Bebiario is a diary for your baby's first months. This page explains, in plain words, which data we process, why we process it and what control you have over it.
Data controller
The service is provided by GOLDEN GRIFFIN SL (NIF B24958365, Calle Lepant 270, planta 0, puerta BJ, 08013 Barcelona), a company incorporated under Spanish law with registered office in Barcelona (Spain). Data protection contact: the controller (GOLDEN GRIFFIN SL). For any privacy question write to ops.goldengriffin@gmail.com.
Which data we process
- Parent data: email address (to sign in), preferred language and, if you subscribe, payment data handled by Stripe (we never see your card number).
- Baby data: name, date of birth and sex; the events you log in the diary (feeds, nappies, sleep, burps), growth measurements and health events (temperature, medication, symptoms), with optional photos.
- Voice notes: if you dictate a note, the audio is sent to the transcription service and is not kept after transcription: only the text remains, which you can see and correct.
Why we may process it (legal basis)
Your baby's health data is a «special category of data» under art. 9 GDPR: we process it only with the explicit consent of the parent or legal guardian (art. 9.2.a GDPR), which you give by logging these events in the diary and can withdraw at any time by deleting individual events or the whole account. Everything else (account, daily diary, family sharing, payments) is processed because it is necessary to provide the service you ask for (art. 6.1.b GDPR, performance of a contract).
Who processes data on our behalf (sub-processors)
We do not sell your data to anyone. To run Bebiario we rely on:
- Supabase — database and file storage (health photos), EU region (eu-west-1).
- Vercel — application hosting, with EU edge.
- Groq — voice note transcription; the audio is not kept after transcription.
- Anthropic — generation of the AI diary summaries.
- Stripe — subscription payments.
- Google — sign-in with a Google account (OAuth) and, only if you enable it, backup to Google Drive.
- Amazon — only if you link the optional Alexa skill.
Google Drive backup
The Drive backup is optional and you enable it. When you connect it, Bebiario uses the «drive.file» scope: it can only see and manage the files it creates itself (your diary backup), not the rest of your Google Drive. It is used solely to keep a copy of your data for you: we do not read it for other purposes, do not share it, and do not use it for advertising or to train AI models. You can revoke access at any time by disconnecting the backup in the app settings or from your Google account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
For how long
We keep your data for as long as your account exists. You can export everything as JSON and delete the account yourself from the app settings: deletion removes the data from the database and the photos from storage. If there is another parent in the family, the baby's diary stays with them; your personal data is deleted anyway.
Your rights
You have the right of access, rectification, portability, erasure, restriction and objection, plus the right to withdraw consent at any time. The JSON export and account deletion are self-service in the settings; for anything else write to ops.goldengriffin@gmail.com. You can also lodge a complaint with a supervisory authority (in Spain, the AEPD — aepd.es).
Cookies and tracking
We only use technical cookies: the session cookie that keeps you signed in and the language cookie. No third-party trackers, no profiling cookies, no advertising.
Changes to this policy
If anything changes we will update this page; the date at the bottom shows the last revision. We will tell you directly in the app about substantial changes.