Effective Date: July 20, 2026
Jurisdiction: United Arab Emirates (PDPL compliance)
1. INTRODUCTION
Nurture is a childcare communication platform for parents, nannies, and family drivers in the UAE. We collect personal data to operate the App and improve your experience. This policy explains what data we collect, how we use it, and your rights under UAE law.
By using Nurture, you agree to this Privacy Policy.
2. WHAT DATA WE COLLECT
Account & Authentication
- Name, phone number, email, role (parent/nanny/driver)
- PIN (hashed, never stored in plain text)
- Profile photo, language preference
- Device tokens for push notifications
- Referral codes
Child Profile Data
- Child's name, age, photo
- Allergies, medical information
- Emergency contact details
- Doctor and alternate caregiver contact info
Care Logs & Timeline
- Feeding, nap, diaper change records
- Photos and short videos (30 seconds max)
- Activity logs and notes
- Who created each entry (author, timestamp)
Communication
- Messages (text, voice notes, photos)
- Voice transcripts and translations
- Location labels when shared
- Audio duration and metadata
Schedule & Planning
- Appointments and activities
- Shopping lists
- Calendar events
- Driver requirements
Device & Technical Data
- Device type, OS version, app version
- IP address, timezone
- Crash diagnostics
- Push notification tokens
Billing & Subscriptions
- Subscription status (active, trial, canceled)
- Trial and renewal dates
- Purchase history via Apple App Store / Google Play
- RevenueCat account synchronization
Support Communications
- In-app messages, emails, feedback
- Bug reports and feature requests
3. HOW WE USE YOUR DATA
We use your data to:
- Operate the service: Authentication, account management, family linking
- Enable communication: Deliver messages, store voice notes, translate content
- Childcare logging: Record and share care activities with your family
- Process subscriptions: Manage trials, renewals, and billing
- Improve security: Prevent fraud, abuse, and unauthorized access
- Fix bugs: Diagnose crashes and improve stability
- Respond to you: Handle support requests and inquiries
- Legal compliance: Meet UAE laws and authority requests
We do NOT:
- Use your data for advertising or marketing
- Sell or share your data with third parties
- Use behavioral tracking or analytics platforms
- Profile children or make automated decisions about them
4. LEGAL BASIS (Why We Process Your Data)
Under UAE PDPL, we process data based on:
| Data | Basis |
|---|---|
| Account & authentication | Contract — necessary to operate the service |
| Child profile data | Contract + Parental Consent — parents authorize child data processing |
| Care logs | Contract + Legitimate Interest — parent safeguarding |
| Messages | Contract — family communication |
| Voice transcription | Your Consent — optional, opt-in feature |
| Subscriptions | Contract — payment processing |
| Technical data | Legitimate Interest — security and service quality |
| Legal compliance | Legal Obligation — UAE law |
5. WHO CAN SEE YOUR DATA
Data visibility in your family is role-based:
| User Role | Can See |
|---|---|
| Parent | Everything (all children, all care logs, all messages, billing) |
| Nanny | Assigned children, care logs, messages, schedule, shopping list |
| Driver | Only schedule items marked "requires driver," group chat, driver messages |
Outside your family: Data is never shared without permission.
6. THIRD-PARTY SERVICE PROVIDERS
We use these carefully-selected providers (bound by data processing agreements):
| Service | Purpose | Data Shared |
|---|---|---|
| Cloudinary | Photo/video storage | Photos, videos, URLs |
| OpenAI (Whisper) | Voice-to-text transcription | Audio content only, no user ID |
| OpenAI (Translation) | Message translation | Message text, target language, no user ID |
| Resend | Transactional emails | Name, email, message content |
| RevenueCat | In-app subscriptions (iOS/Android) | User ID, purchase data, subscription status |
| Firebase/SuprSend | Push notifications | Device tokens, notification content |
| Optional: HubSpot | CRM (if enabled) | Name, email, phone, payment history |
| Future: Stripe | Web/B2B billing (not yet active) | Payment and billing info |
Data NOT shared:
- ✗ No advertising networks
- ✗ No analytics platforms (Google Analytics, Segment, Amplitude, etc.)
- ✗ No data brokers
- ✗ No child data to third parties
7. CHILDREN'S DATA & PARENTAL CONSENT
Your Responsibility as a Parent
- You are the primary decision-maker for your child's data
- You authorize nannies/drivers to create and view child profile data
- You can delete a child profile anytime (cascades deletion of all associated logs)
- You must ensure caregivers comply with privacy expectations
What We Don't Do
- ✗ We don't collect data directly from children
- ✗ We don't profile children or make automated decisions
- ✗ We don't share child data with third parties
- ✗ We don't use child data for marketing or advertising
8. INTERNATIONAL DATA TRANSFERS
Personal data may be transferred outside the UAE to our service providers in:
- USA (OpenAI, Resend, AWS, Google Cloud)
- EU and other regions (cloud infrastructure, CDN)
We ensure protection via:
- Contractual data processing agreements (Data Processing Agreements)
- Standard Contractual Clauses (SCCs)
- Transfers to jurisdictions with adequate protection under PDPL Article 22
9. DATA RETENTION & DELETION
While Your Account Is Active
- Account profile: Kept indefinitely
- Care logs: Kept indefinitely (subject to storage limits)
- Messages: Kept indefinitely
- Technical logs: 90 days
When You Delete Your Account
We immediately delete:
- ✅ Account profile
- ✅ All child profiles
- ✅ All care logs, photos, videos
- ✅ All messages
- ✅ All schedule/shopping items
- ✅ Nanny/driver accounts detached from your family
Backup window: Automated backups may retain data for up to 30 days for disaster recovery. After 30 days, data is unrecoverable.
Individual Deletions
- Delete a care log entry → immediately removed (including photos/videos)
- Delete a child profile → cascades to delete all associated care logs
- Delete a message → removed from your family's view
- Leave a family (nanny/driver) → your account detached but retained
10. YOUR RIGHTS UNDER PDPL
You have the right to:
- Access — Request a copy of your personal data
- Correction — Fix inaccurate or incomplete information
- Deletion — Erase your data ("right to be forgotten")
- Restriction — Limit how we process your data
- Portability — Export data in a machine-readable format (CSV/JSON)
- Object — Object to processing based on legitimate interests
- Withdraw Consent — Opt out of optional processing (transcription, translation, HubSpot sync)
How to Request:
Email: hello@nurtureuae.com
Subject: "Data Subject Request [Request Type]"
Response Time: 30 days (up to 60 days for complex requests).
11. SECURITY MEASURES
We protect your data with:
- HTTPS encryption (TLS 1.2+) for all communications
- Hashed PIN storage (SHA-256 with salt, never plain text)
- Role-based access control (drivers can't access care logs)
- Database encryption at rest
- Rate limiting to prevent brute-force attacks
- Firewall protection and DDoS mitigation
- Regular security audits
Limitations: No system is 100% secure. You are responsible for protecting your login credentials.
12. PERMISSIONS & DEVICE ACCESS
iOS Permissions
- Camera — Take photos for timeline
- Photos — Upload photos from device
- Microphone — Record voice notes
- Location — Show family activities nearby
- Notifications — Send push notifications
Android Permissions
- Camera, read photos, record audio, location access, notifications
You control: You can grant/deny permissions anytime in device Settings. Denying permissions won't prevent you from using core features like messaging and care logging.
13. COOKIES & TRACKING
Mobile App:
- ✗ No cookies (uses secure local storage for authentication instead)
- ✗ No third-party trackers
- ✗ No Google Analytics, Facebook Pixel, Segment, Amplitude, etc.
- ✗ No session recording or heatmap tools
- ✓ JWT token for secure authentication (stored locally on device)
Web (if future):
- First-party cookies for session management only
- No third-party advertising cookies
14. CHANGES TO THIS POLICY
We may update this policy to reflect:
- Changes in our practices
- New legal requirements
- Technical improvements
When we make material changes:
- We notify you in-app with a banner
- We send an email notification
- We provide 14 days' notice before changes take effect
15. APP STORE COMPLIANCE DISCLOSURES
Apple App Store Privacy Label
Data linked to you that we collect:
- Contact info (name, email, phone)
- Photos & videos
- Audio (voice notes)
- Location (when shared)
- Health info (allergies, medical notes)
- Financial info (subscription/billing)
- Device diagnostics
Tracking: We do NOT use IDFA or App Tracking Transparency data.
Google Play Store
Data we collect: Same as above.
Third-party sharing: RevenueCat (subscriptions), Cloudinary (media), OpenAI (AI services), Resend (email), SuprSend (push).
User control: Manage permissions in device Settings; delete account anytime.
16. CONTACT & COMPLAINTS
Privacy Questions
Email: hello@nurtureuae.com
Subject: "Privacy Question"
Data Subject Rights Requests
Email: hello@nurtureuae.com
Subject: "Data Subject Request [Type]"
Include:
- Your full name
- Registered email or phone
- Clear description of your request
- Supporting documents (if applicable)
Supervisory Authority (UAE Data Office)
If you believe we've violated your privacy rights or are unsatisfied with our response:
UAE Data Office (General Authority of Personal Data Protection)
- Website: https://data.gov.ae/en/home
- Email: info@data.office.ae
- Address: Al Manara Tower, Sheikh Zayed Road, Dubai, UAE
17. KEY DEFINITIONS
| Term | Definition |
|---|---|
| Care Log | A record of a care activity (feeding, nap, diaper, activity, note, photo, video) |
| Family | A parent + one or more nannies/drivers linked via invite code |
| PDPL | UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection |
| Personal Data | Any information relating to an identified or identifiable person |
| Processing | Any operation on data (collection, storage, use, sharing, deletion) |
| Data Controller | Nurture; decides what data to collect and how to use it |
| Data Processor | Third-party service provider (e.g., Cloudinary, RevenueCat) |
18. QUICK SUMMARY
- ✅ We collect: Account info, child profiles, care logs, messages, photos/videos, device data, billing
- ✅ We share with: Your family members (role-based), essential service providers
- ✅ You can: Delete anytime, access your data, request corrections, export data, object to processing
- ✅ We don't: Sell data, use advertising trackers, profile children, share with advertisers
Effective Date: July 20, 2026
Version: 1.0 (Concise)
Language: English
By using Nurture, you acknowledge you have read and understood this Privacy Policy.
For additional details or questions, contact hello@nurtureuae.com.