COREN PRIVACY ADDENDUM

Last updated: October 13, 2026
Document version: v1.2
Applies to: Coren, the family financial-literacy product operated by The Hiwat Group Sociedad Limitada ("THG SL").

> What changed in v1.2 (October 13, 2026): a fuller description of the data Coren processes, including real pocket-money records, Glimmers, shared achievement cards, invitations, the free tools before sign-up, and the details received from Google sign-in and Stripe (§2); the legal basis for children's data, which is the parent's consent (§4), and how withdrawing it works (§4.1); analytics only with consent and never in a child's session, changeable via Cookie settings (§3.5); the services we use and where they are hosted (§5, §9); how long we keep data (§6); and publication in English, Spanish and Dutch, with the Spanish version prevailing (§12).

How this Addendum works

This Addendum sits on top of THG SL's general Privacy Notice, which remains the foundational document governing how THG SL processes personal data across all its activities. The general Privacy Notice continues to apply in full. This Addendum only adds, clarifies, or extends specific items where Coren, as a consumer-facing family product, collects or uses data differently from THG SL's other professional and educational services.

In the event of any discrepancy between the THG SL Privacy Notice and this Addendum, this Addendum prevails for matters specific to the Coren product; for all other matters, the THG SL Privacy Notice governs.

1. Who We Are (Coren)

Coren is operated by THG SL. THG SL remains the Data Controller responsible for processing your personal data, as set out in §1 of the THG SL Privacy Notice.

Contact for Coren-specific privacy questions: assistant@thehiwatgroup.com.

Internal compliance documentation supporting this Addendum includes Coren's Data Protection Impact Assessment (GDPR Art. 35), available on request to a competent EU Data Protection Authority. The DPIA documents Coren-specific processing operations, necessity and proportionality analysis, risk assessment for data subjects, and mitigation measures.

2. What Data We Collect (Coren-specific additions)

In addition to the categories listed in §2 of the THG SL Privacy Notice, Coren collects the following data when parents and children use the product:

2.1 Parent account data

Email address (account login + service communications)
Display name
Subscription tier and billing status

If you sign in with Google, Google shares with us your email address, name and profile picture URL, held in our authentication provider's user record; Coren itself uses only the email address

Billing details handled by Stripe: your billing address and country, used to calculate VAT, and any promotional code you redeem
Marketing communications preferences (where the parent has opted in, see §3.4)

2.2 Child profile data

We collect the minimum data necessary to operate the product for each child the parent adds to their household:

Display name or nickname (chosen by the parent)
Age range, one of "3-5", "6-9", "10-13", or "14-17". We do not collect a child's exact date of birth. The age range is used solely to present age-appropriate financial-literacy content.
Theme and avatar preferences (purely cosmetic, in-app personalisation)
Hashed PIN used for the child's in-app login. PINs are stored as a one-way hash; the original PIN cannot be retrieved.

2.3 In-app activity data

Coren stores records of in-app activity needed to operate the product:

Real pocket-money records: the allowance, chores, income, expenses, savings goals, investments, loans, interest and Family Fund contributions that the parent and child agree on and record in Coren, including amounts, dates and any notes they type. Coren is a ledger for these arrangements: no money is held, transferred or withdrawn through Coren, and the parent settles any amounts with the child outside the product.
Glimmers: the balance and history of Coren's in-app virtual currency (missions, pet care, learning games, store). Glimmers have no monetary value and cannot be bought, sold or withdrawn.
Mission completion records and quiz scores
Pet, store, and home preferences and inventory
Streaks and progression milestones

Arcade games played and scores, stories and articles read, and the tips Guidi has shown.

2.4 What we do not collect

Coren does not collect:

A child's exact date of birth
Real-money payment instruments held in a child's name
Bank account numbers, card PANs, or financial credentials of any kind from a child

Precise location. Our hosting and analytics providers see your IP address when you connect; we use it for security and, in analytics, only to derive a rough region.
Any other special-category data of the child as defined in GDPR Art. 9, unless legally required

2.5 Guidi (in-product educational character)

Coren includes an educational character called Guidi who appears in the product to explain financial-literacy concepts and answer common questions.

Guidi's responses in parent contexts are drawn from the same curated content library used in child contexts. Responses are deterministic and selected from a manually-authored library based on rule-based logic. No machine-learning inference is used to generate Guidi's responses for any user, and Guidi does not communicate with external AI providers.

Guidi is not an AI system in the meaning of EU Regulation 2024/1689 (the AI Act).

2.6 Sharing a child's achievement

If you choose to share a child's achievement, Coren creates a link to a card that shows the child's first name, theme and streak. Anyone with the link can see the card. Sharing stays off until you switch it on for the household and for that child, and you can revoke a link at any time, after which it stops working.

2.7 People you invite

If you invite another family with a referral link, we use the email address you enter only to send the invitation, and we delete that address 30 days after the invitation expires or is accepted.

2.8 Free tools before sign-up

If you use our free calculator or diagnostic and give your email address, we keep your email address, your child's age, the amounts and answers you entered, and how you reached us (campaign tags). We use them to send you your result and, if you agreed, follow-up emails. If you do not create an account, we delete them after 12 months.

3. Why We Use Your Data (Coren-specific additions)

In addition to the purposes listed in §3 of the THG SL Privacy Notice, Coren processes data for the following purposes:

3.1 Operating the product

Authenticating parent and child accounts

Maintaining the family household structure (parent and children)
Recording in-app activity (pocket-money records, Glimmers, missions, streaks, pet, store) so that the product functions across sessions and devices

3.2 Age-appropriate content

Filtering missions, articles, and other content to match the age range of each child
Adjusting copy, examples, and complexity to the child's age band

3.3 Service communications (transactional)

Account confirmations, security notifications, and billing communications
Service incidents, terms updates, and policy changes

3.4 Marketing communications (opt-in only)

Where the parent has explicitly opted in, Coren may send:

Product updates and new-feature announcements
Educational content and tips related to family financial literacy
Occasional surveys to improve the product

The parent can opt out at any time via their Coren parent settings or by contacting assistant@thehiwatgroup.com. Opting out has no effect on the parent's ability to use the product.

This is the only Coren-specific extension to the THG SL Privacy Notice's commitment in §5, "We do not sell personal data or share it for marketing purposes." THG SL still does not sell personal data and does not share it with third parties for their marketing purposes. Coren may, with the parent's explicit opt-in, send the parent its own product-related communications.

3.5 Product analytics (consent only)

If you accept analytics cookies, we use a privacy-focused analytics service hosted in the EU to count a small, fixed set of product events (for example: account created, child added, first chore created, paywall shown). Events are linked to a pseudonymous account identifier, not to your name or email address. We do not record sessions, keystrokes, page content or precise location, and we do not use analytics for advertising. You can decline or withdraw this consent at any time via Cookie settings at the bottom of every page; Coren works the same either way. Analytics runs only in the parent's part of Coren, never in a child's session.

4. Legal Bases for Processing (Coren-specific additions)

In addition to the legal bases listed in §4 of the THG SL Privacy Notice, the following bases apply to Coren:

Performance of a contract (GDPR Art. 6(1)(b)): operating the parent's own Coren account, the household and the subscription.

Consent of the parent (GDPR Art. 6(1)(a) and Art. 8; LOPDGDD Art. 7): the children's profiles, their in-app activity and the pocket-money records. We process these only after the parent has given the children's-data consent in Coren, and the parent can withdraw it at any time (§4.1).
Legal obligation (GDPR Art. 6(1)(c)): meeting our obligations under GDPR, LOPDGDD, and Spanish consumer-protection law
Legitimate interests (GDPR Art. 6(1)(f)): security, fraud prevention, abuse mitigation, and quality assurance of the Coren service

Explicit consent (GDPR Art. 6(1)(a)): for marketing communications under §3.4, for product analytics under §3.5, and for any processing where consent is the appropriate basis under applicable law

4.1 Children's data: universal parental control

Coren is designed for global use across multiple jurisdictions. Rather than tying the product's protections to any single national age threshold, Coren operates on the principle that the parent or legal guardian holds absolute control over a child's account: account creation, age range setting, feature and limit settings, PIN reset, deletion, and the withdrawal of consent (which locks all child accounts in the household immediately) are all parent-only operations. Children themselves do not exercise data-protection rights directly in Coren; the parent acts on the child's behalf throughout.

This stance is intended to satisfy or exceed the parental-consent requirements of the GDPR (Art. 8), the Spanish LOPDGDD (Art. 7), the UK Data Protection Act, the US Children's Online Privacy Protection Act (COPPA), and other relevant child-protection frameworks.

The parent may withdraw this consent at any time in their settings. Withdrawing consent locks all child accounts in the household immediately. During the following 45 days the parent can either restore access by giving consent again, or confirm deletion. We send reminders at days 15, 30 and 45. If neither happens, all child accounts and their data are permanently deleted on day 46. If the parent gives consent again before that, the child accounts reopen and any allowance or interest that fell due while the accounts were locked is credited to the ledger. The parent's own account and data remain.

5. Who We Share Data With (Coren-specific additions)

The general principles in §5 of the THG SL Privacy Notice apply to Coren in full. THG SL still does not sell personal data, and still does not share personal data with third parties for those third parties' marketing purposes.

Coren-specific processors are:

Supabase (database, authentication and file storage; our production project is hosted in the EU, Stockholm)
Vercel (application hosting and scheduled jobs)
Stripe (subscription payments and tax calculation; your card details are entered on Stripe's pages and are never stored by us)
Resend (sending our emails; Resend is a US company and we send through its EU region, with Standard Contractual Clauses covering any data that reaches the United States)
PostHog (product analytics on an EU-hosted instance, only if you accept analytics cookies, see §3.5)

Google (if you choose to sign in with Google: Google handles that sign-in and shares with us your email address, name and profile picture URL, held in our authentication provider's user record; Coren itself uses only the email address. Google's own privacy terms apply to your Google account)

We keep an up-to-date list of processors available on request. All processors are contractually bound to handle data only on THG SL's documented instructions and to apply at least the same standard of protection as THG SL itself.

6. Data Retention (Coren-specific additions)

The general retention principles in §6 of the THG SL Privacy Notice apply. In addition, for Coren:

Active and free accounts: child profiles and in-app activity are kept for as long as the parent's Coren account exists, on any tier. Ending or downgrading a paid subscription removes paid features but does not delete any data. We do not delete accounts for inactivity.
Deletion: data is deleted when the parent deletes a child profile or the whole account in their settings (immediate and irreversible), or through the consent-withdrawal process in §4.1 (deleted on confirmation or on day 46).
Administrative access logs: kept for 365 days.
Marketing preferences: opt-in records are retained for as long as the marketing relationship is active, plus a reasonable period afterwards to demonstrate compliance with consent rules.
Accounting / payment records: retained by us and by our payment processor as required by Spanish law (currently four years for tax-related records, six years for commercial records, same as THG SL).

A parent can delete any child profile, or their entire account, at any time from their settings. Account deletion is immediate and cannot be undone. You can also write to assistant@thehiwatgroup.com.

7. Your Rights (Coren-specific notes)

The full set of rights listed in §7 of the THG SL Privacy Notice applies to all data Coren processes. Specifically, parents may:

Access the data held about them and their children in Coren
Correct inaccurate data, for instance, updating a child's age band or display name via the parent settings
Request deletion of a child profile or the entire household
Restrict or object to specific processing, including marketing communications (which can be turned off at any time)
Request data portability: an export of the parent's account data and the children's profile data in a structured, machine-readable format

Requests can be made by contacting assistant@thehiwatgroup.com as set out in the THG SL Privacy Notice.

Children themselves do not exercise these rights directly within Coren; the parent who set up the child profile acts on the child's behalf. Once a person reaches the age of majority under the law applicable to them, they may contact us to assume direct control of any data still held about them.

8. Data Security (Coren-specific additions)

The general security principles in §8 of the THG SL Privacy Notice apply. In addition, Coren applies these measures:

Child PINs are stored as a one-way hash combined with a server-side secret, and cannot be retrieved; child logins are locked after repeated failed attempts

Parent accounts are protected by password authentication or Google sign-in; admin accounts (those with elevated access to the Coren backend) are additionally protected by two-factor authentication
Access to child data within the Coren backend is minimised, staff debugging tools surface identifiers (e.g. anonymous child IDs) rather than child names wherever practical

Coren never holds, moves or withdraws money. The real-money records in Coren are a ledger of arrangements between parent and child; the only payment Coren processes is the parent's own subscription, on our payment processor's pages

9. International Transfers

The general principles in §5 of the THG SL Privacy Notice apply unchanged. Our database, authentication, application hosting and analytics run in the EU. Some of our processors are US companies (Vercel, Stripe and Resend; Supabase and PostHog for support access). Where personal data reaches the United States, it is protected by the EU-US Data Privacy Framework or by Standard Contractual Clauses. Google sign-in, where used, involves Google under its own EU transfer safeguards.

10. Updates to This Addendum

This Addendum may be updated from time to time. Material changes will be communicated to parents in-product and may require fresh consent before the parent can continue using the product, in line with the Coren consent versioning system.

The current version of this Addendum is shown at the top of this document.

11. Governing Law

This Addendum is governed by Spanish law. The general jurisdiction and dispute resolution provisions of THG SL (§7 of the Legal Notice and §10 of the Terms & Conditions) apply.

12. Language versions

This Addendum is published in English, Spanish and Dutch. In the event of any discrepancy, the Spanish version prevails, consistent with §7 of the THG SL Legal Notice.