Privacy Policy

Version 1.0 · Published 27 July 2026

---

Privacy Policy

Version: 1.0

Last updated: 27 July 2026

Effective date: 27 July 2026

---

1. Who we are

The Bebe Loves You application and website (together, the "Service", accessible at bebely.ro and through the Android and iOS mobile applications) are operated by:

A.I.D.A PFA

Registration number (CUI): 55006680

Registered office: Romania, Bucharest, District 2, Șoseaua Colentina, No. 16, Bl. A5, Ap. B44

Contact email: aidascriban@gmail.com

Within the meaning of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data ("GDPR"), we are the data controller of the information we collect about you and your child/children through the Service.

Data Protection Officer (DPO): We have not appointed a formal DPO, as our processing activities do not fall within the situations that trigger a mandatory DPO appointment under GDPR Art. 37. All requests regarding your data are handled directly by the operator, at the address above.

2. What data we collect

2.1. Data you provide directly

User account:

• First and last name
• Email address
• Profile photo (avatar, optional)
• Timezone and preferred language
• Password (stored only as a bcrypt hash, never in plaintext)

Data about your child (entered by you or by persons with whom you share the account):

• Name, date of birth, gender
• Photo (child avatar, optional)
• Measurements: weight, height, head circumference
• Medical visits: date, doctor, diagnosis, notes
• Vaccines administered: type, date, batch
• Reported symptoms: type, severity, temperature, notes
• Developmental milestones, regressions, teething
• Feeding: meals, breastfeeding, pumping, bottle feeding
• Sleep: bedtime, wake-up, duration
• Diapers: changes, type, appearance
• Moods, walks
• Personal notes about the child

Communications with us:

• Messages sent through the in-app support ticket system
• Messages sent to the AI medical chatbot (if you have a Premium subscription)
• Emails sent to our contact address

2.2. Data collected automatically

• IP address (used for security and coarse geolocation) — retained for 12 months in audit logs
• Device type, operating system, application version
• FCM token for push notifications
• Login and action timestamps (audit logs)
• Notification preferences
• Subscription status (active, expired, tier)

2.3. Data from third parties

• Google Sign-In: if you authenticate with your Google account, we receive from Google your email address, name and profile photo (according to standard Google permissions).
• RevenueCat: we receive subscription status (active/expired, plan type, renewal date). We do not receive or store your bank card details — payments are processed exclusively by Google Play or the Apple App Store.

2.4. Sensitive data

Much of the data about your child (measurements, medical visits, vaccines, symptoms) constitutes health data within the meaning of GDPR Art. 9 and benefits from additional protection. Its processing is based on your explicit consent given when creating the account and each child profile.

2.5. Your responsibility for content you enter

You are responsible for the accuracy of the data you enter and for the fact that you have the legal right to enter it. By using the Service, you expressly warrant that:

• You are the parent, legal guardian or legal representative of the child for whom you create a profile, or you have obtained their explicit consent;
• You have the right to enter any photograph, note or information concerning a third person (partner, doctor, other caregiver);
• The information you enter is accurate, up-to-date and does not infringe the rights of a third party.

We assume no liability for the consequences of entering inaccurate, illegal or unauthorised data.

3. Why we collect this data (GDPR legal bases)

Purpose of processing	Legal basis (Art. 6 / 9 GDPR)
Providing the Service (account, child tracking, notifications)	Performance of contract (Art. 6(1)(b))
Processing health data about the child	Explicit consent (Art. 9(2)(a))
Sending transactional emails (verification, password reset, notifications)	Performance of contract (Art. 6(1)(b))
AI medical chat	Consent (Art. 9(2)(a)) + legitimate interest
Billing and tax obligations	Legal obligation (Art. 6(1)(c))
Security, fraud prevention, audit logs	Legitimate interest (Art. 6(1)(f))
Improving the Service (aggregated, anonymised statistics)	Legitimate interest (Art. 6(1)(f))
Defending rights in court or investigations	Legitimate interest / legal obligation (Art. 6(1)(f)/(c))

We do not use your data for targeted advertising. We do not sell your data to third parties.

Anonymised data: We reserve the right to use fully aggregated and anonymised data (from which you cannot be identified) for any purpose, including analysis, benchmarking and improving the Service. Anonymised data is no longer personal data under the GDPR and may be retained indefinitely.

3.1. Automated processing and AI

The medical chatbot is powered by an artificial intelligence model (Anthropic Claude). Its responses are generated automatically, for strictly informational purposes, and do not replace consulting a doctor. The chatbot does not take decisions producing legal or significant effects on you within the meaning of GDPR Art. 22. You may choose at any time not to use this feature.

4. With whom we share your data (processors)

To provide the Service, we use the following processors (sub-processors). All are selected based on their GDPR compliance guarantees and have signed data processing agreements (DPAs):

Processor	Purpose	Data location
Contabo GmbH (Germany)	Backend + database hosting	European Union
Google Firebase (Google Ireland Ltd.)	Authentication + push notifications (FCM)	EU / USA (SCCs)
RevenueCat, Inc.	Subscription and billing management	USA (SCCs)
Anthropic, PBC	AI medical chat message processing	USA (SCCs)
Resend, Inc.	Transactional email delivery	USA (SCCs)
Google Play / Apple	Payment processing	Global (SCCs)

We reserve the right to add or change processors as the Service evolves. We will update the list above, and for substantial changes we will notify you through the channels described in Section 11.

We do not share data with other third parties except:

• Public authorities, when legally required (courts, police, ANSPDCP, tax authorities, etc.);
• Legal advisers, accountants or auditors, under confidentiality obligations, to the extent strictly necessary;
• Persons with whom you choose to share access to your child (through the sharing feature in the application);
• Legal successors or assignees of the Service — in the event of a merger, acquisition, sale of assets, reorganisation, bankruptcy or any similar transaction, data may be transferred to the successor entity, which will be obliged to comply with this policy or an equivalent one. We will notify you before such a transfer.

5. How long we keep your data

Data type	Retention period
Data of active account	For as long as the account is active
Data after account deletion	Generally deleted within 30 days from the active database
Backups	Generally deleted within 90 days after account deletion
Inactive accounts	We reserve the right to delete or anonymise accounts inactive for 24 consecutive months, after 30 days' prior email notice
Support tickets	Up to 3 years after closure (dispute record)
Audit logs (login, sensitive actions)	Up to 12 months
Invoices and tax data	10 years (legal obligation)
Sent emails	Up to 6 months (Resend log)

Retention exceptions: We reserve the right to retain certain data for longer than indicated above if:

• Required by law or regulatory obligation;
• There is a pending request, dispute, investigation or litigation and retention is necessary to resolve it;
• Data is necessary to establish, exercise or defend a legal claim;
• Data has been irreversibly anonymised (in which case the above retention limits no longer apply).

6. Where we store data and international transfers

The main database and uploaded files (child photos, avatars) are hosted in the European Union, at Contabo GmbH (Germany).

Certain services we rely on (Firebase, RevenueCat, Anthropic, Resend, Google/Apple) process data in the United States of America or other countries outside the European Economic Area. For these transfers, we rely on one or more of the following legal mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Art. 46(2)(c);
• Adequacy decisions of the European Commission (where they exist);
• Data Privacy Framework certifications (where applicable);
• Other appropriate safeguards provided by GDPR Chapter V.

7. Data security

We apply appropriate technical and organisational measures to protect your data:

• Encryption at rest: sensitive child data (names, measurements, medical visits, symptoms) is encrypted in the database using a per-user KEK (Key Encryption Key) scheme. Even in the event of unauthorised access to the database, these fields remain encrypted.
• Encryption in transit: all client-server communications use HTTPS/TLS 1.2+.
• Password hashing: passwords are stored exclusively as bcrypt hashes (not in plaintext).
• Authentication: JWT with refresh tokens, sessions with expiry.
• Admin authentication: mandatory 2FA (TOTP) + IP allowlist.
• Audit logs: all sensitive actions (login, deletion, permission changes) are logged.
• Backups: automated, daily, generally retained for up to 90 days.

Security limits: No IT system is 100% secure. We are not liable for losses resulting from:

• Compromise of your credentials (weak password, phishing, password reuse on other sites);
• Use of infected, outdated or inadequately secured devices;
• Force majeure causes (natural disasters, massive cyberattacks on global infrastructure, actions of public authorities);
• Fraudulent acts of third parties, beyond the reasonable measures we have implemented.

In the event of a security breach affecting our data: we will notify ANSPDCP within a maximum of 72 hours of becoming aware, pursuant to GDPR Art. 33. We will notify you only if the breach is likely to result in a high risk to your rights and freedoms, pursuant to GDPR Art. 34.

8. Your rights (GDPR Art. 15-22)

You have the following rights regarding your personal data:

• Right of access (Art. 15) — to obtain confirmation that we process data about you and a copy thereof
• Right to rectification (Art. 16) — to correct inaccurate data
• Right to erasure / "right to be forgotten" (Art. 17) — to request deletion of your data
• Right to restriction of processing (Art. 18) — to limit how we use the data
• Right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format (JSON)
• Right to object (Art. 21) — to object to processing based on legitimate interest
• Right not to be subject to automated decision-making (Art. 22) — we do not take decisions with legal effects based solely on automated processing
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
• Right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro. If you reside in another EU country, you may also lodge a complaint with your local supervisory authority.

8.1. Limits of these rights

All the rights above are exercised within the limits and exceptions set out in the GDPR. In particular:

• The right to erasure does not apply insofar as processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation (tax, accounting), for establishing, exercising or defending legal claims, or for archiving in the public interest (Art. 17(3) GDPR).
• The right to portability applies only to data you have provided to us directly and only to data processed on the basis of consent or contract — not to derived or aggregated data.
• The right of access may be limited if its exercise would adversely affect the rights and freedoms of others.

8.2. How to exercise your rights

• In the app: open the *Support* section and create a ticket with the "GDPR request" category.
• By email: to aidascriban@gmail.com (recommended if you have already deleted your account).

8.3. Response time

We respond within a maximum of 30 calendar days. For complex or numerous requests, this deadline may be extended by up to 60 additional days, pursuant to GDPR Art. 12(3), in which case we will inform you of the extension within the first 30 days.

8.4. Fees and excessive requests

We respond free of charge to reasonable requests. For manifestly unfounded, excessive or repetitive requests (in particular by reason of their recurring character), we reserve the right, pursuant to GDPR Art. 12(5), either to charge a reasonable fee corresponding to the administrative costs, or to refuse the request.

8.5. Identity verification

For your protection, we may request additional information to confirm your identity before responding to a request (in particular for access or erasure requests).

9. Minors

The Service is intended for persons aged 16 and older. We do not knowingly collect data from users below that age.

Data about babies and young children is entered by parents or legal representatives, who bear responsibility for the accuracy of the information and for giving consent for its processing, as set out in Section 2.5.

If you believe we have collected data from a user under the age of 16 by mistake, please contact us immediately for deletion.

10. Cookies and similar technologies

The bebely.ro website uses a minimal number of strictly necessary cookies for functionality (session, language preference). We do not use advertising or third-party tracking cookies.

The mobile application does not use cookies, but does use:

• Local storage for session (JWT token, preferences)
• FCM (Firebase Cloud Messaging) for push notifications — you can disable notifications from your operating system settings at any time

11. Changes to this policy

We may update this policy at any time to reflect legal changes, new features or feedback. Whether a change is substantial is determined solely by the operator, acting in good faith.

For substantial changes:

• We will notify you in the app via a persistent banner;
• We will ask for your explicit re-acceptance before you continue using the Service, with a grace period of 7 days from notification;
• We will send a notification email to the address associated with your account.

Continued use of the Service after changes take effect constitutes acceptance. If you do not agree with the changes, you may stop using the Service and request account deletion under Section 8.

Minor changes (editorial corrections, clarifications, updates to the processor list that do not substantially affect processing) take effect on publication, without separate notice.

You can always consult the current version at bebely.ro/legal/privacy.

12. Links to other sites

The Service may contain links to third-party sites or services (for example app stores, medical articles, partners). We are not responsible for the privacy policies or practices of those third parties. We encourage you to read their policies before using them.

13. Governing law and jurisdiction

This policy is governed by Romanian law and the applicable law of the European Union (primarily the GDPR).

Any dispute regarding the interpretation or performance of this policy shall be resolved amicably. If amicable resolution is not possible, jurisdiction belongs to the courts of Romania, namely the courts in the district of the operator's registered office (the municipality of Bucharest), subject to the mandatory rights of consumers granted by the law of their habitual residence in the EU.

14. Contact

For any question regarding the processing of your data:

A.I.D.A PFA

Email: aidascriban@gmail.com

Address: Romania, Bucharest, District 2, Șoseaua Colentina, No. 16, Bl. A5, Ap. B44

In the app: *Support* section → "GDPR request" category

Supervisory Authority (Romania):

ANSPDCP — Romanian National Supervisory Authority for Personal Data Processing

B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest

Website: www.dataprotection.ro

Email: anspdcp@dataprotection.ro

If you reside in another EU country, you may lodge a complaint with your local supervisory authority. A list of all EU supervisory authorities is available at <https://www.edpb.europa.eu/about-edpb/about-edpb/members_en>.