Privacy Policy

1. Introduction

BabyReel ("we", "our", or "Service") respects the privacy of its users. This Privacy Policy describes how we collect, use, store, and protect your personal information when using our application.

This policy complies with applicable data protection laws and regulations, including the General Data Protection Regulation (GDPR) and other applicable legislation.

2. Data We Collect

2.1 Data provided by you

• Registration data: Name, email address (via Google login or email/password)
• Journey data: Baby/pet name, date of birth, journey type (pregnancy, baby, pet)
• Uploaded content: Photos, milestones, notes, health data (weight, symptoms, vaccines, mood)
• Payment data: Processed directly by Stripe (we do not store card data)

2.2 Automatically collected data

• Usage data: Pages accessed, features used, interaction events
• Device data: Browser type, operating system, screen resolution
• Cookies: We use essential cookies for authentication and Service functionality

3. How We Use Your Data

We use your personal data for the following purposes:

• Provide, maintain, and improve the Service
• Process payments and manage your subscription
• Send Service-related notifications (reminders, milestones, etc.)
• Generate personalized videos with uploaded photos
• Provide customer support
• Comply with legal and regulatory obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

The processing of your personal data is based on the following legal grounds:

• Contract performance: To provide the Service according to the Terms of Use
• Consent: For sending optional communications and notifications
• Legitimate interest: For Service improvement and fraud prevention
• Legal obligation: To meet tax and regulatory requirements

5. Storage and Security

5.1 Where your data is stored

• Database: Supabase (AWS infrastructure)
• Photos and videos: Cloudflare R2 (globally distributed storage)
• Backend: Railway (video processing)

5.2 Security measures

• Encrypted communication via HTTPS/TLS
• Secure authentication via Supabase Auth (OAuth 2.0 compatible)
• Row Level Security (RLS) in the database - each user can only access their own data
• Signed upload URLs with expiration (presigned URLs)
• API keys and credentials stored in secure environment variables

6. Data Sharing

Your data may be shared with the following third parties, exclusively for the operation of the Service:

7. Your Rights

In accordance with applicable data protection laws, you have the following rights:

• Access: Request information about which personal data we process
• Correction: Request correction of incomplete or outdated data
• Deletion: Request the deletion of your personal data
• Portability: Request the transfer of your data to another service
• Withdrawal of consent: Revoke previously granted consents
• Objection: Object to data processing in certain circumstances
• Information: Be informed about with whom we share your data

To exercise any of these rights, contact us at the email provided in the Contact section. We will respond within 15 (fifteen) business days.

8. Data Retention

• Active account data: Retained while the account is active
• Data after account deletion: Deleted within 30 days, except for legal obligations
• Payment data: Tax records maintained for 5 years as required by tax legislation
• Security logs: Maintained for up to 6 months

9. Children's Data

BabyReel is intended for parents and guardians to record moments of their children. The Service is not directed at minors under 18 years of age. Photos and children's data submitted to the Service are the sole responsibility of the parents or legal guardians who share them.

We treat this data with special care, ensuring it is accessible only to the user who uploaded it and to companions (family members) expressly invited.

10. Cookies

We use strictly necessary cookies to:

• Keep your authentication session active
• Remember user preferences
• Usage analytics (Google Analytics - anonymized data)

You can configure your browser to block cookies, but this may affect the Service's functionality.

11. International Data Transfer

Your data may be processed on servers located outside your country of residence (United States and other regions) through our infrastructure providers (Supabase, Cloudflare, Stripe). These transfers are carried out based on standard contractual clauses and adequate security measures, in compliance with applicable data protection regulations.

12. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be communicated through the Service or by email. The update date at the top of this page indicates the most recent version.

13. Contact and Data Protection Officer (DPO)

For privacy-related questions, exercise of rights, or complaints, please contact us:

If you are not satisfied with our response, you have the right to file a complaint with the relevant data protection authority in your jurisdiction.