Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection laws is:

PlaPlu UG (haftungsbeschränkt), Chausseestraße 118, 15712 Königs Wusterhausen, Germany, email: legal@plaplu.com

2. Subject of data protection

Data protection concerns personal data. Under Art. 4(1) GDPR, this is any information relating to an identified or identifiable natural person, e.g. name, date of birth, or usage data.

3. Data processing when using the app

3.1 Baby profile (voluntary information)

You can create a profile for your baby in the app. The following data is collected:

• Your baby's first name
• Your baby's date of birth

This information is voluntary and is used to match the developmental phases shown in the app to your baby's age. The data is stored locally on your device. On iPhone and iPad it is synchronized with your other devices via Apple CloudKit if iCloud is enabled; on Android it is part of the Android backup if you have enabled it (see section 3.3).

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can delete the data in the app at any time.

Special note on children's data: The data mentioned above relates to your child. Under Art. 8 GDPR and Art. 14 of the Brazilian LGPD, children's data is subject to special protection. We use this data exclusively to personalize the developmental phases within the app. It is not shared with third parties.

3.2 AI parenting assistant (chatbot)

The app offers an AI-powered chatbot that provides general information about child development. When you use the chatbot, your input (chat messages) is transmitted to Amazon Web Services (AWS Bedrock) for processing.

Provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Server location: EU (Frankfurt region, eu-central-1). Processing: Messages are processed in real time to generate a response. Your input is not used to train AI models.

Storage: Your chat history is stored locally on your device. To provide the service and for documentation and evidence purposes, your chat messages (input and output) and an automatically generated conversation summary are additionally stored in our backend (AWS, Frankfurt region). This data is linked exclusively to a pseudonymous installation identifier and does not contain your real name. The data is stored for up to 10 years from your last use; the period restarts with continued use (rolling period), and the data is deleted automatically once it expires. In addition to conversation continuity, the purpose of this storage is to document the content generated by the system and to establish, exercise, and defend legal claims. The AI model itself (AWS Bedrock) does not store your data, and your data is not used for training. You can export your chatbot data stored in the backend and have it deleted at any time in accordance with section 8; retention required for the defense of legal claims remains unaffected.

Notice pursuant to the EU AI Act (Art. 50 of Regulation (EU) 2024/1689): The chatbot is an AI system. When using the chatbot, you are interacting with an artificial intelligence, not with a human.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. Before you first use the chatbot, you will be asked for your explicit consent; without this consent, the chatbot feature cannot be used. You can withdraw your consent at any time in the app settings. After withdrawal, no further data is transmitted to AWS. The legal basis for the storage of chat data for documentation and evidence purposes described above is our legitimate interest pursuant to Art. 6(1)(f) GDPR in documenting system output and defending against potential claims.

3.3 iCloud sync (iOS) and Android backup

If you have enabled iCloud on your iPhone or iPad, the following data is synchronized with your other devices via Apple CloudKit:

• Baby profile data (name, date of birth)
• Phase progress (unlocked or read content)
• Unlock status of purchased content (book, audiobook)

Chat histories, app settings, and your consent status are not synchronized via CloudKit.

Synchronization takes place via Apple's infrastructure. PlaPlu UG has no access to the data of individual users stored in CloudKit. The data is stored encrypted in Apple's data centers. For more information, see Apple's privacy policy at https://www.apple.com/legal/privacy/.

On Android, no synchronization via CloudKit takes place. If you have enabled backup to your Google account in the Android settings, Android backs up the app data (baby profile, journal, chat histories, app settings and the unlock status of purchased content) to your Google account and restores it when you reinstall the app or set up a new device. The app's access credentials are excluded. The backup takes place via Google's infrastructure according to your settings; PlaPlu UG has no access to these backups. For more information, see Google's privacy policy at https://policies.google.com/privacy.

The legal basis is the performance of a contract pursuant to Art. 6(1)(b) GDPR (provision of the app's functionality).

3.4 Notifications

With your consent, the app shows notifications, for example when your baby enters a new developmental phase. On iOS and Android these notifications are scheduled and triggered exclusively locally on your device. No device token is transmitted to Apple, Google or us for this purpose.

Notifications do not contain personal data such as your baby's name.

You can disable notifications at any time in your device's system settings.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

3.5 In-app purchases

All purchases (book, audiobook, subscription) are processed via the in-app purchase system of the respective app store: on iOS via Apple's in-app purchase system, on Android via Google Play Billing. PlaPlu UG does not receive any payment data from Apple or Google (credit card numbers, bank details, etc.). We only receive information about which content has been unlocked so that we can activate the corresponding features in the app. To assign unlocked content, we store a purchase identifier provided by the respective store (e.g. the Original Transaction ID for Apple, the purchase token for Google Play) in our backend. This identifier is pseudonymous: it is not linked to a real name, but it can be linked to an Apple or Google account or device. It is stored for the duration of the contractual relationship and within the scope of statutory retention obligations (see section 7).

The legal basis is the performance of a contract pursuant to Art. 6(1)(b) GDPR.

3.6 In-app usage analytics, feature flags and experiments (PostHog)

If you give your consent, we collect pseudonymized usage data to analyze and improve the app. This includes, for example, screens viewed, features used, interactions within the app, and feedback submitted in the app. We also use the same service to switch features on or off in a targeted way (feature flags) and to compare different versions of features or content (experiments, A/B tests). For this, a version is assigned to your installation and we evaluate how the versions are used. We use the PostHog service for these purposes.

Provider: PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Server location: EU (Frankfurt region). The data is processed in PostHog's EU cloud.

Data minimization: Collection is disabled by default and only starts after your explicit consent. Without your consent, no usage data is collected and no feature flags or experiments are retrieved; you then use the standard version of the app. Your approximate location (country, city) is derived from your IP address; the IP address itself is then discarded and not stored. Advertising and device identifiers (IDFA and IDFV on iOS, the advertising ID and Android ID on Android) are not collected. Session recordings (session replay) are disabled. We record technical details such as device type, operating system and app version, and language setting. Your data is linked exclusively to a pseudonymous installation identifier and does not contain your real name.

Purpose: Analysis of usage to improve and further develop the app, gradual rollout of features, and comparison of versions. The data is not merged with other data sources, shared for advertising purposes, or sold.

Retention period: 12 months.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You will be asked for your consent before any data is collected. You can withdraw your consent at any time with effect for the future in the app settings (profile). After withdrawal, no further usage data is collected and no feature flags or experiments are retrieved.

4. Website

4.1 Website hosting (Amazon S3 and CloudFront)

The plaplu.com website is stored as a static website on Amazon S3 and delivered via the Amazon CloudFront content delivery network. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg.

When you visit the website, the connection data technically required for delivery is processed, in particular:

• IP address
• Date and time of access
• Page accessed
• Browser type and operating system

This data is required for the technical operation and secure delivery of the website. Delivery takes place via CloudFront edge locations in Europe and North America (see section 6). The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing the website reliably and securely.

4.2 Cookies and consent management

When you first visit the website, a cookie banner is displayed. Without your consent, only strictly necessary cookies are set; this includes, in particular, the cookie in which your consent decision is stored. The consent tool is served from our own website; no third-party content is loaded for this purpose.

You can change or withdraw your decision at any time via the “Cookie settings” link in the website footer.

4.3 Website analytics, feature flags and experiments (PostHog)

If you give your consent via the cookie banner, we collect pseudonymized usage data about the use of the website to analyze and improve the website. This includes pages viewed, time on page and scroll depth, the referring page and campaign parameters from the address you opened, as well as browser, operating system, device type, screen size, language setting, and time zone. We also use the same service to switch features on or off in a targeted way (feature flags) and to compare different versions of the website (experiments, A/B tests). We use the PostHog service for these purposes.

Provider: PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Server location: EU (Frankfurt region). The data is processed in PostHog's EU cloud.

After you consent, PostHog stores a randomly generated, pseudonymous identifier in cookies and in your browser's local storage in order to attribute page views to a visit and to show you the same version consistently. Your approximate location (country, city) is derived from your IP address; the IP address itself is then discarded and not stored. Session recordings (session replay) and the automatic capture of clicks and inputs are disabled.

Without your consent, the PostHog SDK is neither loaded nor initialized; no analytics tracking takes place at all, no feature flags are retrieved, and you do not take part in any experiments. If you do not give your consent or withdraw it, the website remains fully usable. After a withdrawal, your browser only keeps a note that no further data may be collected.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the website footer.

5. Processors

We use the following processors:

• Amazon Web Services EMEA SARL — AI chatbot (AWS Bedrock), backend, and website hosting (Amazon S3, Amazon CloudFront); location: EU (Frankfurt), website delivery additionally via edge locations in Europe and North America; basis: data processing agreement pursuant to Art. 28 GDPR
• Apple Inc. — iCloud sync (CloudKit) and in-app purchases on iOS; location: USA/EU; basis: Apple DPA
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — in-app purchases via Google Play on Android; location: EU/USA; basis: Google Play Developer Distribution Agreement and the Google data protection terms incorporated in it
• PostHog, Inc. — usage analytics, feature flags and experiments in the app and on the website; location: EU (PostHog Cloud EU, Frankfurt region); basis: data processing agreement pursuant to Art. 28 GDPR

6. Transfers to third countries

Your chat messages are processed by AWS Bedrock exclusively in the EU (Frankfurt region). The website's static content is stored in the EU; however, when it is delivered via Amazon CloudFront, edge servers in North America may also process connection data that is technically required (in particular the IP address). Any such transfer takes place on the basis of the EU-US Data Privacy Framework, under which Amazon Web Services is certified, and additionally on the basis of the standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

Where data is transmitted to Apple Inc. (USA) (CloudKit, in-app purchases), this takes place on the basis of the standard contractual clauses pursuant to Art. 46(2)(c) GDPR and the EU-US Data Privacy Framework.

Where data is transmitted to Google LLC (USA) in connection with in-app purchases via Google Play, this takes place on the basis of the EU-US Data Privacy Framework, under which Google LLC is certified, and additionally on the basis of the standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

Usage analytics, feature flags and experiments via PostHog take place on EU servers (Frankfurt region). Since PostHog, Inc. is based in the USA and access from the USA cannot be entirely ruled out, any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework, in which PostHog, Inc. participates, and additionally on the basis of the standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

7. Retention periods

• Baby profile data: until deleted by the user in the app.
• Chat messages and conversation summary: locally on the device until deleted by the user; in the backend for up to 10 years from the last use (rolling period), then deleted automatically.
• CloudKit data: until deleted by the user or the app is uninstalled. Note: if iCloud is enabled and the user reinstalls the app, data previously backed up in iCloud is restored. Apple may retain data in accordance with its own policies.
• Android backup: according to the backup settings in your Google account. If backup is enabled and the user reinstalls the app, the backed-up data is restored. Google may retain data in accordance with its own policies.
• Purchase data: for the duration of the contractual relationship and beyond in accordance with statutory retention obligations (Section 147 of the German Fiscal Code (AO): 10 years, Section 257 of the German Commercial Code (HGB): 10 years).
• Support requests: 120 days after the request is closed.
• Usage data (analytics, feature flags, experiments): 12 months; if consent is withdrawn, no further data is collected.

8. Your rights

You have the following rights regarding your personal data:

Right of access (Art. 15 GDPR) — you can request information about which personal data we process about you.

Right to rectification (Art. 16 GDPR) — you can request the correction of inaccurate data.

Right to erasure (Art. 17 GDPR) — you can request the deletion of your data, provided no statutory retention obligations prevent this.

Right to restriction of processing (Art. 18 GDPR) — you can request that the processing of your data be restricted.

Right to data portability (Art. 20 GDPR) — you can request to receive the data you provided in a structured, commonly used, and machine-readable format.

Right to object (Art. 21 GDPR) — you have the right to object at any time, on grounds relating to your particular situation, to the processing of your data where it is based on Art. 6(1)(f) GDPR.

Right to withdraw consent — where processing is based on your consent (Art. 6(1)(a) GDPR), you can withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, please contact legal@plaplu.com.

9. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The supervisory authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (State Commissioner for Data Protection of Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, phone: +49 33203 356-0, email: Poststelle@LDA.Brandenburg.de

10. Automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. The AI chatbot generates responses to your questions but does not make decisions with legal or similarly significant effects. The random assignment to versions as part of experiments likewise has no legal or similarly significant effect.

11. Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

Right to know: you can request information about which categories of personal data we collect, for which purposes, and with which categories of third parties we share them.

Right to deletion: you can request the deletion of your personal data.

Right to opt out: PlaPlu does not sell personal data and does not share it with third parties for advertising purposes. A “Do Not Sell or Share My Personal Information” opt-out is therefore not required.

No discrimination: you will not be disadvantaged for exercising your privacy rights.

To exercise your rights, please contact legal@plaplu.com.

12. Additional rights for users in Brazil (LGPD)

If you are located in Brazil, you have the right under the Lei Geral de Proteção de Dados (LGPD) to confirmation of processing, access, rectification, anonymization, deletion, data portability, information about data sharing, withdrawal of consent, and review of automated decisions.

Special protection of children's data (Art. 14 LGPD): The app processes data relating to children (baby's name, date of birth) exclusively on the basis of the consent of a parent or legal guardian and in the best interests of the child. This data is not shared with third parties and is not used for advertising purposes.

To exercise your rights, please contact legal@plaplu.com.

13. Additional rights for users in the United Kingdom

For users in the United Kingdom, the provisions of the UK GDPR and the Data Protection Act 2018 apply. Your rights essentially correspond to those set out in section 8. The competent supervisory authority is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, https://ico.org.uk.

14. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy with effect for the future where this is objectively justified due to changes in the law or case law, changed regulatory requirements, or the further development of the app or the website. We will inform you of significant changes in an appropriate manner and in good time before they take effect, for example by a notice in the app.

Where processing is based on your consent (Art. 6(1)(a) GDPR, e.g. AI chatbot, notifications, baby profile, website analytics) and the purpose or scope of that processing changes significantly, we will ask for your renewed consent. Otherwise, continued use of the app after the amended Privacy Policy takes effect constitutes acknowledgment of the changes.

The current version is available at any time in the app, in the App Store, on Google Play, and at https://www.plaplu.com/privacy.

15. Contact

If you have any questions about data protection, please contact:

PlaPlu UG (haftungsbeschränkt), email: legal@plaplu.com