HP Robots privacy policy
Effective 5 October 2026. Version 2.0, replacing the version of 17 March 2026.
This Privacy Policy explains how MORAVIA Consulting spol. s r.o. collects, uses, stores and discloses personal data when you use the HP Robots website, the STEAMhub, and the Otto coding application on the web and on iOS and Android devices.
1. The data controller
The controller of the personal data described in this Policy is MORAVIA Consulting spol. s r.o., a company registered in the Czech Republic under company number 49967550, whose registered office is at Olomoucká 83, 627 00 Brno, Czech Republic.
General enquiries may be addressed to support@hprobots.com or made by telephone to +420 541 422 511. Questions about this Policy, and requests concerning your personal data, should be made in writing to support@hprobots.com.
2. Using Otto without an account
An account is not required in order to use Otto.
The coding application operates without a sign-in. You may write code and connect a robot by Bluetooth without providing any information that identifies you. Work created in this way remains on the device on which it was created, and in the iOS and Android applications it is stored on that device, so that a student may return to it in a later lesson without registering at any point. Three of the lessons published on the website may also be accessed without an account.
It is therefore possible to teach Otto from beginning to end without any student being identified to us.
In the event that the application encounters an error, it transmits a crash report to us so that we are able to correct the fault. Each report contains the device model, the operating system version, the application version and the language setting. It contains no name, no email address and no material created by a user, and it is not associated with any individual. We rely upon our legitimate interest in maintaining a functioning product as the lawful basis for this processing. A crash report is the only information the application transmits while you are signed out, and the application performs no analytics of any kind.
3. Accounts
An account exists in order that work may be opened again at a later date, or on a different device.
An account contains an email address, a name, a profile picture where one has been added, the work saved to the account, and administrative records such as the dates on which the account was created and last used. Passwords are not received by us at any point. Sign-in is performed by Google Firebase Authentication, with the result that a password is transmitted to Google and does not reach our servers in any form. You may alternatively sign in using a Google or an Apple account.
We process this information in order to provide access to the lessons and the accompanying materials, to store your work and make it available to you, to maintain the security of the account, and to respond to you when you contact support. The lawful basis for this processing is the performance of the agreement under which those services are provided. Before an account becomes active we send a confirmation link to the email address given, so that no other person is able to register using that address.
The newsletter option on the registration form is presented separately from the agreement to this Policy and is not selected by default. We will send you information about our products only if you select it. Every such message contains an unsubscribe link, and you may withdraw your consent at any time.
The application provides a Delete account function, which removes the account, the work saved to it and any picture. You may alternatively make that request to support@hprobots.com, and we will carry it out and confirm to you when it has been completed.
Accounts for students
Accounts for students are created by an adult: either by the teacher, using the email addresses issued by the school, or by a parent on behalf of their own child. We neither ask students to register themselves nor invite them to do so.
The name recorded against an account is free text and is not verified by us. We ask schools to enter initials, a first name, or an identifier such as “Y5 pupil 12” in place of a full name. Where that practice is combined with a school address that carries no name, we hold no information by which the child may be identified.
We do not create profiles of students, we do not direct advertising to them, we do not use their work for the training of any system, and we do not sell, rent or otherwise disclose their data for the purposes of any other party.
4. The robot
The robot is located and operated by means of a Bluetooth connection between the robot and your device. That connection extends no further, and no information concerning the operation of the robot is transmitted to us or to any other party.
The application requests location permission, and it neither uses nor records your location. When the robot’s software is updated, the application offers to enter your Wi-Fi network name on your behalf, and both the Android and the iOS operating systems require location permission before an application may read a network name.
The Wi-Fi password that you enter is transmitted directly to the robot by Bluetooth, so that the robot is able to download its own update. It does not at any time reach our servers, and the application does not retain it.
5. Children and schools
Otto is used by children, and the product has been designed so that a child is able to use the whole of it without our holding any information by which that child may be identified.
We do not rely upon the consent of a child for any purpose. Every account is created by an adult, and that adult is the person responsible for it. We do not ask children to agree to this Policy, and we do not knowingly collect personal data from a child who has registered without the involvement of an adult. If you have reason to believe that this has occurred, please write to support@hprobots.com and we will delete the account and its contents.
Where a school requires us to enter into a data processing agreement, we will do so.
In respect of schools in the United States, we process student data solely in order to provide the service that the school has requested. We do not use it to construct profiles, we do not use it for advertising, and we do not sell it. Where student data forms part of a school’s education records, we process it as a school official with a legitimate educational interest, acting under the direction of the school, and we will assist the school in responding to a parent’s request to access, correct or delete it.
Parents should note that where a child uses Otto at school, the school determines what data is held, and a request made through the school will usually be answered most quickly. If you have created an account for your child yourself, you may ask us at any time for a copy of the information that it contains, or for that information to be deleted.
6. Cookies and tracking
The Otto application performs no analytics. We do not record which screens are opened, the length of time for which the application is used, or which controls are selected, and the application contains no advertising identifiers and no cross-application tracking. Since there is no tracking for which permission need be sought, iOS does not display the “allow tracking” prompt.
The website uses cookies, in four categories. Functional cookies are necessary in order for the site to operate and are always active; they include the cookies that keep you signed in and those that record the consent choices you make. Preference cookies store individual settings. Statistics cookies, which include Google Analytics, measure how the site is used. Marketing cookies are set by the YouTube videos embedded in our pages and by Google reCAPTCHA, which filters automated form submissions.
Every category other than the functional one is set only where you have accepted it. When you first visit the site you may accept all categories, refuse them all, or choose between them and save your preferences, and you may change your choice at any time using the manage consent control on the site. A complete list of the individual cookies, naming each one, the service that sets it, its purpose and how long it lasts, is published in our cookie policy at https://hprobots.com/cookie-policy-eu/.
7. Disclosure, storage and retention
We do not sell personal data.
We engage service providers under contract, and disclose personal data to them only to the extent necessary for the services that they perform. Those services are hosting and database provision, sign-in, the storage of pictures, crash reporting, the automatic confirmation and password reset messages, and the newsletter. We will identify any of these providers on request. No data is disclosed to the newsletter provider unless you have selected the newsletter option, and in that event only your email address is disclosed. We may also disclose personal data where we are required to do so by law, or where it is necessary in order to establish or defend a legal claim.
Account data and saved work are stored within the European Union. One provider is established outside it: the automatic confirmation and password reset messages are sent by SendGrid, part of Twilio Inc. of the United States, which receives your email address and the content of that message and nothing further. Twilio participates in the EU-US Data Privacy Framework, and we additionally rely upon the European Commission’s standard contractual clauses as a safeguard for that transfer.
An account and the work saved to it are retained for as long as the account exists, and both are deleted when the account is deleted. A project that you delete may be restored for a period of 7 days, after which it is removed. Records of a robot software update are deleted after 7 days. Newsletter and support records are retained only for as long as they are required for those purposes. We do not retain personal data indefinitely.
8. Security
Passwords do not reach our servers at any point, with the result that we hold no password that could be stored, lost or compelled from us. Your account and the work saved to it are stored within the European Union with Google Cloud, which encrypts that data both in storage and in transit.
Where a personal data breach is likely to result in a risk to any individual, we will notify the competent supervisory authority within 72 hours and will inform the individuals affected without undue delay.
9. Your rights
If you are in the European Union or the United Kingdom, you have the right to request a copy of your personal data, to have it corrected, to have it deleted, to restrict or to object to our processing of it, to receive it in a portable format, and to withdraw your consent where our processing is based upon consent. The withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.
If you are in the United States, your rights are determined by the law of your state. Where your state confers rights to know, to delete, to correct, or to opt out of the sale of personal data or of targeted advertising, we will honour them. We do not sell personal data and we do not use it for cross-context behavioural advertising.
Requests should be addressed to support@hprobots.com. We will respond within one month, and no fee is payable. Where a request is complex we may require a longer period, and we will explain the reason to you.
You are not obliged to provide any of the information described in this Policy. Otto may be used without an account, and an account requires only an email address and a name.
10. Complaints
We ask that you raise any complaint with us in the first instance, by writing to support@hprobots.com, so that we may seek to resolve it. We will acknowledge your complaint within 30 days and will inform you of the outcome without undue delay.
You are also entitled to complain to a supervisory authority, and you are not required to contact us before doing so. In the United Kingdom the supervisory authority is the Information Commission (the ICO), at ico.org.uk. In the Czech Republic it is the Office for Personal Data Protection, the Úřad pro ochranu osobních údajů, at uoou.cz. Elsewhere in the European Union, you may complain to the supervisory authority of your own country.
11. Changes to this Policy
Where we make a material change to this Policy, we will publish the revised version on this page with a new effective date, and we will notify account holders by email at or before the time it takes effect. Previous versions are available on request.
MORAVIA Consulting spol. s r.o., Olomoucká 83, 627 00 Brno, Czech Republic
