Van Mierlo Solutions Ltd ("we," "us," "our"), operating as Kyma Studio, is a company registered in Cyprus. We are the data controller for personal information processed through the Newborn AI Sleep Coach mobile application (the "App").
We are committed to protecting your privacy. This policy explains what information we collect, why, how it is used and shared, how long it is kept, and what rights you have over it, wherever in the world you use the App.
If you have any questions about this policy or how your data is handled, contact us at [email protected].
1. Who this policy applies to
The App is intended for use by parents and caregivers of infants. It is not directed at children, and children do not use the App or create accounts. Any information about your baby (such as their name, birth date, sleep, or feeding information) is provided by you, the parent or caregiver, not collected directly from a child. You are responsible for ensuring you have the right to provide this information about your baby, in your capacity as their parent or legal guardian.
By creating an account, you confirm that you are 18 years of age or older and that you agree to this Privacy Policy and our Terms of Service.
2. Information we collect
Information you provide directly
- Account information: your account starts anonymously, with no email address required. If you choose to link an email address (for example, to secure your account across devices), we store that email for authentication purposes.
- Baby profile information: your baby's name, birth date, and gender, and information about their feeding type. We also collect the answers you give during onboarding about your goals and current challenges, to personalize the App to your situation.
- Sleep log entries: nap and nighttime sleep times you record, along with optional details you may add such as sleep quality and the reason your baby woke (for example, feeding, crying, or a diaper change).
- AI Coach conversations: messages you send to the AI Coach, and the responses it gives.
Information generated through your use of the App
- Daily insights: summaries generated from your sleep log data.
- Push notification tokens: a device identifier used to deliver notifications you have opted into (all notifications are off by default and require your explicit opt-in).
- Subscription status: whether you have an active trial or paid subscription, and which plan.
- Referral activity: your personal referral code, and, if you use someone else's code, a record that links your account to theirs for the purpose of applying trial extensions and referral rewards.
Information we do not collect
We do not use analytics, advertising, or crash-reporting tools of any kind. We do not track your behavior across other apps or websites, and we do not build advertising profiles.
3. How we use your information
We use the information above to:
- Provide the core features of the App: sleep tracking, personalized routines, and the AI Coach.
- Generate daily insights based on your own logged data.
- Manage your subscription and free trial.
- Send you notifications you have explicitly opted into.
- Operate the referral program, including verifying and applying trial extensions and rewards.
- Maintain the security and integrity of the App.
We do not sell your personal information, and we do not use it for advertising.
Legal basis for processing (EU/UK GDPR)
Where GDPR or UK GDPR applies to you, we rely on the following legal bases for processing your information:
| Processing activity | Data involved | Legal basis |
|---|---|---|
| Account creation and management | Email address, if you choose to link one to your anonymous account | Performance of a contract (Art. 6(1)(b)) |
| Sleep tracking and daily insights | Sleep logs, baby profile data | Performance of a contract (Art. 6(1)(b)) |
| AI Coach | Age, feeding/sleep data relevant to your question | Performance of a contract (Art. 6(1)(b)); see note below on health-related information |
| Push notifications | Push token | Your consent (Art. 6(1)(a)), always opt-in |
| Referral program | Referral codes and redemption records | Performance of a contract / our legitimate interest in preventing abuse (Art. 6(1)(b)/(f)) |
| Security and fraud prevention | Technical and account data | Our legitimate interest in keeping the App secure (Art. 6(1)(f)) |
A note on health-related information: some information you choose to share with the AI Coach (for example, about feeding difficulties, illness, or a medical condition affecting sleep) may constitute a special category of data under Article 9 GDPR. We ask that you only share information necessary for the App's sleep-coaching purpose, and avoid entering detailed medical history, diagnoses, or medication information, none of which the AI Coach needs to help with sleep guidance. Where you do choose to share information that touches on your baby's health, we treat this as processed with your explicit consent, given by voluntarily providing it to the AI Coach. The AI Coach is designed to direct you to appropriate medical care rather than provide guidance if you describe a potential medical emergency or a symptom that needs a doctor's attention, rather than attempting to answer with sleep advice.
4. Who we share information with
We use a small number of service providers to operate the App. Each only receives the specific data it needs to perform its function.
| Service provider | What they receive | Purpose |
|---|---|---|
| Supabase | Account data, baby profiles, sleep logs, AI conversation data, referral data | Database hosting and backend infrastructure (hosted in the United States, East US region) |
| OpenAI | Your baby's age, and feeding/sleep data relevant to your question. Never your name, email, or account information. | Generating AI Coach responses and daily insights |
| RevenueCat | Your Supabase user ID, which RevenueCat uses to calculate and return your subscription/entitlement status to us. Their SDK also independently collects device and platform information for their own fraud-prevention purposes, under their own privacy policy. | Managing subscriptions and free trials |
| Google Play / Apple App Store | Payment and subscription information (handled directly by Google/Apple, not by us) | Processing in-app purchases |
| Firebase Cloud Messaging (Google) | Push notification token, and, if your notification includes it, your baby's name in the notification text | Delivering push notifications you have opted into |
Our marketing website, kymastudio.dev, is hosted separately using Cloudflare. Cloudflare does not receive or process any data from within the App itself.
We do not permit any of these providers to use your data for their own purposes beyond providing their service to us, except where noted above (such as RevenueCat's own fraud-prevention data collection, which is governed by their privacy policy).
About the AI Coach and OpenAI: We have configured our OpenAI account so that none of the data sent through the AI Coach is used by OpenAI to train or improve their underlying models. Our systems also never send your name or account information to OpenAI, only the specific baby-related details relevant to your question. To be clear: when we refer elsewhere in our Terms of Service to using your content to "improve the App's features," this means things like refining how our own product works, not training or fine-tuning any AI model with your individual conversations.
5. International data transfers
Van Mierlo Solutions Ltd is based in Cyprus, within the European Union. Some of our service providers process data outside the EU/EEA, specifically:
- Supabase (database hosting): data is hosted in the United States (East US region).
- OpenAI (AI Coach): processes the limited baby-related data described in Section 4, in the United States.
- RevenueCat and Firebase Cloud Messaging (Google): may process data in the United States or other countries as part of their global infrastructure.
Where we transfer personal data from the EU/EEA to a country that does not have an adequacy decision from the European Commission, we rely on appropriate safeguards, such as Standard Contractual Clauses, participation in the EU-U.S. Data Privacy Framework, or another legally recognized transfer mechanism offered by that provider, to ensure your data continues to receive an appropriate level of protection. We review these safeguards with each provider as part of selecting them.
6. Data retention and deletion
We retain your active account data for as long as your account is active, so the App can function and show your history over time. This includes baby profiles, sleep logs, AI Coach history, insights, and your subscription record within our own systems.
You can delete your account and all associated data at any time directly within the App, under Settings. This immediately and permanently removes your account, baby profiles, sleep logs, AI Coach conversation history, subscription record, and referral data from our live systems. This action cannot be undone. Residual copies in backup systems are overwritten on our standard backup rotation cycle, and are not separately accessed or restored except in the event of a system failure.
Deleting your account does not affect billing or transaction records held separately by Google Play or the Apple App Store, which they retain under their own policies as the payment processor. It also does not automatically cancel an active paid subscription; subscriptions must be cancelled separately through the respective store to stop future billing. The App will show you this reminder before you confirm account deletion if you have an active subscription.
If you would like to request a copy of your data before deleting your account, contact us at [email protected] and we will provide this to you.
7. Your privacy rights
Depending on where you live, you may have some or all of the following rights regarding your personal information. To exercise any of these, contact us at [email protected], or use the in-app account deletion feature described above.
If you are in the European Union or United Kingdom (GDPR / UK GDPR), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Erase your data ("right to be forgotten")
- Receive your data in a portable format
- Restrict or object to certain processing
- Lodge a complaint with your local data protection authority. As our company is registered in Cyprus, you may also lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus (www.dataprotection.gov.cy), though you are always free to contact your own national authority instead.
If you are a California resident (CCPA/CPRA), you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.
If you are in Canada (PIPEDA), you have the right to access your personal information, to know how it is used, and to challenge its accuracy.
If you are in Australia (Privacy Act 1988 / Australian Privacy Principles), you have the right to access and correct your personal information, and to make a complaint about how it has been handled.
Wherever you are in the world, we apply the same core protections described in this policy, and honor deletion and access requests sent to [email protected].
8. Security
We use industry-standard measures to protect your information, including encrypted data transmission and database-level access controls (Row Level Security) that restrict data access to your own account only.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to protect your information using appropriate technical and organizational measures.
9. Children's privacy
The App is designed for use by parents and caregivers, not by children. We do not knowingly collect personal information directly from children. Information about your baby (name, birth date, sleep patterns) is provided by you, the parent or legal guardian, as part of using the App's tracking features, and is treated with the same protections described throughout this policy.
If you believe a child has created an account or provided us with information directly, contact us at [email protected] and we will take appropriate action.
10. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above, and where appropriate, notify you within the App.
11. Contact us
Van Mierlo Solutions Ltd (Kyma Studio) Registered in Cyprus Email: [email protected]