Privacy Policy

1. Introduction

Welcome to ActiBux.

ActiBux is a rewards application that encourages children to build healthy habits, stay active and spend quality time with their families by earning points redeemable for Robux rewards on Roblox.

ActiBux was founded by Vann Winsey, age 10, and is operated by ActiBux Ltd.

We take the privacy and safety of children extremely seriously. This Privacy Policy explains what personal data we collect, how we use it, who we share it with and what rights you and your child have.

2. Who This Policy Applies To

This policy applies to:

• Children who use the ActiBux app (the child user)
• Parents and guardians who register on behalf of their child (the parent)
• Visitors to our website at www.actibux.com

Where we refer to you in this policy, we mean the parent or guardian. Where we refer to your child we mean the child using the app under your supervision and consent.

3. Our Commitment to Children’s Privacy

ActiBux is designed specifically for children. We are committed to:

• Collecting only the minimum personal data necessary to operate the service
• Never using children’s data for advertising or marketing profiling
• Never selling children’s personal data to any third party, ever
• Requiring verifiable parental consent before any child under 13 can use the app
• Complying with children’s privacy laws in all 42 countries where ActiBux operates
• Designing our service with children’s safety, wellbeing and privacy as the default

We comply with: COPPA (USA), UK GDPR and the UK Children’s Code (ICO Age Appropriate Design Code), EU GDPR, LGPD (Brazil), PDPL (Saudi Arabia), PDPA (Thailand) and equivalent legislation across all markets.

4. What Data We Collect

4.1 Parent / Guardian Account Data

When a parent creates an ActiBux account on behalf of their child, we collect:

• Parent’s full name
• Parent’s email address
• Parent’s date of birth (to verify you are aged 18 or over)
• Country of residence
• Password (stored in encrypted form – we never store plain text passwords)
• Device information (device type, operating system, app version)

4.2 Child User Data

Once parental consent is given, we collect the following data about the child:

• Child’s first name or chosen display name only (not full name)
• Child’s age or age range (we do not require an exact date of birth)
• Activity data submitted through the app (challenges completed, points earned)
• App usage data (sessions, features used, time in app)
• Device information (device type, operating system)

4.3 Rewards and Redemption Data

When points are redeemed for Robux, we collect:

• Roblox username (provided by the parent for redemption purposes only)
• Points balance and transaction history
• Redemption date and amount

4.4 Technical and Usage Data

We automatically collect certain technical data when you use our app and website:

• IP address (anonymised where possible)
• Browser type and version
• App version and crash reports
• General usage analytics (anonymised and aggregated)

4.5 Communications Data

If you contact us at support@actibux.com or through our support system, we collect your name, email address and the content of your message.

4.6 Collection of Health Data

Our application accesses and collects certain health and fitness data (such as the user’s daily step count) to provide rewards for their activity in the form of ActiBux. We only access this data with your explicit permission and do not share this data with third parties for marketing purposes without your consent.

5. How We Use Your Data

6. Parental Consent – Children Under 13

If your child is under 13 years old, we require verifiable parental consent before they can use ActiBux.

During registration, parents are required to:

• Confirm they are the parent or legal guardian of the child
• Confirm they are aged 18 or over
• Review and agree to this Privacy Policy on behalf of their child
• Provide a valid email address for ongoing account communications

Parents have the right to:

• Review the personal data we hold about their child at any time
• Request correction of any inaccurate data
• Request deletion of their child’s account and all associated data
• Withdraw consent at any time by deleting the account or contacting support@actibux.com
• Refuse to allow further collection or use of their child’s data

If we discover that we have inadvertently collected personal data from a child under 13 without verifiable parental consent, we will delete that data immediately.

For users in the European Union: The minimum age for digital consent varies by country (13-16 years). We apply the age of 16 as our default threshold for EU users in the absence of parental consent, in line with GDPR Article 8.

7. Who We Share Your Data With

We do not sell your data or your child’s data to any third party under any circumstances.

We may share data with the following trusted service providers, strictly for the purposes of operating ActiBux:

All third-party providers are contractually required to process data only on our instructions, maintain appropriate security standards and comply with applicable data protection laws.

8. International Data Transfers

ActiBux operates globally across 42 countries. Where we transfer personal data outside of the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs)
• Transfers only to countries with adequate data protection frameworks where possible

9. How Long We Keep Your Data

When an account is deleted, all personal data associated with the parent and child is permanently deleted within 30 days, except where we are legally required to retain it.

10. Your Rights

Depending on your country of residence, you have the following rights over your personal data and your child’s personal data:

• Right of access – request a copy of all personal data we hold about you or your child
• Right to rectification – ask us to correct any inaccurate or incomplete data
• Right to erasure – ask us to delete your or your child’s personal data
• Right to restriction – ask us to restrict how we use your data while a concern is resolved
• Right to portability – request your data in a portable, machine-readable format
• Right to object – object to certain uses of your data including analytics
• Right to withdraw consent – where processing is based on consent, withdraw it at any time
• Right to complain – lodge a complaint with your national data protection authority

UK users: Information Commissioner’s Office (ICO) – ico.org.uk
EU users: your local national supervisory authority
US users: Federal Trade Commission (FTC) – ftc.gov

To exercise any of these rights, please contact us at: support@actibux.com. We will respond within 30 days.

11. Security

We take the security of your data and your child’s data seriously. We implement:

• Encryption of all data in transit (TLS) and at rest
• Secure password hashing – we never store plain text passwords
• Access controls strictly limiting who within our team can access personal data
• Regular security reviews and penetration testing
• Incident response procedures in the event of a data breach

In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it, as required by law.

12. Cookies and Tracking

Our app and website use only essential cookies. We do not use advertising cookies or third-party tracking on any part of our service accessible to children.

• Essential cookies – required for the app and website to function. Cannot be disabled.
• Session cookies – temporary, expire when you close the app or browser.
• Analytics cookies – anonymised usage data only. These can be declined.

We do not use cookies to build advertising profiles or track children across other websites or apps.

13. Changes to This Policy

When we make significant changes, we will:

• Notify parents by email to the registered account address
• Display a prominent notice in the app
• Update the Last Updated date at the top of this policy

Continued use of ActiBux after notification of changes constitutes acceptance of the updated policy. You may delete your account at any time if you do not agree with changes.

14. Specific Country Provisions

United States – COPPA

ActiBux complies with the Children’s Online Privacy Protection Act (COPPA). We do not collect personal information from children under 13 without verifiable parental consent. Parents may review, delete or refuse further collection of their child’s data by contacting support@actibux.com.

European Union and UK – GDPR / UK GDPR

Our lawful bases for processing are set out in Section 5. Our lead supervisory authority for UK GDPR purposes is the Information Commissioner’s Office (ICO). EU users may contact their local supervisory authority. We apply an age threshold of 16 for digital consent across EU markets in line with GDPR Article 8, unless local law specifies a lower age (minimum 13).

Brazil – LGPD

ActiBux complies with the Lei Geral de Protecao de Dados (LGPD). Brazilian users have the rights set out in Article 18 of the LGPD, which are reflected in Section 10 of this policy.

California – CCPA / CPRA

California residents have additional rights under the California Consumer Privacy Act. We do not sell personal data. California residents may request disclosure of data collected, request deletion, and opt out of any future sale of data (which we do not engage in).

Saudi Arabia – PDPL

ActiBux complies with the Personal Data Protection Law (PDPL) of Saudi Arabia. Users in Saudi Arabia have the rights set out in this policy and may contact us at support@actibux.com to exercise them.

All Other Markets

We are committed to complying with applicable data protection and children’s privacy laws in all 42 countries where ActiBux operates. If you have a question about your rights in a specific country, please contact us at support@actibux.com.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle children’s data, please contact us: