Privacy policy
Last updated 11 July 2026
This policy explains what personal data beanlo (“we”, “us”) collects, why, and your rights over it. It is written to meet the UK GDPR and the Data Protection Act 2018.
Who is responsible for your data
beanlo is run by an individual (sole trader) based in England, United Kingdom. The operator is the “data controller” for the personal data described here. You can contact the operator about privacy at privacy@beanlo.com.
The data we collect
- Account details — your email address, and (if you sign in with Google) your name and profile email.
- Baby profile — the name, date and time of birth and birth weight you enter, and settings such as feed intervals.
- Care logs (health data) — feeds, nappies (including any photos you take), weights, sleep, pumping, notes, and the mother’s medication. Some of this is “special category” health data about your baby and, where you record it, about the mother.
- Notifications — if you enable them, a push subscription for your device.
- Technical data — a sign-in session cookie and basic information needed to run and secure the service.
How we use it, and our lawful bases
- To provide the service (store and show your logs, share with carers you invite) — on the basis of our contract with you (our Terms).
- Health data and optional features (recording care logs, the Ask assistant, and notifications) — on the basis of your explicit consent, which you give by choosing to use them and can withdraw at any time by turning them off or deleting your data.
- Keeping the service secure and working — on the basis of our legitimate interests.
Who we share it with
We do not sell your data or use it for advertising. We share it only with the service providers that run beanlo on our behalf (“processors”):
- Supabase — database, authentication and photo storage (hosted in the EU).
- Anthropic — powers Bea, the Ask assistant. When you ask a question, the relevant text from your logs (and your question) is sent to Anthropic to generate a response. It is not used to train their models.
- Vercel — hosts and serves the application.
We also share your baby’s data with the carers you explicitly invite.
International transfers
Some providers (for example Anthropic) process data outside the UK/EEA. Where that happens, appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses are relied upon to protect your data.
How long we keep it
We keep your data for as long as your account is active. You can delete individual entries, a baby and all its data, or your whole account at any time from within the app; deletion removes the data from our live systems, and from routine backups within a short period afterwards.
Your rights
Under UK data protection law you have the right to:
- access a copy of your data (the app also lets you export it);
- have inaccurate data corrected;
- have your data erased;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time.
To exercise any of these, email privacy@beanlo.com. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to help first.
Children’s data
beanlo is for use by adults (18 or over) who are the parent or carer of the baby whose information is recorded. The data about the baby is provided and controlled by you as their parent or carer. The service is not intended for use by children.
Security
Data is encrypted in transit, access is restricted by row-level security so you and your invited carers only see your own baby’s data, and photos are held in private storage. No system is perfectly secure, so we cannot guarantee absolute security.
Changes
We may update this policy from time to time; the “last updated” date above shows when. Material changes will be highlighted in the app.