Privacy Policy

1. Data controller

The controller of the personal data you provide through Naranest is:

• Juan Raimundo Martín Gutiérrez
• Address: Calle Picachos, 43 · 35200 Telde · Las Palmas (España)
• Tax ID (NIF/CIF): 54093465H
• Contact email: contacto@naranest.app
• Data protection email (exercise of rights): contacto@naranest.app

2. Purposes and legal basis for processing

We process your personal data for the following purposes and on the legal bases indicated:

• Account management and provision of the Service: identification via NextAuth (name, email, profile picture provided by Google or another sign-in provider) and the baby data you register. Legal basis: contract performance (Art. 6.1.b GDPR) for your own account. For the baby's data, which is health data (special category under Art. 9.1 GDPR), the basis is your explicit consent (Art. 9.2.a GDPR), requested separately when you register each baby and which you may withdraw at any time by deleting the baby from their profile.
• Billing and payment plan management (Pro): identification and transaction data via Stripe (payment gateway) on the website, or via Apple and RevenueCat for purchases made in the iPhone app; we do not store full card numbers. Pro subscriptions, one-off (lifetime) payments and, where applicable, refunds or prorating. Legal basis: contract performance and legal obligation (Art. 6.1.b and c GDPR).
• Commercial communications and news: sending information about the Service or offers, if you have given your consent. Legal basis: consent (Art. 6.1.a GDPR). You may withdraw it at any time.
• Compliance with legal obligations: retention of data for tax, claims or requests from authorities. Legal basis: legal obligation (Art. 6.1.c GDPR).
• Security and improvement of the Service: access logs, product analytics (PostHog, product analytics) in pseudonymised form and only if you have accepted analytics cookies, fraud prevention. Legal basis: legitimate interest (Art. 6.1.f GDPR) for security; consent (Art. 6.1.a GDPR) for product analytics.

3. Categories of data processed

Depending on how you use the Service, we may process the following data. We expressly flag which of it falls under the special categories of Art. 9 GDPR, because processing it requires your explicit consent and is not covered by the mere provision of the Service:

• Identification data: name, email address, profile picture (provided by Google or other login provider).
• Baby data you register. SPECIAL CATEGORY (health data, Art. 9.1 GDPR): name, date of birth, sex if provided, and the records you create (feeds, sleep, nappies, activities, weight, height and head circumference). This data is processed solely on your explicit consent, given when you register the baby, and in giving it you declare that you hold parental responsibility or guardianship of the child, or have their authorisation. It is not used for profiling, not shared for commercial purposes, and not sent to analytics tools.
• Billing and payment data: processed by our payment provider (Stripe) on the website; in the iPhone app, payment is handled by Apple and the purchase status by RevenueCat. We do not store full card numbers.
• Technical data: IP address, browser type, session identifiers, usage logs, to the extent necessary for the provision and security of the Service.

4. Data retention

We retain your data while you have an active account and, after closure or cancellation, for the periods necessary to comply with legal obligations (e.g. billing, claims) and for the establishment, exercise or defence of claims. The specific periods depend on applicable law (typically several years for tax and accounting). Once those periods have elapsed, data will be securely deleted or anonymised.

5. Recipients and international transfers

Your data may be disclosed to providers who supply necessary services: hosting (Vercel, Supabase), authentication (Google OAuth via NextAuth), email (Resend), payment gateway (Stripe), management of purchases made in the iPhone app (RevenueCat), product analytics (PostHog). All act as processors under contracts ensuring GDPR compliance. RevenueCat (RevenueCat, Inc., United States) receives our internal user ID and the data of purchases made in the iPhone app, to know which plan belongs to each account; it stores the data in the United States and the transfer relies on the standard contractual clauses approved by the European Commission. Payment for those purchases is processed by Apple (in the EEA, the UK and Switzerland, Apple Distribution International Ltd., Ireland; elsewhere, the Apple entity in your country), which does not act as our processor but as an independent controller, under its own privacy policy. Some of these providers may be located outside the European Economic Area (EEA). In such cases we ensure appropriate safeguards (EU-approved standard contractual clauses, adequacy decisions or equivalent guarantees) in accordance with Art. 44 et seq. GDPR. You may request the up-to-date list of subprocessors by writing to contacto@naranest.app.

6. Data subject rights

You may exercise the following rights before the controller, as provided for in the GDPR and LOPDGDD:

• Access: to know whether we process your data and to obtain a copy.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure ("right to be forgotten"): to have your data erased when no longer necessary or when you withdraw consent, unless we must retain it by law.
• Restriction of processing: in certain cases, to have data retained without being used for other purposes.
• Portability: to receive your data in a structured, commonly used format and to transmit it to another controller where technically feasible.
• Objection: to object to processing based on legitimate interest, including profiling for commercial purposes.
• Withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact contacto@naranest.app, stating your identity and the right you wish to exercise. You may also lodge a complaint with the competent supervisory authority; in Spain: Agencia Española de Protección de Datos (AEPD).

7. Minors

The Service is not directed at minors. Baby data registered by users is entered by parents or guardians. If you become aware that a minor has provided personal data without the consent of their legal representatives, please contact contacto@naranest.app so we can proceed to erase it.

8. Security

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk (including against destruction, loss or unauthorised access). However, no system is infallible; we recommend using strong passwords (where applicable) and not sharing access to your account.

9. Cookies and similar technologies

We use cookies and local storage (e.g. for user session, preferences or cookie consent) as described in our Cookie Policy. When you first access the Site you may see a notice or banner about the use of cookies and requesting your consent where required by law; you may accept, reject or configure your preferences. The legal basis for strictly necessary cookies is legitimate interest or contract performance; for others, consent (Art. 6.1.a GDPR).

10. Modifications

We may update this privacy policy. Material changes will be communicated by a notice on the Site or by email when required by law. We recommend reviewing this page periodically. The "Last updated" date appears at the top of the document.

11. Contact

For any questions about privacy or data protection: contacto@naranest.app. For other enquiries: Legal Notice.