Sleepabee

Privacy Policy

Effective date: [EFFECTIVE_DATE] · Last updated: [EFFECTIVE_DATE]

This Privacy Policy explains how GLate Ltd. (ДжиЛейт ООД), UIC 205170147 ("Sleepabee", "we", "us", "our"), a company registered in Bulgaria with registered address at 9 Sredets Street, Pazardzhik 4400, Bulgaria, processes personal data when you use the Sleepabee mobile application, its watch companion apps, and the website sleepabee.com (together, the "Service").

We are the data controller for the personal data described in this Policy.

Contact: support@sleepabee.com

1. Who the Service is for

Sleepabee is a sleep-tracking and guidance app for parents and legal guardians of babies and young children. The Service is intended for use only by adults (18+). It is not directed at children, and we do not knowingly allow children to create accounts.

You, the parent or guardian, provide information about your child. Because this includes data about a minor — including health-related information — we treat it with heightened care, as described below. By creating a child profile you confirm that you are the child's parent or legal guardian, or that you have been invited into a family by someone who is.

2. Data we collect

Data you provide

Account data

  • Email address and password (passwords are stored only as secure hashes by our authentication provider), or your email obtained through Sign in with Apple or Google Sign-In.
  • Your display name, if you choose to set one.

Child profile data (data about your child, provided by you)

  • Child's first name (or nickname — you may use a nickname instead of a real name).
  • Date of birth, gender, birth weight.
  • Sleep-behavior details: typical night wakings, how the child falls asleep (including whether the child is fed to sleep), temperament, usual bedtime.

Sleep and health-related logs

  • Sleep sessions: start/end times, naps vs. night sleep, sleep quality, how the child fell asleep, night wakings and their suspected causes (hunger, diaper, discomfort, noise), whether the child was fed, and free-text notes you add.
  • Weight/growth measurements over time.
  • Daily context flags you log: sick, teething, fever, vaccination, daycare, travel, developmental milestone, growth spurt, room temperature, and free-text notes.

Some of this information (for example illness, fever, or vaccination flags, and weight history) is health data and is treated as a special category of personal data under the EU/UK GDPR. We process it only with your explicit consent, which you give when you enable and use these logging features, and which you can withdraw at any time by deleting the relevant entries or your account.

Family and invitations

  • Family name and family member roles (parent, caregiver, relative).
  • If you invite someone to your family, we process the invitee's email address and the invitation code. If someone invited you, we process your acceptance of that invitation. If you invite another person, you are responsible for having their permission to share their email address with us.

AI Sleep Coach conversations

  • The messages you type to the AI coach. Conversations are processed to generate a reply and are not stored as chat history on our servers (see Section 4 for what context is sent to the AI provider).

Sleep insights

  • When AI-generated sleep insights are produced for your child, we store the generated output, related quality metadata, and any outcome feedback notes you provide.

Support requests

  • Your email address, the subject and text of your message, your app version, platform, and language.

Referral program

  • Your referral code, codes you apply, and the link between referrer and referred accounts, including reward status.

Data collected automatically

  • Session and security data: when you sign in, we record your device's IP address and browser/device identifier (user agent) with the session, to secure your account and detect token misuse.
  • Server logs: our servers log requests, including IP address, requested endpoint, and timestamps, for security and troubleshooting. Log data is retained for 30 days.
  • Subscription events: our subscription platform (RevenueCat) sends us purchase lifecycle events, which include a pseudonymous user ID, product ID, store (App Store / Google Play), purchase and expiry dates, purchase price and currency, country code, and trial status. We never receive or store your card number or full payment details — payment is handled entirely by Apple or Google.
  • Crash reports (optional): if you enable analytics, Firebase Crashlytics collects crash and device diagnostics (device model, OS version, crash traces).
  • Usage analytics (optional, off by default): see Section 6.
  • Push notifications (sleep reminders): if you allow notifications, the app sends us your device's push token, platform (iOS/Android), app language, time zone and app version, and we keep your reminder settings and the reminders scheduled for you. Our server sends the reminders; their text includes your child's first name and the planned time. With Premium, the other parents and caregivers in your family also get a short notice when someone records that the child fell asleep or woke up; it shows the first name of the child and the profile name of the parent who recorded it.

Data we do NOT collect

  • We do not collect your precise location.
  • We do not access your contacts, photos, camera, or microphone.
  • We do not use the advertising identifier (IDFA / Android Advertising ID) and we do not track you across other companies' apps or websites.
  • Biometric unlock (Face ID / fingerprint) happens entirely on your device; we never receive biometric data.

3. Why we process your data and our legal bases

  • Providing the Service — accounts, child profiles, sleep tracking, schedules, family sharing. Data: account, child profile, sleep logs, family data. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
  • Health-related logging — illness, fever, vaccination flags; weight history. Legal basis: your explicit consent (Art. 9(2)(a)), withdrawable at any time.
  • AI Sleep Coach and sleep insights — child profile and recent sleep/context data, your messages. Legal basis: performance of a contract; explicit consent for the health-related elements (Art. 9(2)(a)).
  • Account security, fraud and abuse prevention — IP address, user agent, session data, server logs. Legal basis: legitimate interests (Art. 6(1)(f)) — keeping the Service secure.
  • Managing subscriptions, trials, and referral rewards — subscription events, referral data. Legal basis: performance of a contract; legal obligations (accounting).
  • Customer support — support messages. Legal basis: performance of a contract; legitimate interests.
  • Sleep reminders (push notifications) — push token, device platform, language and time zone, reminder settings, your child's first name, planned sleep times and, for family notices, the recording parent's profile name. Legal basis: performance of a contract (Art. 6(1)(b)); you can turn reminders off at any time in Settings → Notifications or in your phone's settings.
  • Optional product analytics and crash reporting — usage events, crash diagnostics. Legal basis: your consent (Art. 6(1)(a)); off by default, withdrawable in Settings.
  • Compliance with law — any of the above, as required. Legal basis: legal obligation (Art. 6(1)(c)).

We do not sell personal data, and we do not use your or your child's data for third-party advertising.

4. AI features and your data

Sleepabee's AI Sleep Coach and sleep insights are powered by Google's Gemini API.

When you use these features, we send Google the context needed to generate a useful answer: your child's first name (as you entered it), age, gender, temperament and sleep-behavior profile, recent sleep sessions and daily summaries, the context flags you logged (such as illness, teething, fever, vaccination, travel), your notes, and — for the coach — the message you typed.

Important points:

  • We use Google's paid API tier under terms which provide that Google does not use data submitted via the API to train its models.
  • AI chat conversations are not stored on our servers; each conversation is stateless.
  • AI answers are general guidance, not medical advice (see our Terms of Service). Always consult your pediatrician for health concerns.
  • If you prefer not to send your child's name to the AI provider, you can use a nickname or initial in the child profile.

5. Who we share data with (processors)

We share personal data only with service providers ("processors") who process it on our instructions, under data-processing agreements:

  • Supabase, Inc. — database, authentication, and delivery of the system emails we send you (account verification, password reset). All account and app data. Location: West EU (Ireland), eu-west-1 — within the EEA.
  • YouTube (Google LLC) — hosting of the educational videos in the app. When a video list or a video loads, your device requests the thumbnail and the player directly from YouTube, so your IP address and device information are visible to Google, and the player may set cookies. This only happens when you open the educational content.
  • OVH Hosting Limited (OVHcloud, Ireland) — hosting of our API and website on a virtual private server. All data in transit; server logs. Location: France (Gravelines) — within the EEA. OVHcloud staff in other countries may access the server remotely for support, maintenance and security (see Section 7).
  • Google LLC (Gemini API) — AI coach and insights generation. Child profile and sleep/health context described in Section 4. Location: USA.
  • Google LLC (Firebase Analytics & Crashlytics) — optional analytics and crash reporting, only if you opt in. Usage events (designed to contain no names, no sleep times, no child data), app-instance ID, device model, OS, language, IP-derived coarse location. Location: USA.
  • RevenueCat, Inc. — subscription management. Pseudonymous user ID, purchase events. Location: USA.
  • Resend, Inc. — transactional email (support). Email address, message content. Location: USA.
  • Expo (650 Industries, Inc.) — delivery of push notifications to Apple and Google. Push token and notification content (your child's first name, the time and, for family notices, the recording parent's profile name). Location: USA.
  • ChottuLink (Tavas Analytics Inc., USA) — referral and invitation links (deferred deep linking). IP address, user agent, device model/OS/locale, app version, click and timestamp data, and a first-party cookie used for web-to-app attribution. Location: AWS Mumbai, India (ap-south-1). Attribution data is retained for 12 months.
  • Apple Inc. / Google (Play) — payments, app distribution, and delivery of push notifications to your device (Apple Push Notification service, Firebase Cloud Messaging), handled under their own privacy policies.

We may also disclose data if required by law, or in connection with a merger or acquisition (in which case this Policy continues to apply to your data, and we will notify you).

6. Analytics — off by default

Product analytics and crash reporting are disabled by default. On first launch we ask whether you allow anonymous usage analytics. If you decline, nothing is collected. You can change your choice at any time in Settings → Analytics.

Even when enabled, our analytics events are designed to be free of personal content: no names, no email addresses, no sleep times, no note contents, no child data — only feature-usage patterns (e.g., "a sleep session was logged"). Firebase itself additionally processes an app-instance identifier and device metadata, as described in Section 5.

7. International transfers

We are based in Bulgaria. Your account and app data are stored by Supabase in the European Economic Area (West EU, Ireland).

Some processing happens outside the EEA:

  • United States — Google (Gemini, Firebase, YouTube), RevenueCat, Resend, Expo. For these we rely on the European Commission's Standard Contractual Clauses and, where applicable, on the provider's EU–US Data Privacy Framework certification.
  • India — ChottuLink, for referral and invitation link attribution (AWS Mumbai). India has no European Commission adequacy decision, so this transfer relies solely on the Standard Contractual Clauses (Module 2, controller-to-processor) together with the UK Addendum, agreed in our Data Processing Agreement with the provider. ChottuLink is not Data Privacy Framework certified.
  • Remote access by OVHcloud — our server is in France, but OVHcloud group companies in Canada and the United Kingdom may access it remotely for support, maintenance and security. Both countries have a European Commission adequacy decision; the transfer is also covered by OVHcloud's Data Processing Agreement.

In all cases we apply supplementary safeguards, and the data leaving the EEA for link attribution is limited to technical device and click information — never your child's health or sleep data.

8. How long we keep data

  • Account, child profiles, sleep and health logs — for as long as your account exists; deleted when you delete your account.
  • Sessions (incl. IP, user agent) — deleted with your account; expired sessions purged within 90 days.
  • Server logs (incl. IP) — 30 days.
  • Subscription records — deleted with your account. The raw payment-provider payload attached to each event is cleared after 18 months.
  • Support messages — retained up to 24 months after we receive your message, including after account deletion, to handle follow-ups and legal claims.
  • AI insight snapshots — deleted with your account.
  • Push tokens and reminder settings — deleted when you log out on that device or delete your account; devices not seen for 90 days are removed.
  • Scheduled reminders — deleted 2 days after they are sent or expire.

9. Deleting your account

You can delete your account at any time in Settings → Delete account. This permanently deletes your profile, your children's profiles, all sleep and health logs, insights, referral data, sessions, and your push tokens and reminder settings from our systems, and deletes your login with our authentication provider.

Notes:

  • If you share a family with another parent, the shared children's data remains with the other parent; only your membership and personal data are removed.
  • Deleting your account does not cancel an active subscription — manage subscriptions in your App Store or Google Play account settings.
  • Support messages may be retained as described in Section 8.

10. Your rights

Under the GDPR (and similar laws), you have the right to:

  • Access the personal data we hold about you and your child;
  • Rectify inaccurate data (you can edit most data directly in the app);
  • Erase data (in-app account deletion, or on request);
  • Data portability — receive your data in a machine-readable format;
  • Restrict or object to certain processing;
  • Withdraw consent at any time (analytics in Settings; health-related logging by deleting entries or your account), without affecting prior processing;
  • Complain to a supervisory authority — in Bulgaria: the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, cpdp.bg — or your local authority.

To exercise any right, email support@sleepabee.com from your account email. We respond within one month. To request a data export, contact us at the same address.

California residents: we do not sell or share personal information as defined by the CCPA/CPRA. You may exercise rights of access, deletion, and correction via the contact above, without discrimination.

11. Children's privacy

The Service is not directed at children and may not be used by anyone under 18. All information about children in Sleepabee is provided by their parent or legal guardian, who controls it and can delete it at any time. We do not knowingly collect personal information directly from any child. If you believe a child has created an account, contact us at support@sleepabee.com and we will delete it.

12. Security

We protect your data with, among other measures: encryption in transit (TLS) for all connections; passwords stored only as secure hashes; refresh tokens stored hashed with automatic reuse detection and session revocation; strict server-side access controls and audit logging for any staff access; rate limiting and abuse protection. No system is perfectly secure; if a breach affects your data, we will notify you and the supervisory authority as required by law.

13. Changes to this Policy

We may update this Policy from time to time. For material changes we will notify you in the app or by email before the change takes effect, and update the "Last updated" date above. Previous versions are available on request.

14. Contact

GLate Ltd. (ДжиЛейт ООД) · UIC 205170147 9 Sredets Street, Pazardzhik 4400, Bulgaria Email: support@sleepabee.com

15. Cookies

We use a small number of cookies, and all of them are strictly necessary to sign you in, keep you signed in, protect the forms you submit, and remember your language. We do not use cookies for advertising, profiling, or third-party analytics on this website.

| Cookie | Purpose | Lifetime | Readable by scripts | |---|---|---|---| | access_token | Keeps you signed in for the current session | Expires with the token (short-lived, minutes) | No | | refresh_token | Lets the app renew your session without asking you to log in again | 30 days | No | | csrf-token | Protects forms and requests against cross-site request forgery | Current session | Yes — the page must send it back as a header for the check to work | | NEXT_LOCALE | Remembers whether you chose English or Bulgarian | Until you change it or clear your browser | Yes |

Because these cookies are strictly necessary to deliver a service you asked for, we do not ask for consent before setting them — but we are still required to tell you they exist, which is what this section does. You can delete them in your browser at any time; doing so will sign you out.

Note that video playback is embedded from YouTube, which may set its own cookies when you open the educational content — see Section 5.