Effective date: 14 August 2026
Nurture ("we", "us", or "our") operates the Nurture mobile application, a childcare communication and early-childhood activity guidance service designed for parents and household staff (nannies and family drivers) in the United Arab Emirates. This Privacy Policy explains how we collect, use, share and safeguard your personal data and is issued in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its Executive Regulations.
1. Data controller
The data controller for personal data processed through the App is Nurture. Our designated contact point for privacy matters is the email address provided at the end of this policy. Where the App is used in conjunction with services we resell or integrate, separate data controllers may apply for those services and you will be informed at the point of booking.
2. Personal data we collect
We collect only the data necessary to provide childcare-management features. Categories of personal data we may process include:
- Account data — email address (used to sign in), name, role (parent / nanny / driver), preferred language, hashed PIN, family invite code, and an optional mobile telephone number. Sign-in is by email address. The mobile telephone number registered on the account may still be used as a sign-in credential in two cases: for accounts created before email sign-in existed, and by older versions of the app that still sign in by phone — so that neither is locked out.
- Child profile data — child's name, date of birth or approximate age, allergies / dietary notes, an optional avatar image, and optional developmental-profile details (interests, goals, medical notes) the parent may add.
- Care-log data — feeding times and amounts, nap times, diaper changes, notes, photos and short videos, and the timestamp / author of each entry.
- Messaging data — text messages, attached photos, voice notes and any transcripts or translations of those voice notes (see sections 6 and 7).
- Precise location data — only when you choose to share it (see section 5). The App never collects your location in the background.
- Schedule data — appointments including title, location (optionally with map coordinates), time, notes and whether a family driver is required.
- Shopping list data — items on the shared family shopping list and their status.
- Device & technical data — IP address, device type, operating system version, app version, language, time zone, crash diagnostics, and push-notification tokens.
- Communications with us — any message you send via the in-app contact form, email or support channel.
3. How we use your data (purposes & lawful basis)
Under the PDPL we process your personal data only where we have a valid lawful basis. Our purposes are: to operate the service (contract); to enable communication, including voice-note transcription and translation (contract and your consent); to provide activity, meal and coaching guidance via the AI providers named in sections 7 and 9 (contract); to help carers do their job (contract / legitimate interest in safeguarding); to take payment for your subscription (contract); to improve and secure the App (legitimate interest); and to contact you with a welcome email, service notices and support replies (contract / consent).
4. Children's data
The App stores limited personal data about children (name, age, care-log entries, photos and videos uploaded by household staff). This data is created and supplied by the parent or a household employee acting on the parent's behalf. The parent is the primary decision-maker for any child profile and may delete it at any time. A child is never an account holder and the App never collects data directly from a child.
What we send to AI providers about a child. When you use an AI feature about a child, we send only the child's age in months, any allergies and dietary preferences, and the interests you have entered, so suggestions are age- and needs-appropriate.
What we never send. We never send a child's date of birth, photographs or medical notes to any AI provider.
Names are replaced before sending. When you use the in-app assistant, your message may naturally mention a child by name. Before the request leaves our servers we automatically replace every name we know with a neutral placeholder ("CHILD_1", "CHILD_2") — in both your message and the list of children we describe — and we swap the real name back in only after the reply returns to us. The AI provider therefore receives the placeholder, never the child's name and never an account or child identifier.
5. Precise location
The App can attach a precise location in two places: when you choose to share a location in a chat message, and on a scheduled appointment. This is always optional and user-initiated — the App never accesses or collects your location in the background. Each time, you can either use your current GPS position or type an address; if you type an address, no GPS coordinates are sent or stored (address-only). Any location you share is stored with the relevant chat message or appointment in our database and is used only to show a map or open directions.
6. Voice notes and transcription
When you record a voice note, the audio is sent to OpenAI for transcription (the Whisper model), so the recipient can read and translate it. The text transcript is stored on the message. The original audio recording is also retained on that message in our database; it is removed when the message — or your account — is deleted, and we do not separately purge it beforehand.
7. Artificial-intelligence features and providers
Several features use AI: meal plans, activity ideas, caregiver coaching, on-demand message translation, voice-note transcription, and learning-content generation. Every AI request is routed through our AI broker, Emergent, to the underlying model provider — OpenAI (meal plans, activities, coaching and Whisper transcription) or Google (Gemini) (message translation).
Each AI request is tagged only with a pseudonymous session identifier — a salted, one-way hash. This lets a provider group the turns of a single conversation while ensuring it never receives your name, email address, telephone number, or any raw account or child identifier.
When you translate a message, the message text is sent to Google (Gemini) with the target language, and the resulting translation is stored in a translation cache (keyed by the text, not by your account) so the same message is not translated twice.
8. Sharing with other family members
Data within a family group is visible to other members according to their role: parents see all data; nannies see care logs, child profiles, schedule, shopping list and chat; drivers see only schedule items flagged as "requires driver" and their chat channels — not care logs, child profiles or daily summaries.
9. Third-party processors and sub-processors
We use the service providers below to run the App. Each is bound by a written agreement and may only process your data on our instructions. We name each and what it receives:
- Emergent — our AI broker. Every AI request (section 7) passes through Emergent, which routes it under a single secure key to the model provider.
- OpenAI — generates meal plans and activity ideas, produces caregiver coaching tips, and transcribes voice notes (Whisper). Receives the inputs described in sections 4, 6 and 7.
- Google (Gemini) — translates messages you choose to translate; receives the message text and target language, and the translation is cached (section 7).
- Cloudinary — hosting and delivery of short video clips uploaded to the timeline and generated audio for learning content. Photos are stored in our own database, not with Cloudinary.
- HubSpot — customer-relationship management; receives your email address, optional phone number, role, and subscription / billing status.
- RevenueCat — manages your in-app subscription purchases and entitlements.
- Stripe — processes card payments for subscriptions.
- Resend — delivers transactional email (welcome message and support replies).
- Cloud hosting & database — our backend and database are hosted with commercial cloud providers, with primary processing in regions chosen for latency to the UAE.
We do not sell your personal data, and we do not share it with advertising networks.
10. International transfers
Where personal data is transferred outside the UAE for processing by a sub-processor listed above, we rely on the safeguards permitted by Article 22 of the PDPL — including transfers to jurisdictions with an adequate level of protection or, where none exists, contractual safeguards that bind the recipient to a comparable standard.
11. Data retention
We keep personal data only for as long as it is needed to provide the service or to comply with legal obligations. Account, child profile and family data are kept while your account is active. Care-log entries, photos and videos are kept while your account is active, subject to a rolling storage cap on media size. Messages — including voice-note audio and its transcript — are kept on the message until the message or your account is deleted. Cached translations are stored by content (not linked to your account) to avoid re-translating the same text.
12. Account deletion
You can delete your account at any time from Profile → Delete Account.
What we remove. Your account and login sessions, and — if you are the parent who owns the family — the family and all of its children, care logs, messages, appointments, shopping list, AI meal and activity plans, developmental profiles, coaching scores and referral records. Any nanny or driver linked to your family is detached (their own account is kept). We also cancel and delete your billing profile with our payment processor.
What we cannot remove. Short-lived technical backups (up to 30 days) before they are overwritten; copies of content already delivered to or processed by a third-party provider in the past (for example an email already sent, a CRM record, or content already processed by an AI provider); and cached translations, which are stored by content and not linked to your account. You can ask us to address any of these through a data-rights request (section 13).
13. Your rights under the PDPL
Subject to the PDPL, you have the right to request access, correction, deletion (also available directly through the in-app delete-account flow), restriction of or objection to processing, withdrawal of consent (e.g. for voice-note transcription), portability of data you have provided, and to lodge a complaint with the UAE Data Office. To exercise any right, contact us at the email below; we aim to respond within 30 days of a verified request.
14. Security
We use appropriate technical and organisational measures to protect your personal data, including encrypted transport (HTTPS), PIN storage hashed with bcrypt, role-based access controls (e.g. drivers cannot access care logs), restricted media uploads and least-privilege access for staff. No method of electronic transmission or storage is 100% secure, so we cannot guarantee absolute security.
15. Cookies and tracking
The App itself does not use advertising cookies, does not embed third-party advertising trackers, and does not track you across other apps or websites.
16. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes we will notify you in-app or by email at least 14 days before the change takes effect.
17. Contact us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact our privacy team at hello@nurtureuae.com.