mebobox

Mebobox Privacy Notice

How Mebobox handles data across the Mebobox console and the Library store

Version 0.3 (draft)

TEMPLATE — NOT LEGAL ADVICE. This is a drafting starting point, not finalised legal advice. Have a qualified solicitor (or data-protection adviser) review it before use. Governing law is assumed to be England & Wales.

In short

1. Who we are

Mebobox Ltd is responsible for the personal data described in this notice (the "data controller").

2. What this notice covers

This notice covers your use of the Mebobox console, our website at mebobox.com, and the Library store and account. It sits alongside the Mebobox Terms of Use and the Library Account Terms.

Where something applies to only one of those, this notice says so. In particular, §4a (Analytics on our website) applies to the website and to nothing else.

3. Software from the Library

Software you download from the Library (for example, games) is prohibited from collecting data about you. This notice is about the limited data that Mebobox itself handles to run the service.

4. What we collect

We do not ask for more personal data than we need, and we do not collect special-category data.

4a. Usage analytics — our website only

This section is about mebobox.com and nothing else. It does not apply to the Mebobox console, and it does not apply to games — the console does not send us analytics, and a game may not collect anything about a player at all (see §3).

Still to review: analytics is now gated behind consent, which is what UK and EU rules expect for analytics cookies. The Age Appropriate Design Code sets a higher bar again for a service likely to be used by children — have this section, and the wording of the consent bar, reviewed against it before launch.

4b. Your console

The Mebobox console carries no third-party code of any kind. No third-party cookies, no analytics service, no advertising or tracking SDK, no fonts or scripts fetched from anyone else. Games are packaged to run entirely offline and are blocked from reaching the internet at all, so nothing about your play leaves the box to a third party.

The console does send one thing, to Mebobox and only to Mebobox: a periodic list of which games are installed on it and how many times each has been launched, identified by the console's own serial number. That is how a console knows when a game has an update, and how your account can show you what is on your Mebobox. It contains no personal data, no names, no contact details and nothing about who is playing.

4c. mebo, the Creator Studio helper

Creator Studio — the part of our website where a child builds a game from blocks — includes an optional AI helper called mebo. He does two things: he turns a few tap-to-choose answers into the starting point of a game, and he answers "why isn't this working?" while a child is building. Using him is always a choice; every other part of Creator Studio works without him.

What is sent. When a child asks mebo something, we send Google's Vertex AI service: the short piece of text the child typed, a summary of the blocks in their game (the words printed on the blocks, and the names they have given their own pictures and sounds), and any problems our automatic checks have already found. Nothing that identifies the child is sent — not their name, their username, their email address, their account or their console.

What is refused before it is sent. We check what a child types before it leaves our servers, and refuse to send anything containing an email address, a web address, a phone number, an @name, or a long number, along with anything that breaks our house rules. A refused message is not sent to Google.

What we keep, and who can see it. We store what the child asked and what mebo replied — including messages we refused — for 30 days, and then delete them automatically. We keep them so that a parent or guardian, or our own staff, can review what a child has been asking and check that our safeguards are working. This is a safeguarding measure, and we tell children plainly, in the product, that a grown-up can see what they ask mebo. Ask us and we will show you your child's history, or delete it.

Google as our processor. Vertex AI acts as our processor: it answers our request and nothing more. Google does not use this content to train its models, and we do not allow it to be used for advertising. Processing may take place outside the UK or EEA, under the safeguards described in §7.

No profiling, no decisions about a child. mebo helps somebody make a game. He does not build a profile, does not make any decision that affects a child, and is not used to moderate, rank or judge them.

5. How we use your data

We use your data to: create and run your account; deliver and let you re-download your software and purchases; provide support; keep the service safe and prevent fraud; meet our legal obligations; understand how our website is used (§4a); and operate, improve and develop our products and services (including by using aggregated, anonymised and de-identified data).

6. What we don't do

We do not use your data for advertising. We do not sell your personal data, and we do not share it with third parties for their own purposes. Our website analytics provider (§4a) acts on our behalf, and we have turned off the settings that would let that data be used for advertising or cross-device tracking.

7. When we share data

We use service providers (such as analytics, payment, hosting and support providers) who act on our behalf and only on our instructions. Some of them, including our website analytics provider, may process data outside the UK or EEA; where that happens, we rely on the safeguards required by data-protection law. We may disclose data where the law requires, or to protect the safety, rights or security of people or of the service. If our business is reorganised, sold or transferred, data may pass to the new owner, who must continue to honour this notice.

8. Children

The Mebobox is used by children and adults, and an adult should set up and manage a child's account. We do not verify ages. We limit the data we collect about children to what is necessary, and we handle children's data in line with the UK Age Appropriate Design Code, the UK GDPR and the US COPPA, as applicable.

The console does not profile children. It runs no third-party code and sets no third-party cookies (§4b), and games are prohibited from collecting anything about a player (§3). The measurement described in §4a happens only when someone visits our website.

The Creator Studio helper (§4c) is the one place where words a child has written are sent to a third party. It is optional, it is limited to making games, what is sent carries nothing identifying, and what is said is kept for 30 days so that an adult can review it. An adult managing a child's account can ask us for that history, or ask us to delete it, at any time.

9. How long we keep data

We keep personal data only as long as needed for the purposes in this notice, or as the law requires; after that we delete or anonymise it. Website analytics data is kept for no longer than the retention period set in our analytics account. Creator Studio helper conversations (§4c) are kept for 30 days and then deleted automatically.

10. Your rights

Depending on where you live, you can ask to access, correct, delete, restrict or port your personal data, or object to its use. To exercise your rights, or for any privacy question, contact Mebobox through the support options provided on your Mebobox or in the Library. You can also complain to your data-protection regulator (in the UK, the Information Commissioner's Office).

11. Changes to this notice

We may update this notice. For material changes, we will make the updated notice available and, where appropriate, give notice.

12. Contact

Contact Mebobox through the support options provided on your Mebobox or in the Library.

← Back to mebobox