Privacy Policy

Ninou is a baby-tracking app shared within a family. We take the protection of your data — and especially your child’s data — very seriously. This policy explains what data we process, why, and what your rights are under the General Data Protection Regulation (GDPR).

Data controller

The data controller is [TO COMPLETE: company name] (see the legal notice). For any question about your data: privacy@getninou.app.

Data we process

• Account: email address, first name, last name, password (encrypted), preferences.
• Child: first name, date of birth, sex, photo (optional).
• Tracking data, potentially health data: feeds/bottles, diapers, sleep, temperatures, weight, height, head circumference, developmental milestones, medical appointments, notes.
• Family: invited members, roles and access permissions.
• Technical data: connection logs strictly necessary for operation and security.

Purposes and legal bases

• Providing the tracking and family-sharing service: performance of the contract.
• Processing the child’s health data: on the basis of your explicit consent, which you can withdraw at any time by deleting the relevant data or your account.
• The “Ninou” AI assistant: see the dedicated section below.
• Security, fraud prevention and legal obligations: legitimate interest / legal obligation.

“Ninou” AI assistant

When you ask Ninou a question, the relevant context of your child (e.g. age, recent activities, measurements) is sent to our processor OpenAI to generate an answer. These exchanges are not used to train models. You can use the app without ever using the Ninou assistant.

Processors and recipients

Your data is never sold. It is accessible only to our technical processors:

• Supabase: database, authentication and storage (EU).
• OpenAI: generating Ninou’s answers (United States, with appropriate contractual safeguards).
• Vercel: hosting of the marketing website.
• RevenueCat / Apple / Google: management of Premium subscriptions.

The family members you invite access the data according to the permissions (read, write, administration) that you define.

Transfers outside the EU

Some processors (OpenAI) are located outside the European Union. These transfers are governed by appropriate safeguards (standard contractual clauses).

Retention period

Your data is kept for as long as your account is active. When you delete your account from the app (Privacy & security → Delete my account), your personal data and the families of which you are the only member are deleted permanently and immediately.

Security

Access to data is partitioned by family using database-level security rules (Row Level Security). Exchanges are encrypted in transit (HTTPS) and passwords are never stored in plain text.

Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability. The app lets you export your data in JSON format and delete your account at any time. To exercise your other rights, write to privacy@getninou.app. You may also lodge a complaint with your local data protection authority (in France, the CNIL — cnil.fr).

Children

Ninou is intended for parents and people responsible for a child. Data about the child is entered and controlled by the adults holding parental authority.

Changes

We may update this policy; the last-updated date appears at the top of the page.