Privacy Policy

This Privacy Policy explains how OMO Technology Ltd collects, uses, discloses, and safeguards your personal information when you visit our website omo.technology (the "Site") and use our OMO App (the "App") and the OMO children's smartwatch (the "Device"). Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Site or use the App.

1. Who we are

The data controller of your personal information is OMO Technology Ltd, a company registered in England and Wales under company number 17168987, with its registered office at:

167-169 Great Portland Street, London, England, W1W 5PF, United Kingdom

OMO Technology Ltd has not appointed a Data Protection Officer. If you have any questions about this Privacy Policy or how we handle your data, please contact us at hello@omo.technology.

2. What data we collect and why

We collect and process personal data for the purposes set out below. Where you have ordered a device from us, this includes the name, delivery address, email address and phone number you give at checkout, which we use to take and deliver your order and to set up your watch.

Order processing & device dispatch

  • What we collect: Your name, delivery address, email address and phone number; your order reference and what you ordered; and a reference to your payment record with Stripe (we never see or store your full card or PayPal details)

  • Legal basis: Performance of a contract with you

  • Retention: Duration of the contract plus 6 years (statutory/tax record-keeping)

Subscription and payment (the OMO service fee)

  • What we collect: Whether your subscription is waiting to start, active, overdue or cancelled, and the dates that matter (when billing started, when a payment first failed, when you cancelled); your Stripe customer and subscription references; and the type of payment method kept for the monthly charge (for example card or PayPal). Stripe, our payment provider, holds the payment method itself.

  • Legal basis: Performance of a contract with you

  • Retention: Duration of the contract plus 6 years (statutory/tax record-keeping)

Customer service & support queries

  • What we collect: Contact details, correspondence content, and messages you send through "Report a Problem" in the App

  • Legal basis: Performance of a contract / legitimate interests (resolving your query)

  • Retention: 2 years from resolution of the query, or earlier if you ask us to delete it

Marketing newsletter

  • What we collect: Email address, marketing preferences

  • Legal basis: Consent (PECR / UK GDPR)

  • Retention: Until you unsubscribe or withdraw consent

Parent account (the App)

  • What we collect: Your name, email address and an account identifier, via Google Sign-In or Sign in with Apple. If you sign in with Apple, a sign-in token from Apple, kept only so that we can revoke it when you delete your account

  • Legal basis: Performance of a contract

  • Retention: For as long as your account is active; deleted within 30 days of an account deletion request (see Section 8)

Device tracking and safety features (the App and the Device)

  • What we collect: The Device's location (from GPS, or estimated from nearby WiFi and mobile network identifiers) and location history; step counts; battery level; whether the Device is connected and how (WiFi or mobile data); text messages sent to and received by the Device, including the phone number of the sender or recipient; the contacts (names and phone numbers) you add to the Device; alarms, calendar events and "do not disturb" / School Mode settings you set; safe zones you create and the arrival and departure alerts they produce; SOS alerts; the WiFi network names you set up on the Device; the Device's SIM phone number if you enter it; a profile photo and name for the Device if you add them; and the Device's identifier (its IMEI / Watch ID)

  • Legal basis: Performance of a contract (providing the tracking and safety service you asked for)

  • Retention: Location history, step counts and the battery readings stored with them are kept for 90 days and then deleted automatically, so they also disappear from the App. The technical detail behind each location reading (the raw message from the Device and the lists of nearby WiFi networks and mobile masts used to estimate a position) is deleted after 30 days. Text messages and safe zone arrival and departure alerts are kept for 12 months and then deleted automatically (the Device keeps its own copy of its text messages). Your contacts, alarms, events, safe zones and settings are kept while your account is active, and everything is deleted when your account and the Device's records are deleted (see Section 8). Estimated locations worked out with Google's Geolocation API are cleared after 28 days. Technical records about the Device's connection (connection history, including the internet address it connects from and the checks that confirm it is your Device, battery readings, firmware and SIM details, mobile data usage) are kept for up to 90 days in detail and up to 400 days in daily or hourly summaries

Your agreement to our terms (the App)

  • What we collect: The version of the Terms of Service and Privacy Notice you agreed to, the date and time, whether you used the iPhone or Android app and the app version. We do not store your IP address for this.

  • Legal basis: Performance of a contract, and legitimate interests (keeping a record that you agreed, in case of a dispute)

  • Retention: For as long as your account is active; deleted with your account

Voice typing on the Device

  • What we collect: Nothing. If voice typing is used, the words your child speaks are sent by the keyboard on the Device directly to Google, which turns them into text. We do not receive, listen to or store the audio, and it does not pass through our servers. The text that results appears in the message your child is writing, and is then handled like any other message (see "Device tracking and safety features" above).

  • Legal basis: Not applicable to us for the audio, because we do not receive it. For the message text, performance of a contract (the Messages feature you asked for).

  • Retention: We do not hold the audio. Google's own terms govern what Google does with it (see Section 5).

Push notifications

  • What we collect: The notification token for your phone

  • Legal basis: Performance of a contract (delivering the alerts you've configured, e.g. SOS and safe zone notifications)

  • Retention: For as long as your account is active, or until you disable notifications

Website analytics & security

  • What we collect: Browsing behaviour, IP address, cookie identifiers

  • Legal basis: Legitimate interests (keeping our site secure and improving it)

  • Retention: Up to 26 months

2.1 Product purchase, registration, and dispatch

  • To process and manage orders you place with us, including collecting your name, delivery address, email and phone number to take payment, arrange delivery and set up your watch.

  • To take the monthly OMO service fee from the payment method you used at checkout, starting when you first set up the watch in the App (or 90 days after we post it, if that is sooner), and to let you cancel, update your payment method and see your invoices on Stripe's customer page.

  • To respond to queries or requests you send us during or after the sales process.

  • To personalise your orders and give you access to products and promotions through your account on our website.

  • To keep you informed about offers and promotions, where you have agreed to receive marketing (you can unsubscribe at any time).

2.2 Contact and support

  • To respond to queries or requests, and to provide technical support if requested.

  • Our support team can see the technical records of a Device (its connection history, battery and location diagnostics, firmware and SIM details) when helping you with a problem.

2.3 Newsletter

  • To send you news, offers, and promotions, where you have opted in. This is subject to the Privacy and Electronic Communications Regulations (PECR) as well as UK GDPR, and you may withdraw consent at any time.

2.4 OMO App and Device

  • If you use the OMO App, we collect location and device information to provide real-time tracking, location history and safe zone alerts for your authorised Devices.

  • If you use the Messages feature, the text of messages sent to and received by the Device, and the phone numbers they come from or go to, is transmitted to and stored on our servers so it can be shown to you in the App. This includes messages from people other than you, who have not used our App.

  • The contacts you add to the Device (name and phone number), calendar events, alarms and safe zones you create are stored on our servers so they can be sent to the Device and shown in the App.

  • The App may use your camera only when you scan a QR code to pair a new watch, and your photo library only when you choose a profile photo for the Device. We do not access your camera or photo library at any other time, and the QR code scan is not stored.

  • You sign in to the App using Google Sign-In or Sign in with Apple. Google Sign-In shares your name and email address with us for authentication; Sign in with Apple shares your name and either your email address or a private relay address, depending on what you choose when signing in. Each provider's own privacy policy governs how they handle your sign-in credentials.

  • On Android we use Google Firebase Cloud Messaging to deliver push notifications (for example, SOS alerts and safe zone entry/exit). This involves sharing a device notification token with Google. Google does not have access to your location history, messages, or account data through this service.

  • On iPhone, we use Apple's Push Notification service to deliver the same alerts. This involves sharing a device notification token with Apple. Apple does not have access to your location history, messages or account data through this service.

  • The App shows the Device's location on a Google Map. Google receives the usual technical information a map request involves, such as your IP address and the area of the map being viewed.

  • When GPS positioning isn't available, our servers may send nearby WiFi network identifiers (and, where available, mobile network cell identifiers) to Google's Geolocation API to estimate your child's location. This request is made from our servers, not your device, and does not include your account, name, or any other identifying information beyond the network data needed to resolve a position. In line with Google's terms, we do not keep positions estimated this way for more than 28 days.

  • The mobile network operator whose SIM card is in the Device carries its calls, texts and data and keeps its own records of them under its own privacy policy.

  • The App does not contain advertising and does not use advertising or analytics software that tracks how you use it. We do not use your data for advertising or marketing.

  • The Device's lock screen shows the Device's colour and the name you gave the Device in the App (for example your child's first name), so anyone who picks up the Device can see that name. We suggest using a first name or a nickname. The colour and name are sent from our servers to the Device to do this.

  • The Device has an on-screen keyboard supplied by Google (Gboard). If your child presses the microphone key to speak a message instead of typing it, the device asks permission to use the microphone, and then the speech is sent to Google over the Device's mobile data (or WiFi) to be turned into text. Google also supplies the keyboard's language data to the Device, which involves the Device contacting Google. We do not receive the audio. This only happens if your child uses the microphone key and allows the microphone permission when asked.

  • To get a GPS position faster, the Device contacts Google's location-assistance service whenever its GPS switches on. That request includes the identifier of the mobile mast the Device is connected to and technical information needed for the service, and Google replies with satellite and time data. It does not include your child's name or your account details. We do not receive this request or the reply.

  • If your subscription ends (you cancel it, or a payment stays unpaid for 30 days), we stop asking the Device for its location and stop storing its location and messages, and the App stops showing them. Calls and texts on the Device itself carry on. What we already hold is deleted on the usual schedule (Section 4) or when you delete your account.

  • This data is used solely to provide the services you have requested and is not shared with third parties except as described in Section 5.

2.5 Website improvement and security

  • To monitor how you use our website, helping us improve its functionality, security, user-friendliness, and overall service quality.

3. Our legal basis for processing

UK GDPR requires us to have a valid legal basis for each way we use your data. We do not rely on consent alone. Depending on the purpose, we rely on one of the following:

  • Performance of a contract — where processing is necessary to fulfil an order, deliver a device, or provide the tracking service you've signed up for.

  • Legitimate interests — where processing helps us run, secure, and improve our website and services, and we've concluded this doesn't override your rights.

  • Consent — specifically for marketing communications and non-essential cookies, which you are free to withdraw at any time without affecting other processing.

  • Legal obligation — where we must retain or disclose data to comply with the law (for example, tax or accounting records).

See the list in Section 2 for the specific basis and retention period that applies to each purpose.

4. How long we keep your data

We do not keep personal data for longer than necessary. Retention periods vary by purpose and are set out in Section 2. Location history and step counts are deleted automatically once they are 90 days old (and the technical detail behind each location reading once it is 30 days old). Text messages and safe zone alerts are deleted automatically once they are 12 months old. Where no fixed period is stated, we keep data for as long as your account is active, or as needed to comply with our legal obligations, resolve disputes, and enforce our agreements. Copies of our database backups are deleted automatically after 30 days.

5. Do we share your data with others?

We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:

  • Delivery — Royal Mail, to deliver your device to the postal address you provide.

  • Payment processing — Stripe, which takes your payment and keeps your payment method so we can charge the monthly OMO service fee later, and PayPal if you choose to pay with it. Stripe also runs the page where you can cancel your subscription, update your payment method and see your invoices. Stripe and PayPal handle your payment details under their own privacy policies; we never see your full card or PayPal details.

  • Website hosting — Squarespace, which hosts our website.

  • Cloud infrastructure — Google Cloud, which hosts the servers that run the App and the tracking service. These servers are located in the United Kingdom (London).

  • Push notification delivery — Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iPhone), to deliver alerts to your phone.

  • Maps — Google Maps, to display the map in the App.

  • Sign-in providers — Google and Apple, to authenticate you when you sign in.

  • Location resolution — Google's Geolocation API, used only when GPS positioning isn't available.

  • Voice typing — Google, which converts speech to text when your child uses the microphone key on the Device's keyboard. This is the child's speech going from the Device directly to Google; it does not pass through us. Google handles it under its own privacy policy and terms.

  • GPS assistance — Google's location-assistance service, which the Device contacts each time its GPS starts, to get a first position quicker (see Section 2.4). It receives the identifier of the nearby mobile mast and technical information needed for the service; it does not pass through us.

  • Customer support tools — to manage and respond to your queries.

  • Public authorities or regulators — where required by law.

Any third party that processes data on our behalf is bound by a data processing agreement requiring them to protect your data to the same standard as we do.

Who processes your data: The OMO App and the device tracking service are built and operated entirely by us. Your account details, location history, messages, and contact information are processed and stored on servers we control and operate ourselves — no external party operates our backend, and no external party has standing access to this data.

OMO products are manufactured by a third-party hardware supplier. The device's underlying operating system includes some manufacturer-standard components (such as diagnostic and error-reporting tools) that are separate from the OMO App and our tracking service. The Device's keyboard is supplied by Google (Gboard) and is separate from the OMO App and our tracking service. We are in the process of auditing and minimising these components. The device manufacturer does not have access to your OMO account, and we do not share your account, location, message, or contact data with the device manufacturer.

Contacts and people who message the Device: Where you add a contact to your child's device, you are providing us with that person's name and phone number. We process this data on the basis of our legitimate interest in enabling the safety feature you have configured, and by adding a contact you confirm that you have their permission (or, where the contact is also a child, their parent's permission) to do so. People who send text messages to the Device also have their phone number and message stored, so that you can read them in the App.

6. International data transfers

The servers that run the App and the tracking service, and so your account, location, message and contact data, are hosted by Google Cloud in the United Kingdom. Some of our other service providers are located outside the UK. We use Squarespace (US-based) to host our website, Stripe and PayPal to take payments (they may process payment data outside the UK), and Google's own services (Firebase push notifications, Google Maps, the Geolocation API, Sign-In, the voice typing service in the Device's keyboard and Google's GPS assistance service) and Apple's Sign in with Apple and Push Notification service may process the limited data described in Section 2.4 outside the UK. We rely on their standard contractual safeguards (such as the UK International Data Transfer Agreement or equivalent Standard Contractual Clauses) for these transfers. Speech sent to Google for voice typing, and the GPS assistance requests described in Section 2.4, may be processed on Google's servers outside the UK.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right to confirmation — to ask whether we are processing your data.

  • Right of access — to obtain a copy of the personal data we hold about you.

  • Right to rectification — to have inaccurate or incomplete data corrected.

  • Right to erasure — to request deletion of your data where it's no longer needed, or you withdraw consent.

  • Right to restriction of processing — to limit how we use your data in certain circumstances.

  • Right to data portability — to receive the data you've provided to us in a structured, commonly used, machine-readable format, and to have it transferred to another organisation where technically feasible.

  • Right to object — to object to processing based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, contact us at hello@omo.technology. You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk, or by calling 0303 123 1113.

8. Account deletion and data removal

You can ask us to delete your account and the personal data linked to it at any time:

  1. In the App — open Watch Settings, scroll to the bottom and tap Delete my account, then send the request that opens.

  2. Or by email — write to hello@omo.technology from the email address you sign in to the App with, with the subject "Delete my OMO account", and include the Watch ID of any Device you want deleted.

  3. Check — we will confirm that the request comes from you before we delete anything.

  4. Deletion — we delete the account within 30 days of your request and confirm by email once it is done. This cannot be undone.

What we delete: your parent account (name, email address, account identifier, sign-in sessions), your pairing with the Device, your notification token and your support messages. If you signed in with Apple, we also tell Apple to end the Sign in with Apple link for our app. If you were the last parent paired to a Device, we also delete that Device's stored history: locations and location history, step counts, battery and connection records, text messages, contacts, alarms, events, safe zones, WiFi names, and the Device's profile photo and name.

What we keep: if another parent is still paired to the Device, its history stays for them; your own access ends and your account details are deleted. Copies in our database backups are deleted automatically after 30 days. We may keep certain records where the law requires (for example, tax and accounting records for orders).

Cancelling your subscription is separate from deleting your account. Cancelling stops future payments and, when it ends, the online service (Section 2.4); it does not delete your account or your data. To delete your data, use the steps above. We keep order and payment records for 6 years where the law requires it.

You can also ask us to delete only part of your data without deleting your account, for example one Device's history. Use the same contact routes above and tell us what you want removed. A page with these instructions is also available at omo.technology/delete-my-account.

9. Cookies

We use cookies and similar technologies on our website. These fall into the following categories:

  • Strictly necessary cookies — required for the website to function (for example, keeping you logged in or remembering items in your basket). These do not require consent.

  • Analytics cookies — help us understand how visitors use our site so we can improve it. These are set only with your consent.

  • Marketing cookies — used to measure the effectiveness of our promotions. These are set only with your consent, in line with PECR.

When you first visit our site, you will be asked to accept or manage non-essential cookies. You can change your preferences at any time through your browser settings or our cookie management tool. Disabling cookies may affect some website functionality. The App does not use cookies for tracking.

10. Children's data

Our device is designed to be worn by children, with the App and account managed by a parent or guardian. The App is intended for use by adults aged 18 and over. Because our service is likely to be accessed by children, we aim to follow the principles of the ICO's Age Appropriate Design Code (Children's Code), including collecting only the data necessary to provide the tracking and safety features of the device, and applying privacy-protective settings by default.

The data we hold about a child who wears the Device includes their location and location history, step count, and the text messages the Device sends and receives. This data is only visible to the parents or guardians who have been paired to that Device (with approval from an existing parent), and to our support team when needed to help with a problem.

We do not knowingly allow children to create or manage their own account; account registration is carried out by a parent or guardian, who is responsible for the accuracy of the information provided, including the contacts authorised to reach the child's device. If you believe a child has set up an account independently, or that data about a child has been provided to us without appropriate parental involvement, please contact us so we can review and, where appropriate, delete it.

Keeping the child informed and in view. Because the Device follows a child's location, we build in these safeguards: the Device shows a small blue dot on its screen whenever it is looking for its location, so the child can see when it happens and the settings that affect the child (location detail, lockdown periods, the call filter and contacts) can only be changed by the parents or guardians paired to the Device. We’ve published a short, plain-language notice for children about what the watch does and does not do, which can be found here.

The Children's Code. We have assessed the risks of this service to children in a data protection impact assessment (DPIA). We collect only what the safety features need, we do not use children's data for advertising, profiling or marketing, and we do not use nudge techniques to make a child share more data. Location tracking is the main purpose of the Device, and it is switched on only when a parent pairs it.

Voice typing. The keyboard on the Device includes a microphone key. If your child uses it, their speech is sent to Google to turn it into text (see Section 2 and Section 5). It starts only when the microphone key is pressed and the microphone permission has been allowed on the Device. We do not receive or store the audio. If you do not want your child to use voice typing, please tell them not to press the microphone key or allow the permission.

GPS assistance. To get a position faster, the Device's GPS software contacts Google's location-assistance service, which receives the identifier of the nearby mobile mast. This happens whenever the GPS switches on, whether or not anyone is looking at the App.

The name on the lock screen. The name you give the Device is shown on the Device's lock screen, where anyone holding it can read it. Use a first name or nickname you are comfortable with.

11. How we keep your data secure

We protect your data with access controls, encryption in transit between the Device, the App and our servers, and an identity check on each Device so that an imitation of it cannot connect to your account. Our servers are in the UK (London). We publish a security statement at omo.technology/security (how long we provide security updates, and what is and is not updated) and a way to report a security problem. If there is a personal data breach that is likely to put people at risk, we will tell the ICO within 72 hours and, where the risk is high, tell you without undue delay.

12. Links to third-party websites

Our website and App may contain links to third-party websites or services that we do not operate or control. This Privacy Policy does not apply to those third-party websites or services. We recommend reviewing their privacy policies to understand their data practices.

13. Changes to this Privacy Policy

We may update or modify this Privacy Policy from time to time. Any changes will be effective upon posting the revised policy on our website, and we encourage you to review it periodically. If we make a significant change to how we use data about a child, we will tell you through the App or by email. When we make a change that matters to you, the App will ask you to read and agree to the new version when you next open it.

14. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at hello@omo.technology. We will respond to your enquiry as soon as possible.

Last updated: 11/11/2026