Company roles and responsible entity
Ulmio — Powered by UltriumAI. Ulmio is owned and operated by UltriumAI LLC. Hosting and operations: UltriumAI LLC. UltriumAI LLC is legally separate from Ultrium LLC; no division, brand, DBA or subsidiary relationship is asserted.
Owner-confirmed legal identity: UltriumAI LLC, Virginia Limited Liability Company, United States. Virginia Entity ID: 11865834. Updated business principal office and public operator mailing address, approved by the owner for these drafts: 9413 Hull Street Rd, Ste C2, North Chesterfield, VA 23236-1246, United States. Legal sufficiency for the intended disclosures remains subject to review; owner approval is not a regulatory determination. Public support email, privacy email and telephone remain pending. A postal address does not replace required email and telephone disclosures. Required contact disclosures and consent arrangements must be completed and reviewed before affected policies can become effective; the Children's Privacy Notice remains a draft and public-launch blocker.
Future subscription contracting company and payment recipient: UltriumAI LLC. Intended payment processor: Stripe. No new payment service is activated. External AI processors and infrastructure services are distinct from the legal operator and merchant. Policies remain drafts pending legally sufficient contact information, consent arrangements and legal review.
Information you provide
Parents can provide an email address, password credentials and family name. Optional social sign-in involves the chosen identity provider. Child profiles contain a nickname, grade, age band and parent-managed PIN. Conversations may include anything entered by the user; please avoid unnecessary identifying or sensitive information.
The service can store prompts, replies, titles, images and preferences. General file uploads are not currently enabled in the chat composer.
Service-generated information
The service generates account and session identifiers, conversation titles, responses, artwork, activity totals and safety-event metadata. Security records may include login IP addresses, timestamps and success or failure. Optional notification settings may include an email destination.
Why information is processed
The intended purposes are account access, delivering requested conversations, saving content, applying family permissions and usage controls, preventing abuse and supporting service reliability. Approved legal grounds and regional disclosures require review; this draft is not a blanket consent.
Service providers and external AI
Lovable Cloud supports application data, authentication and private file storage. Lovable AI Gateway and the selected AI provider may receive authorized prompts and relevant conversation context or image descriptions. Google receives information needed for Google sign-in when selected. Font requests reach Google Fonts.
Live child AI remains disabled. The adult administrator beta can send authorized requests to OpenAI through Lovable AI Gateway. Other provider integrations do not imply authorization or public availability. Contractual retention, training use, subprocessor details and international processing locations require verification; this draft promises neither zero retention nor no training.
Visitor analytics
Lovable provides analytics for the published site. Its analytics uses no cookies, stores nothing on the visitor’s device, does not keep IP addresses and does not identify visitors.
It records pages visited, referral sources, country, browser, operating system, device type, time on page, page-load performance, errors and clicks on buttons and links. Clicks are identified by location, not their text. No additional custom product events were identified; application error reporting is included in errors.
There is currently no analytics consent banner. Clicks and the other listed analytics are recorded for every visitor. Page visits, time on page, page speed and errors are recorded without cookies and without identifying anyone. The editor preview is not counted. Detailed data is kept for 90 days; daily summaries for one year.
Lovable’s role
Lovable collects this data for us. Lovable’s privacy policy explains how it handles it. These statements do not mean Ulmio’s accounts and other services store nothing.
Lovable’s privacy policyBrowser storage and security
Authentication sessions, child session credentials, theme preferences and local practice conversations can be stored in the browser. They serve different purposes from visitor analytics. Account authorization and private-content permissions are implemented; they do not guarantee detection of every misuse or breach.
Retention and deletion
Parent settings govern application child-conversation retention. Scheduled cleanup is implemented, but this draft does not promise immediate or complete deletion from all systems. Artwork, account records, security logs, safety records and provider or backup copies need a reviewed retention schedule.
Some application deletion controls exist. Financial records may prevent deleting a linked adult conversation. Removing artwork can hide it before private-file cleanup is confirmed. Account-wide deletion, verified privacy-request tracking and backup deletion verification are not complete.
Rights, requests and changes
Applicable rights may include access, correction, deletion and consent withdrawal, depending on location and circumstances. Requests involving children require verified identity and parental authority, with sensitive safeguarding protections preserved. See Data Rights & Deletion.
UltriumAI LLC is the confirmed operator; the updated business mailing address is listed above, while a responsible privacy contact and verified request channel remain pending. Do not send credentials or child transcripts through an unverified channel. Material changes require renewed review and notice, and re-consent where required.