Privacy Policy

1. Introduction and Scope

This policy applies to the Personal Data we process when you use the Service. By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. It does not apply to third-party products or services that we do not control.

2. Information We Collect

Account information: when you create an account, our authentication provider processes your email address and login credentials. Lullu does not directly receive or store your password. You may also add details to your profile or provide information when you contact support.

Child information you provide: your child's name or nickname, date of birth or age, and the daily-care data you choose to record - such as sleep patterns, nap and bedtime schedules, feeding times and habits, and other routine, development, or wellbeing notes. You decide what to record, and you can edit or delete it at any time.

Pregnancy information (Expecting mode): gestational week, estimated due date, symptoms, appointments, notes, and other pregnancy-related information you choose to record.

Purchase information: when you buy a subscription, the purchase is processed by the Apple App Store or Google Play and managed through RevenueCat. We receive your subscription status and a purchase identifier, but we never receive or store your full payment-card details.

Technical information: to keep the Service secure and running, we and our providers process limited technical data such as device type, operating system, app version, and IP address. If you enable notifications, our push-notification provider processes a device token to deliver them.

3. How Our AI Features Work

Some features, such as the Oracle, use artificial intelligence to generate tips, summaries, and personalized guidance. Before sending information to our AI provider, we minimize and de-identify the content by removing direct identifiers such as your name, your child's name, and your email, and we send only the context reasonably necessary to generate the response you requested.

To provide these features, we may send this minimized, de-identified content to our third-party AI provider. Our AI provider does not use content submitted through its API to train its models, and we do not use it for advertising. AI-generated guidance is for general information only and is not medical advice.

4. Error and Crash Reporting

We use Sentry to record technical error and crash reports so we can find and fix problems. These reports contain diagnostic information such as the app version, device model, operating system, and the technical state of the app when an error occurred. We configure Sentry to avoid collecting the contents of your child-care records, and we do not use crash data to identify or profile you.

5. How We Use Your Information

We use the information we collect to: provide, maintain, secure, and improve the Service; store and synchronize the records you create; generate the tips and guidance you ask for; process your subscription and unlock paid features; respond to your support requests; send notifications and reminders you have enabled; and comply with our legal obligations.

We may create anonymized or aggregated information that no longer identifies you, and use it to understand and improve the Service. We do not attempt to re-identify it.

6. Legal Bases for Processing

Under the LGPD and, where applicable, the GDPR, we process Personal Data on the following bases: to perform our contract with you and provide the Service; with your consent, where we ask for it (for example, for push notifications or to record your child's information); for our legitimate interests in operating, securing, and improving the Service; and to comply with legal obligations. You may withdraw consent at any time, without affecting processing already carried out.

7. Children's and Pregnancy Data

Lullu is used by parents, guardians, and caregivers - not by children. Any information about a child is entered by, and remains under the control of, the adult who records it. In line with the LGPD's special protection for the data of children and adolescents, we process this information only in the child's best interest and only to provide the Service you requested. Where our processing relies on consent, we ask for the specific, highlighted consent of at least one parent or the legal guardian, as required by applicable law.

Certain information relating to pregnancy, health, growth, or development may constitute sensitive personal data and receives additional protection under applicable law. We collect the minimum information needed, keep it confidential, never sell it, and never use it for advertising. You can review, edit, export, or delete this information at any time in the app or by contacting us.

8. How We Share Information and Our Service Providers

We do not sell your Personal Data or share it for others' marketing. We share it only with the providers that operate the Service, each acting on our instructions and under a duty of confidentiality:

Clerk (authentication); Neon (database hosting); Amazon Web Services (backend infrastructure); RevenueCat (subscriptions, using a pseudonymous identifier); Sentry (error reporting); and a push-notification provider such as Apple Push Notification service or Firebase Cloud Messaging (notifications). We may also disclose information to a successor in a business transfer, or to authorities where required by law or to protect rights, property, or safety.

9. Where Your Information Is Stored and International Transfers

Account information and the records you enter in Lullu are stored on Amazon Web Services (AWS) infrastructure. AWS may process information in the United States or other locations described in its respective services.

When we transfer Personal Data internationally, we adopt the mechanisms and contractual safeguards required by applicable law, and we work with providers that offer appropriate privacy and security commitments.

10. Data Retention

When you delete your account, we delete your account and associated app data immediately, including your baby profiles, pregnancy information, care records, saved content, and app activity. We do not retain this account data or keep it in backups for an additional retention period. We may retain only limited records that we are legally required to keep, such as transaction or tax records, for the period required by law. Support requests are kept only as needed to respond and maintain a record of the request.

11. Data Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit (TLS/SSL), access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Please keep your account credentials confidential and contact us if you suspect any unauthorized use.

12. Your Rights

Depending on where you live, you have rights over your Personal Data. Under the LGPD you may: confirm whether we process your data and access it; correct incomplete or inaccurate data; request the anonymization, blocking, or deletion of unnecessary data; request the portability of your data; delete data processed based on your consent; obtain information about the parties we share data with; and be informed about the consequences of refusing consent.

If the GDPR applies to you, you also have the rights to restrict or object to processing and to receive your data in a structured, machine-readable format. To exercise any of these rights, contact us at hola@getlullu.com. You also have the right to lodge a complaint with a supervisory authority - in Brazil, the National Data Protection Authority (ANPD).

Lullu does not use Personal Data to make decisions based solely on automated processing that produce legal or similarly significant effects on you or your child.

13. Deleting Your Account

You can delete your account immediately from the app's Settings by opening Lullu, tapping the profile icon, selecting Account details, and tapping Delete account. You can also request deletion at https://getlullu.com/support by sending an email from the address associated with your account to hola@getlullu.com. We delete your account and associated app data immediately. We do not retain that account data or keep it in backups for an additional retention period. Only limited records that we are legally required to retain, such as transaction or tax records, may remain for the period required by law.

14. Cookies and the Website

Our marketing website uses only the minimal browser storage needed to remember your preferences, such as your chosen language. We do not use advertising or analytics trackers on the website, and the app itself does not use advertising cookies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the latest version. If we make material changes, we will notify you through the Service or by other reasonable means before they take effect.

16. Contact Us

If you have any questions or requests regarding this Privacy Policy or your Personal Data, please contact us at hola@getlullu.com.

Data controller: Pampero Labs, operating under the trade name Lullu, Brazil. Privacy contact: hola@getlullu.com.