Privacy Policy

1. Controller

Milena Marketing ltd., Alabin Street 33, 1000 Sofia, Bulgaria (VAT ID BG208676776), represented by its managing director, Milena Barton. For any questions about data protection, you can reach us through our contact form.

2. What data we process

On this website:

• Server logs: Our hosting provider (Hetzner Online GmbH, Germany) processes technically necessary data when you visit the website, such as your IP address, browser type and time of access, in order to deliver and secure the site.
• Contact form: When you write to us through the contact form, we process your name, your email address and the content of your message in order to answer your inquiry. The message is transmitted through the form service FormSubmit and delivered to our email inbox.
• Analytics and advertising services: only with your consent, see Section 5.

In the BabyWear app:

• Account: your email address and your password, or your sign-in with Apple or Google, plus a display name. The app needs the account to store your child's details securely.
• Your child's profile: name or nickname, and optionally date of birth, sex and warmth sensitivity (gets cold easily, normal or sweats easily), and with Premium optionally a photo. From this, BabyWear calculates age-appropriate recommendations for outdoors, at home and for sleep. Photos are re-saved when uploaded, and any location data in the image is removed in the process.
• Places and location: If you allow location access, the app uses your approximate location (accurate to about one kilometer) while you are using it, in order to load the weather right outside your door. Your current location is not saved as a place. Places you add yourself are stored with their name, country, time zone and coordinates rounded to two decimal places. Without location access, BabyWear works with places you add yourself.
• Settings: app language, time zone, temperature unit and your reminder settings.
• Device and usage: basic technical data and crash reports that keep the app stable; usage analytics only with your consent (Section 5).

3. Weather and location

For every recommendation, BabyWear needs the weather at your location. To get it, the app sends only the rounded coordinates, your language and your time zone to our server in the EU. The server requests the weather from Apple WeatherKit (Apple Inc.); neither your name nor your account ID nor any details about your child are transmitted. We cache retrieved forecasts for a grid of about five kilometers for no more than 24 hours, without any link to you as a person. The weather data comes from Apple Weather (data sources).

4. Storage and processors

• Account and data: We store your account, profiles, photos, places and settings with Google Firebase (Google Ireland Ltd.). We use EU data centers (regions eur3 and europe-west1, Belgium), and transmission is encrypted. The data is visible only to your own account.
• Sign-in with Apple or Google: If you sign in with Apple or Google, Apple or Google, as applicable, confirms your identity. In doing so, we receive your email address and, if you allow it, your name.
• Subscription processing: Purchases are handled through Apple's App Store. To manage subscriptions and one-time purchases, we use RevenueCat (RevenueCat, Inc., USA). RevenueCat receives pseudonymous transaction data (e.g., purchase status, a pseudonymous user ID), never any details about your child. Transfers to this third country are based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
• Crash reports and app protection: Firebase Crashlytics collects technical crash data (e.g., device model, system version, the sequence of the error), no name and no details about your child. Firebase App Check uses Apple App Attest to verify that requests come from the genuine app.
• Notifications: If you turn on the reminder for weather changes, we store a device token along with the time zone, language and the rounded location the reminder applies to. Notifications are delivered through Firebase Cloud Messaging and Apple's push notification service. We delete device data 60 days after the app was last opened.
• Contact form: Messages from this website are delivered by FormSubmit (formsubmit.co, USA). They contain only what you enter there: your name, email address and message.

5. Cookies, analytics and advertising

On the website, we use analytics and marketing services to improve our website and to measure the effectiveness of our advertising:

• Google Analytics 4 and Google Ads (Google Ireland Ltd., Ireland)
• Meta Ads / Meta Pixel (Meta Platforms Ireland Ltd., Ireland)
• TikTok Pixel / TikTok Ads (TikTok Technology Ltd., Ireland)

These services use cookies and similar technologies and process pseudonymized usage data (e.g., pages visited, device and browser information, advertising IDs, approximate location) in order to measure reach, build audiences and attribute conversions. Data may be transferred to the parent companies in the USA in the process; such transfers are based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

All of these services are used only if you give your consent through the cookie banner (Art. 6(1)(a) GDPR, Section 25 TDDDG). Without your consent, they remain completely disabled. You can withdraw or adjust your consent at any time with effect for the future.

In the app, we use Firebase Analytics without an advertising ID, and only if you choose "Allow analytics" at the end of setup. The data is pseudonymized and is never linked to the details about your child. You can change your choice at any time in the settings. BabyWear does not show ads.

6. Purposes and legal bases

We process data to provide the service: loading the weather, calculating recommendations, storing profiles and places, managing purchases, sending reminders and answering inquiries (Art. 6(1)(b) GDPR). With your consent where it is required, for example for usage analytics and notifications (Art. 6(1)(a) GDPR, Section 25 TDDDG). And on the basis of our legitimate interest in a secure, reliably functioning product, for example for crash reports and app protection (Art. 6(1)(f) GDPR). Data is never sold.

7. Retention and deletion

We store personal data only for as long as necessary for the purposes stated. In the app, you can delete your account at any time in the settings (Art. 17 GDPR). When you do, we delete your account, your children's profiles and photos, your places and device data, remove your data from RevenueCat and unlink your account from Apple or Google. Deleting your account does not cancel an active subscription; please cancel it in your Apple account. Technical logs, caches and backups are deleted automatically after 30 days at the latest. We delete inquiries sent through the contact form once they have been fully answered and no statutory retention obligations apply.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; in Bulgaria, this is the Commission for Personal Data Protection (CPDP, cpdp.bg).

Simply use our contact form to exercise these rights.

9. Security and children

Transmission is encrypted with HTTPS, and the data is stored with Google Firebase in EU data centers. No transmission or storage is completely secure, but we take appropriate protective measures. BabyWear is made for parents and caregivers, not for children: you, as an adult, create your child's profile. These details are visible only to your account, are never used in analytics and are deleted completely together with your account. We do not knowingly collect any data from children themselves.

10. International transfers

We are based in the EU and host data in the EU or the EEA wherever possible; the app data is stored with Google Firebase in EU data centers. Some service providers operate outside the EEA: RevenueCat (subscription management) and FormSubmit (contact form) in the USA, as well as Apple (weather data, sign-in, push notifications). For these, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

11. Changes

If we update this policy, we will change the date at the top of this page.