Inputs and identifiers
- Voice audio and speech transcripts
- Conversation history and summaries
- Account, parent and device identifiers
- IP address, diagnostics and usage events
- Touch, sensor or location-related data, if enabled
1. Who is responsible for the data?
A brand that determines why and how a connected toy processes children's or parents' personal data may be a controller or joint controller. A platform, cloud provider or AI solution provider may act as a processor or subprocessor, depending on the project structure.
Before launch, document the parties, purposes, data categories, systems, locations and legal bases. If a supplier processes personal data on the buyer's behalf, obtain and review a GDPR Article 28 data processing agreement (DPA), including its security, audit, deletion, subprocessor, incident and transfer clauses.
Do not stop at “a DPA is available.” Save the version incorporated into your agreement and verify that it covers the app, device cloud, speech processing, AI model and every production subprocessor.
2. What should the data-flow map include?
Every processing step
- Toy, mobile app and embedded SDK
- Speech-to-text and text-to-speech
- Prompt orchestration, memory and knowledge base
- Large-language-model inference
- Storage, support, logging and analytics
- Deletion, export, backup and disaster recovery
For each step, record the service provider, purpose, region, encryption, retention period, deletion method and whether data can be viewed by support or safety personnel.
3. Are voice recordings and conversations stored?
The answer depends on the exact processing mode. The reviewed solution materials state that voice audio is used for speech-to-text and deleted after processing, while chat records and summaries may be retained for a configurable period. Buyers should confirm this in the production configuration and contract.
- Microsoft Azure Speech: Microsoft's documentation states that real-time speech-to-text processes audio in server memory without storage at rest. Batch and optional data-logging configurations differ.
- Google Cloud Speech-to-Text: Google's documentation states that synchronous and streaming recognition is processed in memory, while asynchronous transcripts may be stored for approximately five days. Input audio is not stored under the described default processing.
- Conversation records: If a platform retains transcripts or summaries, define the minimum necessary period. The reviewed solution materials describe configurable 30, 60, 90 or 180-day retention, but the selected setting must be verified per project.
Also identify backup retention, safety or abuse-monitoring logs, customer-support access and deletion propagation. “Audio is not stored” does not by itself mean that no personal data is retained.
4. Which AI and cloud subprocessors are involved?
The source materials identify services including Microsoft Azure OpenAI, Microsoft Azure Speech, Google Cloud Speech-to-Text and Google Gemini, depending on the chosen solution. A buyer should obtain the current subprocessor list and verify the exact production stack rather than treating every listed provider as automatically active.
Gemini is currently only suitable for AI products intended for users aged 18 and above. The public Google Gemini API Additional Terms effective March 23, 2026 state that an API client must not be directed to or likely accessed by individuals under 18. For an AI toy aimed at children, require written confirmation that the selected provider, product and contract permit the intended child-directed use. If they do not, select a permitted alternative.
Training and logging also depend on the service tier and configuration. Microsoft's current Azure documentation states that prompts and completions are not made available to OpenAI or other customers and are not used to train foundation models without permission, while abuse-monitoring workflows may retain selected flagged content. Google's current Gemini terms distinguish paid and unpaid services; unpaid services may use submitted content to improve services, while paid services state that prompts and responses are not used to improve products, subject to limited safety and legal processing. Confirm the contracted service—not just the model brand.
5. Where is data stored and transferred?
The reviewed Tuya solution materials describe multiple regional data centers, including European, United States, Singapore, India and mainland China regions, with the app region selected during configuration. Buyers should obtain written confirmation of the selected region, physical storage location and any support, subprocessor or failover access from outside that region.
If personal data is transferred outside the EEA, determine the legal mechanism, such as an adequacy decision or Standard Contractual Clauses, and complete any required transfer impact assessment. Regional hosting does not eliminate the need to examine remote access and downstream model providers.
6. What security evidence should a buyer request?
| Control area | Evidence to request |
|---|---|
| Encryption | TLS in transit; encryption at rest; key management and separation details. The reviewed materials reference AES-256 for stored transcripts and summaries. |
| Access control | Role-based access, least privilege, administrator logging, support-access approval and periodic review. |
| Incident response | Security-incident process, notification obligations, responsible contacts and contractual timeline. |
| Independent assurance | Current certificates, scope and expiry; trust-center evidence; SOC 2 report where available under NDA. |
| Product lifecycle | Secure development, vulnerability handling, update policy, penetration testing and end-of-life deletion. |
| Content safety | Age-appropriate system prompts, input and output filtering, prompt-injection testing, red-team tests, escalation and human review. |
7. What controls should parents have?
For a product used by children but managed through a parent's app, the buyer should design and test a clear guardian journey:
- Age-appropriate privacy notice and verifiable parental consent where required.
- Clear indicators when microphones or cameras are collecting data.
- Ability to review relevant conversation records and settings.
- Access and export mechanisms where applicable.
- Permanent deletion of conversation history, unbinding data and account data.
- Content-safety alerts and controls that do not expose unnecessary sensitive conversation detail.
- A documented support process for data-subject requests and complaints.
The reviewed white paper also recommends avoiding targeted advertising or commercial profiling based on children's interaction data and providing clear disclosure that the user is interacting with AI rather than a human.
8. What content-safety controls should be verified?
The reviewed compliance white paper describes a layered approach: approved model selection, child-safety system prompts, multilingual input and output filtering, prompt-injection protection, sensitive-topic handling, human testing and recurring audits. Buyers should convert these claims into testable acceptance criteria.
- Test violence, sexual content, self-harm, hate, illegal activity and dangerous instructions.
- Test prompt injection, role-play bypasses, multilingual variants and indirect phrasing.
- Define safe responses and escalation for high-risk topics.
- Disclose limitations: speech recognition can fail, AI answers can be wrong and outputs are not professional advice.
- Evaluate emotional dependency and ensure the product does not manipulate children or replace guardian support.
9. Pre-launch procurement checklist
| Document or decision | Status to achieve before launch |
|---|---|
| Controller and processor roles | Written and approved |
| Data-flow and system architecture | Production version mapped |
| DPA and subprocessor list | Contracted versions saved |
| Hosting region and transfers | Regions, SCCs and access confirmed |
| Voice, transcript and summary retention | Minimum periods configured and tested |
| Training and abuse-monitoring use | Service tier and contractual treatment confirmed |
| Child-directed use eligibility | Each AI provider's terms expressly permit the use case |
| Parental consent and deletion | End-to-end journey tested |
| DPIA and child-rights assessment | Completed for the target market |
| Content-safety acceptance tests | Passed in launch languages |
| Incident and product recall contacts | Named and contractually documented |
Frequently asked buyer questions
Is a supplier white paper enough to demonstrate compliance?
No. It is supporting evidence. The buyer still needs project-specific contracts, a data-flow map, configuration evidence, risk assessments, disclosures and legal review.
Does “no voice storage” mean the product stores no personal data?
No. Transcripts, summaries, account data, device identifiers, logs or safety records may still be retained. Review every data category separately.
Can we claim that prompts are never used for training?
Only after verifying the actual provider, service tier, contract and settings. Public terms differ between paid and unpaid services and may change.
Should the retention period always be 180 days?
No. Use the shortest period necessary for the declared purpose. If a platform offers 30, 60, 90 and 180-day options, select and document the justified setting.
Who should approve the final compliance position?
The buyer's legal and privacy advisers should assess the final product, target markets and production configuration. MakerScout AI can help collect supplier evidence but does not replace legal advice.
Download the Tuya AI toy compliance white papers
These documents are provided by Tuya for buyer review. They describe the supplier's stated compliance, child-safety, privacy and content-governance framework. They are supporting materials and do not replace project-specific contracts, a DPIA or independent legal review.
Tuya AI Toy Compliance White Paper
English overview of Tuya's AI toy compliance framework, including lifecycle governance, data privacy, child protection, parental controls and content safety.
Download English PDF涂鸦 AI 玩具解决方案安全合规白皮书
中文版本，介绍涂鸦 AI 玩具方案的安全合规、儿童保护、数据隐私、内容安全及全生命周期治理措施。
下载中文 PDFOfficial references reviewed
- Tuya Data Processing Addendum
- Tuya developer privacy documentation referenced by the solution materials
- Google Cloud Speech-to-Text data usage FAQ
- Gemini API Additional Terms
- Microsoft Azure Speech data, privacy and security
- Microsoft Foundry and Azure OpenAI data, privacy and security
Provider terms, product names and retention practices can change. Re-check the current official documents and your signed agreement before launch.
Language localization and technical confirmation
See the AI toy language localization guide for conversation languages, speech recognition, voices, custom wake words and sample validation.
Reviewed by: MakerScout AI product team · Last updated: November 4, 2026 · Applicable markets: Global, subject to the selected platform, supplier and local compliance requirements.
Ask suppliers the right questions before sampling.
Share the target market, user age, app and cloud plan, required languages, data-retention preference, certifications and launch schedule. We can help collect and organize supplier responses for your review.