visitors find and use the site, and to measure our advertising. We record events such as a page view, a sign-up, a click through to Telegram or WhatsApp, and a completed purchase.
• These cookies are used only on our public website, which is aimed at parents and professionals. There is no advertising, tracking or profiling inside the chat with your child.
• You can refuse or delete cookies in your browser, use Google's opt-out add-on, or, where we show a cookie banner, decline non-essential cookies. Doing so does not affect the chat service.

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share it only with the service providers below, each under a written contract that limits them to processing it on our instructions:

We may also disclose personal data:

• to professional advisers (lawyers, accountants, auditors) bound by confidentiality;
• where we must, to comply with a law, a court order or a valid request from an authority — we review every request, refuse those that are overbroad, and tell you unless legally prohibited;
• to protect the vital interests of a child or another person, or to establish, exercise or defend legal claims;
• to a buyer or successor if we are involved in a merger, acquisition or restructuring — we will notify you beforehand and this Policy will continue to apply to data transferred, or you will be asked to accept a new one.

Our servers and database are located in the European Union (France). Some of the providers listed in section 10 are established in the United States or process data there, so your data may be transferred outside the European Economic Area.

Where that happens we rely on one or more of these safeguards:

• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), together with a transfer risk assessment;
• an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified;
• technical measures such as encryption in transit and access controls at the recipient.

You can request a copy of the relevant safeguards by emailing [email protected].

When we no longer need data for the purposes above, we delete it or irreversibly anonymise it so that it can no longer be linked to you or your child.

We take the security of a child's conversations seriously and apply measures appropriate to how sensitive that data is:

• Encryption in transit. All traffic to hicobi.ai and to our APIs is encrypted with TLS (HTTPS). Traffic to our messaging, AI and payment providers is likewise encrypted.
• Passwords. Stored only as salted scrypt hashes and compared in constant time. Nobody at HiCobi can read your password.
• Network isolation. Our database is not reachable from the public internet; it accepts connections only from the application server.
• Least privilege. Administrative access is limited to the small number of staff who need it, is individually accounted for, and is removed when someone changes role or leaves.
• Authenticated webhooks. Inbound messages from Telegram and Twilio are signature-validated, so a third party cannot inject messages into a conversation.
• Payment isolation. Card data is captured directly by Stripe, a PCI-DSS Level 1 provider, and never touches our servers.
• Segregation and backups. Encrypted backups, separated production and development environments, and logging of administrative access.
• Vendor diligence. Data-processing agreements with every provider listed in section 10, and periodic review of them.

No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs that is likely to result in a risk to people's rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it and, where the risk is high, notify affected parents without undue delay, telling you what happened, what data was involved and what you should do.

Please help us: use a strong, unique password, keep it private, and tell us at [email protected] immediately if you think your account has been accessed by someone else. You are responsible for the security of the device and messaging app your child uses.

Under the GDPR and equivalent laws you have the rights below. Where the data concerns your child, you exercise them on your child's behalf; as children grow older they may exercise these rights themselves, and we will take their wishes into account.

• Access — a copy of the personal data we hold.
• Rectification — correction of anything inaccurate; most of it you can edit yourself in the dashboard.
• Erasure — deletion of a child profile, its conversations, or your whole account.
• Restriction — pause our processing while a dispute is resolved.
• Portability — your data in a structured, machine-readable format, or sent directly to another provider.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time and without reason.
• Withdraw consent — at any time, including consent to health-related profile details and to SMS, WhatsApp or Telegram messages.
• Complain — to a supervisory authority.

To exercise any of these, email [email protected] from the address on your account, or use the delete and export controls in the dashboard. We reply within 30 days (extendable by two months for complex requests, in which case we will tell you). We may need to verify your identity first. These rights are free to exercise.

If you are in the EEA you may complain to your local data protection authority; in the UK, to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve it with you first.

Residents of California and other US states

You have the right to know what personal information we collect and how we use and disclose it, to access and delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of — but you may still contact us at [email protected] and we will honour your request. An authorised agent may submit a request with written proof of authority.

We update this Policy when the service or the law changes. The version and dates at the top always show the current text. If a change is material — for example a new purpose, a new category of recipient, or anything that reduces your protections — we will notify you by email or in the dashboard at least 14 days before it takes effect, and where the law requires it we will ask for your consent again. Continuing to use HiCobi after a change takes effect means you accept the updated Policy.

Previous versions are available on request from [email protected].

• Privacy and data-subject requests: [email protected]
• Legal notices: [email protected]
• Everything else: [email protected]
• Post: Melt Candle Company, LLC, 1022 Diane Ave, Oak Harbor, WA 98277, USA

Melt Candle Company, LLC · registration number 604-048-603 (Washington UBI) · the State of Washington, USA