Privacy Policy

1. Data controller

The controller of the personal data you provide through Naranest is:

• Juan Raimundo Martín Gutiérrez
• Address: Paseo Alejo Pérez Santana 4, 35215 Telde, Las Palmas (España)
• Tax ID (NIF/CIF): 54093465H
• Contact email: contacto@naranest.app
• Data protection email (exercise of rights): contacto@naranest.app

2. Purposes and legal basis for processing

We process your personal data for the following purposes and on the legal bases indicated:

• Account management and provision of the Service: identification via NextAuth (name, email, profile picture provided by Google or other sign-in provider), data on the babies you register and the records you enter (feeds, sleep, nappies, activities, measurements). Legal basis: contract performance (Art. 6.1.b GDPR) and, where applicable, consent.
• Billing and payment plan management (Pro): identification and transaction data via Stripe (payment gateway); we do not store full card numbers. Pro subscriptions, one-off (lifetime) payments and, where applicable, refunds or prorating. Legal basis: contract performance and legal obligation (Art. 6.1.b and c GDPR).
• Commercial communications and news: sending information about the Service or offers, if you have given your consent. Legal basis: consent (Art. 6.1.a GDPR). You may withdraw it at any time.
• Compliance with legal obligations: retention of data for tax, claims or requests from authorities. Legal basis: legal obligation (Art. 6.1.c GDPR).
• Security and improvement of the Service: access logs, anonymised or pseudonymised usage analytics, fraud prevention. Legal basis: legitimate interest (Art. 6.1.f GDPR) and, where applicable, consent.

3. Categories of data processed

Depending on how you use the Service, we may process:

• Identification data: name, email address, profile picture (provided by Google or other login provider).
• Data on the babies you register: name, date of birth (if provided), and the records you create (feeds, sleep, nappies, activities, measurements).
• Billing and payment data: processed by our payment provider (Stripe); we do not store full card numbers.
• Technical data: IP address, browser type, session identifiers, usage logs, to the extent necessary for the provision and security of the Service.

4. Data retention

We retain your data while you have an active account and, after closure or cancellation, for the periods necessary to comply with legal obligations (e.g. billing, claims) and for the establishment, exercise or defence of claims. The specific periods depend on applicable law (typically several years for tax and accounting). Once those periods have elapsed, data will be securely deleted or anonymised.

5. Recipients and international transfers

Your data may be disclosed to providers who supply necessary services (hosting, authentication, email, payment gateway, analytics), acting as processors under contracts ensuring GDPR compliance. Some of these providers may be located outside the European Economic Area (EEA). In such cases we ensure appropriate safeguards (EU-approved standard contractual clauses, adequacy decisions or equivalent guarantees) in accordance with Art. 44 et seq. GDPR. You may request further information on specific transfers by writing to contacto@naranest.app.

6. Data subject rights

You may exercise the following rights before the controller, as provided for in the GDPR and LOPDGDD:

• Access: to know whether we process your data and to obtain a copy.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure ("right to be forgotten"): to have your data erased when no longer necessary or when you withdraw consent, unless we must retain it by law.
• Restriction of processing: in certain cases, to have data retained without being used for other purposes.
• Portability: to receive your data in a structured, commonly used format and to transmit it to another controller where technically feasible.
• Objection: to object to processing based on legitimate interest, including profiling for commercial purposes.
• Withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact contacto@naranest.app, stating your identity and the right you wish to exercise. You may also lodge a complaint with the competent supervisory authority; in Spain: Agencia Española de Protección de Datos (AEPD).

7. Minors

The Service is not directed at minors. Baby data registered by users is entered by parents or guardians. If you become aware that a minor has provided personal data without the consent of their legal representatives, please contact contacto@naranest.app so we can proceed to erase it.

8. Security

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk (including against destruction, loss or unauthorised access). However, no system is infallible; we recommend using strong passwords (where applicable) and not sharing access to your account.

9. Cookies and similar technologies

We use cookies and local storage (e.g. for user session, preferences or cookie consent) as described in our Cookie Policy. When you first access the Site you may see a notice or banner about the use of cookies and requesting your consent where required by law; you may accept, reject or configure your preferences. The legal basis for strictly necessary cookies is legitimate interest or contract performance; for others, consent (Art. 6.1.a GDPR).

10. Modifications

We may update this privacy policy. Material changes will be communicated by a notice on the Site or by email when required by law. We recommend reviewing this page periodically. The "Last updated" date appears at the top of the document.

11. Contact

For any questions about privacy or data protection: contacto@naranest.app. For other enquiries: Legal Notice.