Privacy Policy

Introduction

This Privacy Policy describes the types of personal information BumpBook LLC and its affiliates (collectively, "BumpBook," "we," or "us") collects, as well as how it's used, disclosed, protected, and retained through our website from which you are accessing this Policy, our mobile applications, social media pages on third-party social media platforms, email, text, and any offline business interactions you have with us (collectively, our "Services"). It also explains your privacy choices and rights, as well as how to exercise them.

When you visit our website bumpbook.app, use our mobile applications, and use our Services, you trust us with your personal information. We take your privacy very seriously. In this Privacy Policy, we describe our privacy practices. We seek to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it. We hope you take some time to read through it carefully, as it is important.

By accessing or using our Services, you signify your acceptance of this Privacy Policy and consent to the collection, use, disclosure, and other handling of your personal information as described in this Privacy Policy. If there are any terms in this Privacy Policy that you do not agree with, please discontinue use of our Services immediately.

Collection of Personal Information

We collect and process different types of information about you, including information that identifies, relates to, describes, or can be associated with you (known as "personal information"). This includes information that we collect directly from you, through automated collection technologies, from other sources, or personal information we derive based on other types of personal information we collect, as more fully described below.

Personal Information You Disclose to Us

Name and Contact Data. We collect your first and last name, email address, postal address, phone number, and other similar contact data.

Payment Data. We collect data necessary to process your payment if you make purchases, such as your payment instrument number (such as a credit card number), and the security code associated with your payment instrument. All payment data is stored by Stripe. You may find their privacy policy at: Stripe Privacy Policy

Account Information. We collect your username, password (stored securely), profile photo, and account preferences.

Pregnancy-Related Data. We collect pregnancy-specific information including due dates, current pregnancy week, pregnancy milestones, journal entries, uploaded photos, ultrasound images, appointment notes, symptoms tracking, and other pregnancy journey documentation you choose to provide.

Partner Connection Information. If you choose to connect with a partner through our Services, we collect information related to that connection, including partner account details and shared content permissions.

Communications. We collect information when you contact us for support, provide feedback, or communicate with us through the Services.

Information Automatically Collected

We automatically collect certain information when you visit, use or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. See our "Cookies and Other Tracking Technologies" section below for more details.

Pregnancy-Specific Data Privacy

We recognize that pregnancy-related information is highly sensitive and personal. Your pregnancy journey, including journal entries, photos, medical information, due dates, and pregnancy outcomes, is treated with the utmost care and confidentiality.

Sensitivity and Protection. All pregnancy data is:

• Stored securely
• Stored on secure servers with restricted access
• Never sold, shared for marketing purposes, or used for advertising
• Protected by industry-standard security measures
• Isolated from non-essential third-party access

Partner Sharing. When you connect with a partner through our Services, you are granting that partner access to view your pregnancy-related content. You can revoke partner access at any time through your account settings. We recommend carefully considering the privacy implications before sharing your pregnancy journey with another person.

Pregnancy Loss and Sensitive Outcomes. We understand that pregnancy journeys can have various outcomes, including miscarriage, stillbirth, or other losses. All pregnancy data, regardless of outcome, is handled with sensitivity and respect. You may delete your account and all associated data at any time.

No Medical Use. Your pregnancy data is NOT used for any medical purposes, diagnoses, or health-related decisions. BumpBook is a journaling and memory-keeping service only, not a medical or healthcare service.

Commitment to Privacy. We are committed to protecting the intimate and personal nature of your pregnancy information. Your trust in sharing your pregnancy journey with us is not taken lightly, and we implement rigorous safeguards to honor that trust.

Sensitive Personal Information

We do not "sell" or "share" sensitive personal information about Californians or other state residents within the meaning of the California Consumer Privacy Act (CCPA) and other US privacy laws, unless we have obtained prior consent or are legally obligated to do so.

Additionally, we do not use sensitive personal information for any purposes that are incompatible with the disclosed purpose for which it was collected or other than those permitted purposes authorized by US privacy law. Our commitment includes not using sensitive personal information for inferring characteristics about you.

Pregnancy Data as Sensitive Information. We treat all pregnancy-related data as sensitive personal information requiring heightened privacy protections. This includes:

• Pregnancy status and due dates
• Health information related to pregnancy
• Journal entries containing personal thoughts and feelings
• Photos and ultrasound images
• Pregnancy outcomes and medical information

We will never use this sensitive information for marketing profiling, targeted advertising based on pregnancy status, or sharing with third parties for their commercial purposes without your explicit, affirmative consent.

Use of Personal Information

We use personal information collected via our Services for a variety of business purposes described below. We process your personal information for these purposes in reliance on our legitimate business interests, in order to enter into or perform a contract with you, with your consent, and/or for compliance with our legal obligations. We indicate the specific processing grounds we rely on next to each purpose listed below.

We use the information we collect or receive to:

• Fulfill and manage your orders. We may use your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
• Provide and maintain our Services. We use your information to deliver the core functionality of BumpBook, including pregnancy tracking, journaling, photo storage, and partner sharing features.
• Track your pregnancy progress. We use pregnancy-related data you provide to help you track your pregnancy journey and milestones.
• Enable partner sharing features. We use partner connection information to facilitate content sharing between connected accounts with your explicit permission.
• Send you marketing and promotional communications. We may use the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt-out of our marketing emails at any time.
• Send you notifications. We may send you service-related notifications, updates, and communications (with your consent where required by law).
• Post testimonials. We post testimonials on our Services that may contain personal information. Prior to posting a testimonial, we will obtain your consent to use your name and testimonial. If you wish to update or delete your testimonial, please contact us.
• Deliver targeted advertising to you. We may use your information to develop and display content and advertising (and work with third parties who do so) tailored to your interests and/or location and to measure its effectiveness.
• Request feedback. We may use your information to request feedback and to contact you about your use of our Services.
• Improve our app and develop new features. We analyze usage patterns to enhance our Services and create new features.
• Respond to your support requests. We use your information to respond to your inquiries and solve any potential issues you might have with the use of our Services.
• Enforce our terms, conditions and policies. We may use your information for business purposes, legal reasons, and contractual obligations.
• Respond to legal requests and prevent harm. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
• For other business purposes. We may use your information for other business purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Services, products, marketing and your experience.

We may use and store information in aggregated and anonymized form so that it is not associated with individual end users and does not include personal information. We will not use identifiable personal information without your consent. We may also aggregate and/or anonymize personal information so that it will no longer be considered personal information. We do so to generate other data for our use, which we may use and disclose for any purpose, as it no longer reasonably identifies you or any other individual.

Disclosures of Personal Information

We may process or share data based on the following legal basis:

• Consent: We may process your data if you have given us specific consent to use your personal information for a specific purpose.
• Legitimate Interests: We may process your data when it is reasonably necessary to achieve our legitimate business interests.
• Performance of a Contract: Where we have entered into a contract with you, we may process your personal information to fulfill the terms of our contract.
• Legal Obligations: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process, such as in response to a court order or a subpoena (including in response to public authorities to meet national security or law enforcement requirements).
• Vital Interests: We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities, or as evidence in litigation in which we are involved.

More specifically, we may need to process your data or share your personal information in the following situations:

• With your partner (if you've connected accounts). When you choose to connect with a partner through our Services, your pregnancy-related content will be shared with that connected partner according to your sharing preferences.
• Vendors, consultants and other third-party service providers. We may share your data with third party vendors, service providers, contractors or agents who perform services for us or on our behalf and require access to such information to do that work. Examples include: payment processing (Stripe), data storage and hosting (Supabase, Vercel), email delivery, customer service and marketing efforts. We may allow selected third parties to use tracking technology on the Services, which will enable them to collect data about how you interact with the Services over time. Unless described in this Policy, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes.
• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Third-party advertisers. We may use third-party advertising companies to serve ads when you visit the Services. These companies may use information about your visits to our Services and other websites that are contained in web cookies and other tracking technologies in order to provide advertisements about goods and services of interest to you.

We do not sell, trade, or rent your personal information to third parties for their marketing purposes.

Retention of Personal Information

We plan to retain your personal information only for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or allowed by law. When we determine that we have no ongoing legitimate business need nor lawful legal ground to process your personal information, we will take steps to delete, anonymize, or aggregate it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will store your personal information until deletion is possible.

We determine retention based primarily on the type of record being retained. However, because a particular category of personal information may appear in different types of records, each with different retention periods, it may not be possible to specify a universal retention period for each particular category of personal information. Instead, the criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you have an account with us or keep using the Services)
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them)
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations)

You can delete your account at any time through your account settings, which will permanently remove all associated data, including all pregnancy-related content, journal entries, and photos.

Data Security

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Secure authentication systems
• Regular security audits
• Limited access to personal information on a need-to-know basis
• Secure infrastructure provided by industry-leading cloud services

However, please also remember that we cannot guarantee that the internet itself is 100 percent secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

Cookies and Other Tracking Technologies

Cookies are files that are placed on your computer or mobile or handheld device (such as smartphones or tablets) when you visit certain pages on the internet or use certain mobile applications. They can be used to "remember" when your computer or device accesses our Services. Cookies are stored in your browser. The cookie will help the Site, or another website, to recognize your device the next time you visit.

Most cookies won't collect information like a name or email address that directly identifies you as a person and will instead be used in efforts such as collecting more general information such as how visitors arrive at and use our Services. Cookies may, however, be used to create a profile of the visitor's activities on the Internet, and they can contain unique identifiers or any form of personal information.

Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your device, clear GIFs are embedded invisibly on web pages. We may use clear GIFs (a.k.a. web beacons, web bugs, or pixel tags), in connection with our Services and with cookies to, among other things, track the activities of visitors, help us manage content, compile statistics about usage (including clicks and cursor movements), and engage in targeted advertising. We and our third-party service providers also use clear GIFs in HTML emails we send, to help us with things like tracking email response rates, identifying when our emails are viewed, tracking whether our emails are forwarded, and customizing email or Service content.

Categories of Cookies

Our uses of such technologies usually fall into one of the following categories:

You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of our Services. Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies.

Third-Party Services

Our Services integrate with third-party providers who have their own privacy policies:

• Stripe: For payment processing. We do not store credit card information. All payment data is handled directly by Stripe in accordance with PCI compliance standards.
• Supabase: For database and authentication services. Data is stored on secure servers with encryption.
• Vercel: For hosting and content delivery. May collect basic analytics for performance monitoring.

We encourage you to review the privacy policies of these third-party services to understand how they handle your information.

California "Shine the Light" Disclosure

California Civil Code Section 1798.83 (California's "Shine the Light" law) permits customers that are California residents and who provide personal information in obtaining products and services for personal, family, or household use to request certain information regarding our disclosure of personal information to third parties for their own direct marketing purposes.

If applicable, this information would include the categories of personal information and the names and addresses of those businesses with which we shared qualifying California personal information during the immediately prior calendar year. You may request this information once per calendar year.

To make such a request, please contact us at support@bumpbook.app.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information we collect about you
• The right to know whether we sell or share your personal information (we do not)
• The right to request deletion of your personal information
• The right to opt-out of the sale of your personal information (not applicable as we do not sell personal information)
• The right to non-discrimination for exercising your CCPA rights

To exercise these rights, please contact us at support@bumpbook.app.

International Data Transfers

Please be advised the Services are hosted in the United States. If you access the Services from the European Union, Asia, or any other region of the world with laws or other requirements governing personal data collection, use, or disclosure that differ from applicable laws in the United States, then through your continued use of the Services, you are transferring your data to the United States, and you expressly consent to have your data transferred to and processed in the United States.

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law and take appropriate steps to mitigate harm. Given the sensitive nature of pregnancy-related data, we maintain heightened security protocols and incident response procedures.

Use of Services by Minors

We do not knowingly solicit data from or market to individuals under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services.

If we learn that personal information from users less than 18 years of age has been collected, we will take reasonable measures to promptly delete such data from our records. If you become aware of any data we have collected from individuals under age 18, please contact us at support@bumpbook.app.

User-Generated Content

You retain all rights to the content you create and upload to BumpBook, including journal entries, photos, and other materials. By using our Services, you grant us a limited, non-exclusive license to:

• Store and backup your content
• Display your content back to you and your connected partner (if applicable)
• Process your content to provide our Services (e.g., creating your printed book)

We will never use your personal content for marketing, advertising, or share it with third parties without your explicit consent, except as required by law.

Your Privacy Rights

You have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt-out of certain communications
• Withdraw consent for data processing

Cookies and similar technologies: Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. To opt-out of interest-based advertising by advertisers on our Services visit https://www.aboutads.info/choices/.

Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.

Medical Disclaimer

BumpBook is not a medical service and does not provide medical advice. The information provided through our Services is for personal journaling and memory-keeping purposes only. Always consult with qualified healthcare providers for medical advice, diagnoses, or treatment. Your pregnancy data is never used for medical purposes, diagnoses, or health-related decision making.

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, BUMPBOOK SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR REVENUES, WHETHER INCURRED DIRECTLY OR INDIRECTLY, OR ANY LOSS OF DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES RESULTING FROM YOUR USE OF OUR SERVICES.

Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the United States and the State of Maryland, without regard to its conflict of law provisions. Any disputes arising under or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in Maryland.

Updates to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" legend at the bottom of this Privacy Policy indicates when this Privacy Policy was last revised. Any changes will become effective when we post the revised Privacy Policy on the Services.

We will notify you if the policy changes in any material way by placing a prominent notice on our website or, for significant changes, providing additional notice through the app or via email.

Contact Us

If you have any questions, requests, concerns, complaints, or suggestions about this Privacy Policy, have any requests related to your personal information pursuant to applicable laws, or otherwise need to contact us, please contact us at: