Privacy Policy

1. Who We Are (Controller)

Lullanest is the data controller responsible for your personal data. For any privacy request or question, contact us at privacy@lullanest.app. If we appoint a representative or data protection officer, their details will be published on this page.

2. Data We Collect

We collect the following categories of personal data:

• Account data: your name, email address, and authentication identifiers (including Apple or Google sign-in identifiers if you use them).
• Baby and household data that you enter: your baby's first name, date of birth, gender, and your sleep-program inputs.
• Sleep and activity logs that you record: bedtime rituals, night wakings, naps, morning wake times, protest/settling details, mood, feedings, diaper changes, and free-text notes.
• Partner data: if you invite a partner, we process their name and account so a household can share a program.
• Subscription data: your plan, entitlement status, and purchase events received from the app stores via our payments processor. We do not store full card numbers — payment is handled by Apple, Google, and our payments processor.
• Device and technical data: device type, operating-system version, app version, push-notification tokens, crash and diagnostic data, and an approximate location inferred from your IP address.
• Usage and analytics data: in-app events and interactions, used to understand and improve the product.

Baby data is entered by you, the parent or guardian, on behalf of your child. You are responsible for the accuracy of the information you provide and for your authority to provide it.

3. How We Use Your Data

We use personal data to:

• Provide, operate, and secure the App and your account.
• Deliver the structured sleep program, progress tracking, insights, and reminders.
• Generate personalized insights and celebratory or supportive content. Some of these features may use artificial-intelligence models; where they do, we send limited, relevant data to a trusted technology provider that supplies the underlying language-model technology, under contractual confidentiality and data-protection terms, and we do not permit that provider to use your data to train its general models.
• Send transactional and service messages (for example, email verification codes and account notices) and, where you have enabled them, push notifications.
• Process subscriptions and manage entitlements.
• Understand usage in aggregate, debug, and improve the App.
• Comply with legal obligations and enforce our Terms.

4. Legal Bases for Processing

Where the EU/EEA General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the App and the services you request.
• Consent — for optional features such as push notifications and certain analytics; you may withdraw consent at any time.
• Legitimate interests — to secure, debug, and improve the App, where not overridden by your rights.
• Legal obligation — to comply with applicable law.

In Israel, we process personal data in accordance with the Protection of Privacy Law, 5741-1981 and its regulations.

5. Data Sharing and Disclosure

We do not sell or rent your personal data. We share data only as follows:

• Service providers (processors) who operate the App under contract, including: Supabase (authentication and database hosting), our payments processor together with Apple and Google (subscription billing), Expo (push-notification delivery), our product-analytics provider hosted in the EU, and an AI/language-model provider for the features described in Section 3.
• Your household partner, who can see the shared program and logs you choose to share with them.
• Research partners, only in anonymized and aggregated form that cannot reasonably identify you or your child.
• Legal and safety disclosures, where required by law, court order, or to protect rights, safety, and the integrity of the App.
• Business transfers, where data may be transferred as part of a merger, acquisition, or sale of assets, subject to this Policy.

6. International Data Transfers

We and our service providers may process data in countries other than your own. Where we transfer personal data internationally, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), or transfers to jurisdictions recognized as providing adequate protection.

7. Data Retention

We keep personal data for as long as your account is active or as needed to provide the App, and thereafter for the period required to comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it. You can request deletion as described in Section 8.

8. Your Rights

Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. To exercise any right, contact privacy@lullanest.app. We will respond within the timeframes required by law. You also have the right to lodge a complaint with a supervisory authority.

EU/EEA residents (GDPR): you may complain to your local data protection authority. UK residents (UK GDPR / Data Protection Act 2018): you may complain to the Information Commissioner's Office (ICO). Israel: you may contact the Privacy Protection Authority.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, to request deletion or correction, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. We will not discriminate against you for exercising your rights, and you may use an authorized agent to submit a request. To exercise these rights, contact privacy@lullanest.app.

10. Children's Privacy

The App is intended for use by adults (parents and guardians), who enter information about their own children. The App is not directed to children, and we do not knowingly collect personal data directly from a child under 16 (or under the age set by your local law, including under 13 for purposes of the US Children's Online Privacy Protection Act). If we learn that we have inadvertently collected personal data directly from a child, we will take reasonable steps to delete it. If you believe a child has provided us personal data, contact privacy@lullanest.app.

11. Data Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and a backend architecture in which the mobile app never holds direct database credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. App Store Disclosures

Our Apple App Store "privacy nutrition label" and Google Play "Data Safety" disclosures summarize the data the App collects and how it is used, consistent with this Policy. Subscriptions are sold and managed by the relevant app store; purchase data is shared with us by the store and our payments processor to manage your entitlement.

13. Third-Party Links and Services

The App and our website may link to third-party services that we do not control. Their privacy practices are governed by their own policies, and we encourage you to review them.

14. Changes to This Policy

We may update this Policy from time to time. We will revise the "Last updated" date and, for material changes, provide additional notice through the App or by email. Your continued use of the App after an update means you accept the revised Policy.

15. Contact Us

For any privacy question or request, contact us at privacy@lullanest.app.