Privacy Policy
Last updated: 25 September 2026
Summary
The short version, with detail below. We collect your email address and the planning details you enter — due date, budget style, feeding plan and similar. We use them to build and save your plan, run your subscription, and improve the service. We do not sell your data or use it for targeted advertising. If you allow it, we tell Google Ads when a visit that began with one of our ads leads to a subscription — nothing about you or your plan goes with it. See section 11.
Your due date tells us you are pregnant or have recently given birth. That is health information, so we ask your permission before storing it, and you can withdraw that permission at any time.
You can use the calculator without an account. In that mode your due date stays in your own browser and never reaches us.
1. Who we are
My Nurevia (“we”, “us”) is the data controller for the personal data described here. We are a sole trader based in the United Kingdom.
- Privacy contact: help@mynurevia.com
The Information Commissioner’s Office is the UK’s data protection regulator, and you can complain to them about how we handle your data — see section 8.
2. Where the service is offered
My Nurevia is offered to residents of the United Kingdom. The estimates are built from UK prices and UK childcare costs and assume NHS healthcare, so they would be misleading elsewhere.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Email address; sign-in timestamps | You, when you create an account |
| Plan data | Due date or birth date, budget style, feeding plan, whether you are expecting multiples, whether you expect gifts, childcare hours and rate | You, in the planner |
| Subscription data | Subscription status, trial end date, renewal date, records of the consents you gave at checkout, and an identifier linking you to our payment processor | Stripe, and you, when you subscribe |
| Feedback | A thumbs up or down and any comment you write | You, optionally |
| Product analytics | Which premium prompts you saw and whether you clicked upgrade | Automatically, as you use the service |
| Page-view analytics | Which pages were viewed, roughly where from (country and city), and on what kind of device and browser — counted, never linked to you | Automatically, as you use the service |
| Technical data | IP address, browser type and request logs held by our hosting provider | Automatically |
We never receive your full card number. Payment details go directly to Stripe. We hold only an identifier and your subscription status.
4. Health information, and why we ask permission
Your due date, or your baby’s birth date, reveals that you are pregnant or have recently given birth. That makes it data concerning health — a special category of personal data under UK GDPR, with stricter rules than ordinary data. The Information Commissioner’s Office has publicly scrutinised period and fertility apps on exactly this point.
So before we store a due date against your account we ask for your explicit consent. It is a separate choice from accepting our Terms, it is never pre-ticked, and we record when you gave it. You can withdraw it at any time by deleting the plan or your account, which deletes the data. Withdrawing does not affect anything we did lawfully beforehand.
If you would rather not give it, the calculator still works — you simply cannot save a plan to an account.
5. Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Create your account and sign you in | You asked us to | Contract (Art. 6(1)(b)) |
| Generate and save your plan | It is the service | Contract, plus your explicit consent for the health element (Arts. 6(1)(b), 9(2)(a)) |
| Take payment and manage your subscription | To bill you and let you cancel | Contract (Art. 6(1)(b)) |
| Send service messages — sign-in links, trial reminders, six-monthly subscription reminders, billing notices | You cannot use the service without them, and consumer law requires some of them | Contract and legal obligation (Arts. 6(1)(b), 6(1)(c)) |
| Keep records of the consents you gave at checkout | To show we complied with consumer law | Legal obligation (Art. 6(1)(c)) |
| Understand which features people use, in aggregate | To improve the product | Legitimate interests (Art. 6(1)(f)) — improving a service you chose to use, weighed against a low privacy impact |
| Keep accounting records and prevent abuse | We are required to, and to protect the service | Legal obligation and legitimate interests (Arts. 6(1)(c), 6(1)(f)) |
Where we rely on legitimate interests, you can object — see section 8.
6. What we do not do
- We do not sell your personal data, and we do not share it for targeted advertising. The only advertising-related sharing is the Google Ads measurement described in section 11, and only if you say yes to it.
- We do not use your due date or plan details to advertise to you, here or anywhere else.
- We do not tell retailers who you are. An affiliate link tells a retailer that a visitor arrived from us — not your identity, and nothing you entered here.
- We do not use your data to train machine learning models.
- We do not collect location data.
Marketing emails
We send service messages you cannot opt out of while you hold an account — sign-in links, trial and renewal reminders, billing notices — because the service and consumer law require them.
We will only send you marketing email if you have opted in, and every such message will have an unsubscribe link, as the Privacy and Electronic Communications Regulations require.
7. Who we share it with
A small number of service providers process data on our instructions under written contracts:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and authentication | European Union |
| Vercel | Application hosting, request logs, and page-view analytics | Global edge network |
| Stripe | Payments and subscription billing | UK, EU and United States |
| Resend | Sending sign-in and service emails | United States |
If you allow cookies, Google also receives information from your visit, for analytics and for measuring our ads — section 11 explains what, and why you are asked first.
We may also disclose data where the law requires it, to establish or defend legal claims, or to a buyer if the business is sold — in which case we will tell you first.
Sending data outside the UK
Some of our providers operate outside the UK. Where personal data is transferred out we rely on UK adequacy regulations, including the UK extension to the EU–US Data Privacy Framework where a provider is certified, or otherwise on the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. Ask us and we will tell you which applies to which provider.
Your account data — including your due date — is held in the European Union and does not leave it. The transfers above concern payments and email only.
8. Your rights
Under UK data protection law you have the right to:
- Be told how we use your data — that is this document
- Access the personal data we hold about you, and get a copy
- Have inaccurate data corrected
- Have your data erased
- Restrict how we use it
- Object to processing based on legitimate interests
- Receive your data in a portable, machine-readable format
- Withdraw consent at any time, including consent to store health information
- Not be subject to solely automated decisions with legal or similarly significant effects
How to use them
Delete your account any time in Account settings — that removes your plans and cancels any subscription. For anything else, email help@mynurevia.com. We respond within one month and will tell you if we need longer, which we may do for complex requests. There is no charge.
We may ask you to confirm the request from your account email address, so we do not disclose your data to someone else.
If you are unhappy
Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. You can go to them without coming to us first.
9. How long we keep it
| Data | Retention |
|---|---|
| Account and plan data | Until you delete your account, or after 24 months of inactivity, whichever comes first |
| Consent records | Six years after the subscription ends, so we can show we complied with consumer law |
| Subscription and payment records | Held for as long as our payment processor retains them, and in any event for the six years from the end of the accounting period that UK tax law requires. Deleting your account does not erase a payment record we are legally required to keep |
| Feedback and product analytics | Kept in a form no longer linked to you once your account is deleted |
| Server and request logs | Held by our hosting provider on their standard schedule, typically under 30 days |
10. Security
Data is held in a database with row-level access rules, so one account cannot read another’s. Traffic is encrypted in transit. There are no passwords to steal, because we sign you in with a one-time emailed link. Card details never reach our systems.
No service can promise perfect security. If a breach is likely to risk your rights and freedoms we will report it to the ICO within 72 hours and tell you without undue delay.
12. Children
This service is for adults — expecting parents and carers. It is not directed at children and we do not knowingly collect data from anyone under 18. If you think a child has given us personal data, email help@mynurevia.com and we will delete it.
You may enter information about your own child, such as a birth date. That is provided by you as their parent or carer and is protected the same way as the rest of your plan.
13. Automated decisions
The estimate is a calculation, not a decision about you. It has no legal or similarly significant effect, and we do not profile you to make decisions within the meaning of Art. 22 UK GDPR.
14. Changes
We will update this policy from time to time and change the date at the top. If a change materially affects your rights we will email you before it takes effect.
15. Contact
help@mynurevia.com. We aim to reply within two working days, and to any data protection request within one month.