Privacy notice
This notice explains what personal data Tala collects, why we collect it and what you can do about it. It is written for parents and guardians. There is also a version for kids.
Last updated 3 November 2026
Who we are
Tala is run by Pastelero (“we”, “us”). We decide how and why your personal data is used, which makes us the personal information controller under the Data Privacy Act of 2012 (Republic Act 10173). For any privacy question or request, email privacy@tala.kids.
What we collect
About you, the parent or guardian
- Your name and email address from your Google account, which you use to sign in. We never see your Google password.
- The name you choose to display, your time zone and your daily-limit setting.
- Your 4-digit parent PIN, stored only as a salted hash.
- When you gave consent for your children to use Tala.
- Your plan and subscription status from Paddle, including Paddle’s customer, subscription and transaction IDs. We never receive your full card number.
About each child
- A nickname, a Kislap colour and an age band (Little 3–5, Explorer 6–8 or Thinker 9–12).
- Learning activity: the Dream Paths they follow, lessons finished, answers and scores, XP, badges, streak days, minutes spent and review schedule. We use this to choose what comes next for them and to write your weekly note.
- From age 6, every message your child sends to Kislap and every reply, plus any safety flags. Children under 6 cannot chat with Kislap freely.
We never ask a child for an email address, phone number, photo, school, birthday, location or real full name. If a child types personal details into a Kislap chat, our filter holds the message back from the AI. The held message is still saved so that you can see it in the transcript.
Technical data
Our hosting provider records standard server logs, such as IP address, browser type and the time of a request, to keep the service running and secure. We use only the cookies needed to keep you signed in and to remember kid mode on your device. We don’t use advertising or cross-site tracking cookies.
Why we use it, and on what basis
- To provide Tala: your account, kid profiles, lessons, progress, Kislap and the parent dashboard. Basis: our contract with you, and your consent as parent or guardian for your child’s data.
- To keep kids safe: filtering chats, flagging worrying messages and showing you transcripts. Basis: your consent and our legitimate interest in protecting children.
- To take payments and keep billing records. Basis: our contract with you and our legal obligations under tax law.
- To keep the service secure and fix problems. Basis: our legitimate interest in running a safe, working service.
We never sell personal data, never use it for advertising and never use your child’s data to build a marketing profile.
Who processes it for us
These companies process data on our behalf, only to provide Tala. Some of them process data outside the Philippines, including in Singapore and the United States.
| Processor | What it does |
|---|---|
| Supabase | Database and sign-in. Stores account, child profile, progress and chat data in Singapore. |
| Lets you sign in with your Google account. Shares your name, email address and profile picture with us when you sign in. | |
| Vercel | Hosts the website and runs our server code. Its AI Gateway passes Kislap messages to Anthropic. |
| Anthropic | Makes Claude, the AI model that writes Kislap’s replies. Receives filtered chat messages, the current lesson and the child’s age band. |
| Paddle | Our reseller and merchant of record (Paddle.com). Takes payments, runs subscriptions, sends receipts and handles refunds. Receives your email address and payment details, and also looks after them under its own privacy notice. |
How long we keep it
- Kislap chats are deleted automatically 12 months after they are sent.
- Removing a child from your account deletes their profile, progress and chats.
- Your account data is kept while your account is open. When you ask us to delete your account, we delete it and all your children’s data, except billing records we must keep for as long as tax law requires.
- Server logs are kept for a short time by our hosting provider and then deleted.
How we protect it
- All traffic is encrypted with HTTPS.
- Your PIN is stored as a salted hash, and sign-in cookies can’t be read by page scripts.
- Database rules let each parent read only their own family’s data. Every change goes through our server after it checks who you are.
Your rights
Under the Data Privacy Act you have the right to be informed, to access your data and your child’s data, to correct it, to object to its use, to have it erased or blocked, to receive a copy in a portable format, and to claim damages. You can exercise any of these by emailing privacy@tala.kids from the address on your account.
You can withdraw consent for a child at any time by removing them from your account. If you think we have mishandled your data, you can also complain to the National Privacy Commission.
Changes to this notice
If we change how we use personal data, we will update this page and its date. If a change is significant, we will tell you before it takes effect, by email or in the parent area.