Privacy Policy
Last updated: [date]
Unreviewed draft. This has not been checked by a lawyer, and the highlighted sections are unfinished. It is written to be a good starting point for a solicitor or attorney to work from — not to replace one. Remove this notice only once a qualified adviser has reviewed the text and the highlighted fields are filled in. docs/compliance-checklist.md in the repo lists the obligations these documents cannot satisfy on their own.
Summary
The short version, with detail below. We collect your email address and the planning details you enter — due date, budget style, feeding plan and similar. We use them to build and save your plan, run your subscription, and improve the service. We do not sell your data, share it with advertisers, or use it for targeted advertising.
Your due date tells us you are pregnant or have recently given birth. That is health information, so we ask your permission before storing it, and you can withdraw that permission at any time.
You can use the calculator without an account. In that mode your due date stays in your own browser and never reaches us.
1. Who we are
[legal entity name] (“My Nurevia”, “we”, “us”) is the data controller for the personal data described here.
- Registered address: [registered address]
- Company number: [company number, or “sole trader”]
- ICO registration number: [ICO number]
- Privacy contact: [privacy@yourdomain]
We are registered with the Information Commissioner’s Office, the UK’s data protection regulator.
2. Where the service is offered
My Nurevia is offered to residents of the United Kingdom. The estimates are built from UK prices and UK childcare costs and assume NHS healthcare, so they would be misleading elsewhere.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Email address; sign-in timestamps | You, when you create an account |
| Plan data | Due date or birth date, budget style, feeding plan, whether you are expecting multiples, whether you expect gifts, childcare hours and rate | You, in the planner |
| Subscription data | Subscription status, trial end date, renewal date, records of the consents you gave at checkout, and an identifier linking you to our payment processor | Stripe, and you, when you subscribe |
| Feedback | A thumbs up or down and any comment you write | You, optionally |
| Product analytics | Which premium prompts you saw and whether you clicked upgrade | Automatically, as you use the service |
| Technical data | IP address, browser type and request logs held by our hosting provider | Automatically |
We never receive your full card number. Payment details go directly to Stripe. We hold only an identifier and your subscription status.
4. Health information, and why we ask permission
Your due date, or your baby’s birth date, reveals that you are pregnant or have recently given birth. That makes it data concerning health — a special category of personal data under UK GDPR, with stricter rules than ordinary data. The Information Commissioner’s Office has publicly scrutinised period and fertility apps on exactly this point.
So before we store a due date against your account we ask for your explicit consent. It is a separate choice from accepting our Terms, it is never pre-ticked, and we record when you gave it. You can withdraw it at any time by deleting the plan or your account, which deletes the data. Withdrawing does not affect anything we did lawfully beforehand.
If you would rather not give it, the calculator still works — you simply cannot save a plan to an account.
[This consent step is not yet built. It must exist before launch — see docs/compliance-checklist.md.]
5. Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Create your account and sign you in | You asked us to | Contract (Art. 6(1)(b)) |
| Generate and save your plan | It is the service | Contract, plus your explicit consent for the health element (Arts. 6(1)(b), 9(2)(a)) |
| Take payment and manage your subscription | To bill you and let you cancel | Contract (Art. 6(1)(b)) |
| Send service messages — sign-in links, trial reminders, six-monthly subscription reminders, billing notices | You cannot use the service without them, and consumer law requires some of them | Contract and legal obligation (Arts. 6(1)(b), 6(1)(c)) |
| Keep records of the consents you gave at checkout | To show we complied with consumer law | Legal obligation (Art. 6(1)(c)) |
| Understand which features people use, in aggregate | To improve the product | Legitimate interests (Art. 6(1)(f)) — improving a service you chose to use, weighed against a low privacy impact |
| Keep accounting records and prevent abuse | We are required to, and to protect the service | Legal obligation and legitimate interests (Arts. 6(1)(c), 6(1)(f)) |
Where we rely on legitimate interests, you can object — see section 8.
6. What we do not do
- We do not sell your personal data, and we do not share it for advertising.
- We do not use your due date or plan details to advertise to you, here or anywhere else.
- We do not tell retailers who you are. An affiliate link tells a retailer that a visitor arrived from us — not your identity, and nothing you entered here.
- We do not use your data to train machine learning models.
- We do not collect location data.
Marketing emails
We send service messages you cannot opt out of while you hold an account — sign-in links, trial and renewal reminders, billing notices — because the service and consumer law require them.
We will only send you marketing email if you have opted in, and every such message will have an unsubscribe link, as the Privacy and Electronic Communications Regulations require.
7. Who we share it with
A small number of service providers process data on our instructions under written contracts:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and authentication | [hosting region — choose a UK or EU region] |
| Vercel | Application hosting and request logs | Global edge network |
| Stripe | Payments and subscription billing | UK, EU and United States |
| Resend | Sending sign-in and service emails | United States |
We may also disclose data where the law requires it, to establish or defend legal claims, or to a buyer if the business is sold — in which case we will tell you first.
Sending data outside the UK
Some of our providers operate outside the UK. Where personal data is transferred out we rely on UK adequacy regulations, including the UK extension to the EU–US Data Privacy Framework where a provider is certified, or otherwise on the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. Ask us and we will tell you which applies to which provider.
[Choosing a UK or EU Supabase region removes most of this at the root rather than papering over it. Decide deliberately.]
8. Your rights
Under UK data protection law you have the right to:
- Be told how we use your data — that is this document
- Access the personal data we hold about you, and get a copy
- Have inaccurate data corrected
- Have your data erased
- Restrict how we use it
- Object to processing based on legitimate interests
- Receive your data in a portable, machine-readable format
- Withdraw consent at any time, including consent to store health information
- Not be subject to solely automated decisions with legal or similarly significant effects
How to use them
Delete your account any time in Account settings — that removes your plans and cancels any subscription. For anything else, email [privacy@yourdomain]. We respond within one month and will tell you if we need longer, which we may do for complex requests. There is no charge.
We may ask you to confirm the request from your account email address, so we do not disclose your data to someone else.
If you are unhappy
Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. You can go to them without coming to us first.
9. How long we keep it
| Data | Retention |
|---|---|
| Account and plan data | Until you delete your account, or after 24 months of inactivity, whichever comes first |
| Consent records | Six years after the subscription ends, so we can show we complied with consumer law |
| Subscription and payment records | Six years from the end of the accounting period, as UK tax law requires [confirm with your accountant] |
| Feedback and product analytics | Kept in a form no longer linked to you once your account is deleted |
| Server and request logs | Held by our hosting provider on their standard schedule, typically under 30 days |
10. Security
Data is held in a database with row-level access rules, so one account cannot read another’s. Traffic is encrypted in transit. There are no passwords to steal, because we sign you in with a one-time emailed link. Card details never reach our systems.
No service can promise perfect security. If a breach is likely to risk your rights and freedoms we will report it to the ICO within 72 hours and tell you without undue delay.
11. Cookies
We use a small number of strictly necessary cookies to keep you signed in. These do not need your consent because the service cannot work without them. We do not use advertising or analytics cookies.
[Adding an analytics tool changes this and requires a consent banner under PECR — consent must be obtained before the cookie is set, not after.]
12. Children
This service is for adults — expecting parents and carers. It is not directed at children and we do not knowingly collect data from anyone under 18. If you think a child has given us personal data, contact us and we will delete it.
You may enter information about your own child, such as a birth date. That is provided by you as their parent or carer and is protected the same way as the rest of your plan.
13. Automated decisions
The estimate is a calculation, not a decision about you. It has no legal or similarly significant effect, and we do not profile you to make decisions within the meaning of Art. 22 UK GDPR.
14. Changes
We will update this policy from time to time and change the date at the top. If a change materially affects your rights we will email you before it takes effect.
15. Contact
[privacy@yourdomain] — or write to us at [registered address].