Privacy Policy

1. Who is responsible for your data

Data controller: Baby Milk Tracker (sole trader).

Country of establishment: Spain.

Website: babymilktracker.com.

Privacy contact email: hello@babymilktracker.com.

2. Purposes and legal bases

We process your personal data for the following purposes, each with its legal basis under Article 6 GDPR:

• Creating and managing your account and providing the service to log and track your baby's feedings and weight. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Handling enquiries you send us by email. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in responding to your request.

3. Categories of data

The categories of personal data we process are:

• Account data: your email address (required) and, optionally, a display name you choose.
• Data you enter about your baby: feedings, weight and any notes linked to your account.
• Technical and navigation data generated automatically by our hosting providers (Vercel and Cloudflare): IP address, device and browser type, and access and security logs. Processed to run and protect the service, not to personally identify you.

4. Recipients

Your data may be disclosed to:

• Processors providing services to us: Supabase, Vercel, Resend and Cloudflare. A data processing agreement under Article 28 GDPR is in place with each of them.
• Public administrations and competent authorities, where legally required.

5. International transfers

Some of our providers are located outside the European Economic Area. In those cases, transfers are covered by a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or by the Standard Contractual Clauses under Article 46(2)(c) GDPR. You can request a copy of the safeguards at our contact email.

6. Retention periods

We keep your data for the duration of our relationship and, afterwards, blocked for the applicable statutory limitation periods (in general, 3 years). Data processed on the basis of consent is kept until you withdraw it.

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability (Arts. 15–22 GDPR) by writing to hello@babymilktracker.com and providing proof of identity. You may also withdraw your consent without affecting the lawfulness of prior processing.

If you consider that the processing infringes the law, you may lodge a complaint with the supervisory authority: Agencia Española de Protección de Datos (AEPD) (https://www.aepd.es).

8. Security

We apply appropriate technical and organisational measures (Art. 32 GDPR) to ensure the confidentiality, integrity and availability of the data, taking into account the state of the art and the risks of the processing.

9. National law

In addition to the GDPR, Spanish Organic Law 3/2018 (LOPDGDD) applies and, regarding commercial communications and cookies, Law 34/2002 (LSSI-CE).