Victoria Baby CareVictoria Baby CareBack to home

Privacy Policy

Last updated: 4 July 2026

VICTORIA BABY CARE - PRIVACY POLICY

Effective date: 4 July 2026

This Privacy Policy explains how your personal data is collected, used, shared and protected when you use the Victoria Baby Care mobile application and its related services, including the in-app second-hand marketplace ("Shop"), the lullaby music player, the baby-care and maternal tracking features, and the associated website (together, the "Service").

We have written this policy to comply with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and with the French Data Protection Act (Loi Informatique et Libertés). Where the law grants you mandatory rights, nothing in this policy limits or removes them.

1. WHO WE ARE (DATA CONTROLLER)

1.1 The data controller responsible for your personal data is:

Victoria Baby Care Nantes, France Company registration number: [COMPANY REGISTRATION NUMBER]

In this policy, "we", "us", "our" and "the operator" refer to this entity.

1.2 For any question about this policy or about how your personal data is handled, and to exercise your rights, you can contact us at:

Email: support@victoriababycare.com

1.3 Certain third parties act as independent data controllers for parts of the Service (in particular Stripe for payments and seller identity verification, and Apple and Google for in-app subscription billing). Where that is the case, their own privacy notices apply to that processing in addition to this policy. This is explained in Section 9.

2. SCOPE OF THIS POLICY

2.1 This policy applies to personal data we process when you:

  • create or use an account;
  • track baby-care activities, growth, health logs, milestones and maternal data;
  • use the lullaby/music player;
  • buy or sell items in the Shop;
  • upload photos of items or dispute evidence;
  • contact our support team; and
  • visit our website.

2.2 The Service may contain links to, or integrations with, third-party services (for example a carrier's tracking page or an authentication provider). Those services are governed by their own privacy notices, which we do not control.

3. CATEGORIES OF PERSONAL DATA WE PROCESS

Depending on how you use the Service, we process the following categories of personal data.

3.1 Account and profile data

  • email address;
  • display name or username (optional);
  • authentication method and authentication identifiers (for example Sign in with Apple, Google Sign-In, or email/password);
  • account creation date, language and app settings;
  • caregiver role (for example parent, co-parent, or other caregiver) and the family/account members you are linked to.

3.2 Baby and child data

  • the child's first name (or a nickname you choose);
  • date of birth (or expected due date);
  • sex (recorded as boy or girl);
  • growth measurements (weight, height, head circumference) and their timestamps;
  • activity and care logs (feeding, sleep, nappy changes, baths, medication, vitamins, vaccinations, appointments, allergies, temperature, activities and similar entries);
  • milestones and optional notes;
  • optional photos of the child that you choose to upload.

3.3 Maternal data

  • pregnancy and post-partum tracking data that you choose to record (for example due date, contractions, mood entries, screening-questionnaire results, physical recovery entries, lactation, medications, appointments and related notes).

3.4 Uploaded photos and content

  • photos and images you upload to list items in the Shop;
  • photos and images you upload as evidence when reporting a problem or handling a dispute;
  • messages, notes, reviews, reports and other content you submit through the Service.

3.5 Location data

  • for delivery, the relay (pick-up/drop-off) point you select and the approximate area used to display nearby relay points on a map;
  • depending on your device settings and your choices, more precise location may be used to help you find nearby relay points. You can control location permissions at any time in your device settings.

3.6 Phone number

  • your phone number, which may be required to verify sellers, to enable delivery notifications from the carrier, and for security purposes.

3.7 Payment and payout data (processed by Stripe)

  • for buyers: the payment information needed to complete a purchase, processed directly by Stripe;
  • for sellers: payout and identity-verification information required to receive funds, including bank account details and the identity/KYC information Stripe collects to comply with anti-money-laundering and payment-services law (for example name, date of birth, address and, where required, identity documents);
  • transaction records (amounts, fees, dates, order and dispute status).

We do not store full card numbers on our own systems. Card and bank details are handled by Stripe as described in Section 9.

3.8 Seller tax data (DAC7)

  • where you sell on the Shop and meet the thresholds set by law, we collect and report certain tax-related information as described in Section 8.

3.9 Device, app-usage and diagnostic data

  • device type, operating system and version, app version, language and time zone;
  • technical identifiers needed to run the app and deliver push notifications;
  • app-usage and interaction data (for example features used and screens viewed), in aggregated or pseudonymised form where possible;
  • diagnostic data such as crash reports, error logs and performance metrics.

3.10 Communications

  • the content of messages you send us (for example support requests) and our replies;
  • your notification and email preferences.

We do not knowingly collect special-category data beyond what you voluntarily enter into the baby-care and maternal tracking features. Those features exist so that you can record such information for your own use; we process it only to provide the features to you, on the legal bases set out in Section 4.

4. PURPOSES AND LEGAL BASES

For each purpose below we set out the legal basis under Article 6 (and, where relevant, Article 9) GDPR.

4.1 Providing the core app (accounts, tracking, syncing, notifications) Purpose: to create and manage your account, store and synchronise your baby-care, maternal, milestone and related entries across your devices, and send the reminders and notifications you enable. Legal basis: performance of the contract between you and us (our Terms of Service). For health-related and maternal entries you choose to record, our processing is based on your explicit consent, given when you enter that information so that we can provide the tracking features to you; you can withdraw it by deleting the entries or your account.

4.2 Operating the Shop (marketplace, escrow, delivery) Purpose: to let you list, buy and sell items; to process orders; to hold buyer funds in escrow and release them to sellers; to generate shipping labels and enable relay-point delivery; and to run the returns, claims and Buyer Protection process. Legal basis: performance of the contract (our Terms of Service and, for the marketplace, the buyer/seller and Buyer Protection terms).

4.3 Payments, payouts and identity verification Purpose: to process buyer payments, hold funds in escrow, verify sellers, and pay out sellers. Legal basis: performance of the contract; and compliance with a legal obligation to which we and our payment provider are subject (in particular anti-money-laundering, counter-terrorist-financing and payment-services rules, which require identity verification/KYC).

4.4 Image safety scanning and reporting illegal content Purpose: to automatically scan uploaded images for illegal or abusive content - including child sexual abuse material (CSAM) - before they are shown, to block prohibited content, and to preserve and report confirmed illegal material to the competent authorities. Legal basis: compliance with a legal obligation; and our legitimate interest in keeping the Service safe, lawful and free of abusive content and in protecting users, in particular children. This is explained further in Section 7.

4.5 Fraud prevention, safety and security Purpose: to detect, prevent and investigate fraud, abuse, prohibited listings, security incidents and violations of our terms; to protect users; and to enforce our rights. Legal basis: our legitimate interest in the security and integrity of the Service and in preventing misuse; and, where applicable, compliance with a legal obligation.

4.6 Tax reporting for sellers (DAC7) Purpose: to collect and report seller information to the tax authorities where required by the EU platform-reporting rules (DAC7) and their French implementation. Legal basis: compliance with a legal obligation. See Section 8.

4.7 Subscriptions and premium features Purpose: to manage premium subscriptions and unlock premium content (including certain lullabies and features), through the Apple App Store / Google Play and RevenueCat. Legal basis: performance of the contract. The actual purchase is processed by Apple or Google under their own terms.

4.8 Support and communications Purpose: to respond to your requests, resolve disputes, and send you service-related (transactional) messages such as order confirmations, delivery updates, security notices and important changes to the Service. Legal basis: performance of the contract; and our legitimate interest in responding to you and administering the Service.

4.9 Improving the Service and diagnostics Purpose: to understand how the Service is used, fix bugs, and improve reliability, safety and features. Legal basis: our legitimate interest in maintaining and improving the Service. Where required, analytics and non-essential SDKs run only with your consent (see Section 14).

4.10 Marketing (only where you agree) Purpose: to send you optional news, offers or product updates by email. Legal basis: your consent, which you can withdraw at any time. We do not need your consent to send purely transactional or service messages. See Section 13.

4.11 Legal claims and compliance Purpose: to comply with legal obligations, respond to lawful requests from public authorities, and establish, exercise or defend legal claims. Legal basis: compliance with a legal obligation; and our legitimate interest in defending our rights.

Where we rely on legitimate interests, you have the right to object; see Section 12.

5. CHILDREN'S DATA

5.1 The Service is intended for adults - parents, guardians and caregivers. It is not directed to children, and children may not create an account or use the Service themselves.

5.2 The baby-care and maternal features let a parent, legal guardian or authorised caregiver record information about their own child. Any data about a child is entered by, and remains under the responsibility of, the adult account holder. By entering a child's data, you confirm that you are the parent, legal guardian, or an adult authorised by them, and that you have the authority to provide that information.

5.3 We use baby and child data only to provide the tracking, growth, milestone and reminder features to you. We do not use it for advertising, we do not sell it, and we do not use it to build profiles for marketing.

5.4 If you believe a child's data has been provided to us without proper authority, contact us at support@victoriababycare.com and we will act promptly.

6. THE BABY-CARE AND MATERNAL FEATURES ARE INFORMATIONAL ONLY

The tracking, growth charts, milestones and maternal features are provided for personal information and record-keeping only. They are not a medical device and do not provide medical advice, diagnosis or treatment. You should always consult a qualified healthcare professional for any medical concern. This does not affect how we protect your data; it explains what the data is for.

7. IMAGE SAFETY AND REPORTING OF ILLEGAL CONTENT

7.1 To keep the Service lawful and safe, every image you upload (for example item photos and dispute-evidence photos) is automatically scanned for illegal or abusive content before it is displayed to others. This scanning includes detection of child sexual abuse material (CSAM).

7.2 If content is flagged, it may be blocked from being shown and your account activity may be reviewed. Where an image is confirmed to be illegal material - in particular CSAM - we are legally required to preserve the relevant content and associated data and to report it, together with information that may identify the account and device involved, to the competent authorities. We do this to comply with a legal obligation and to protect children and other users.

7.3 We may retain such material and related records for as long as necessary to comply with our legal obligations and to cooperate with the authorities, even after you delete your account.

8. SELLER TAX REPORTING (DAC7)

8.1 EU rules on the reporting of income earned through digital platforms (Council Directive (EU) 2021/514, known as DAC7, as implemented in France) require platform operators to collect and report information about sellers who meet certain activity thresholds.

8.2 If you sell on the Shop and reach those thresholds, we are required to collect and verify information such as your name, address, date of birth (for individuals) or business identifiers, your tax identification number where applicable, your bank/payout account identifier, and details of the transactions and consideration you receive. We report this information to the competent tax authority, which may exchange it with the tax authority of your country of residence.

8.3 We collect and report this data to comply with a legal obligation. If you do not provide the required information, we may be legally required to withhold payouts or restrict your ability to sell, in accordance with the applicable rules.

9. PROCESSORS, SUB-PROCESSORS AND OTHER RECIPIENTS

9.1 We use trusted service providers who process personal data on our behalf and under our instructions (processors), and some independent controllers who are necessary to deliver the Service. We do not sell your personal data.

9.2 The main recipients are:

  • Google Firebase (Google) - authentication, database, file storage, and push notifications (hosting and core infrastructure).
  • Stripe - payment processing, escrow/Connect payouts, seller identity verification (KYC), and tax-related functions. For payment and KYC processing, Stripe acts as an independent controller under its own privacy policy and as required by financial-services law.
  • RevenueCat - management of in-app subscriptions and entitlements. The purchase itself is processed by the Apple App Store or Google Play under their own terms.
  • Sendcloud - generation of shipping labels and coordination of delivery with the carrier (Mondial Relay), including tracking.
  • Resend - sending transactional and, where applicable, other emails on our behalf.
  • Google Cloud Vision (Google) - automated scanning of uploaded images for illegal or abusive content, including CSAM detection.
  • Google Maps / Places (Google) - displaying maps and relay-point locations and related place information.

9.3 We may also disclose personal data:

  • to the carrier and to Sendcloud, as needed to deliver parcels;
  • to competent authorities, courts or regulators where required by law, or to report illegal content as described in Section 7;
  • to professional advisers (for example lawyers, auditors) under confidentiality; and
  • to a successor entity in the context of a merger, acquisition or reorganisation, subject to this policy.

9.4 We maintain agreements with our processors that require them to protect personal data and to process it only on our instructions. An up-to-date list of sub-processors is available on request at support@victoriababycare.com.

10. INTERNATIONAL TRANSFERS

10.1 We aim to keep personal data within the European Economic Area (EEA) where possible. However, some of our providers (including those named in Section 9) may process data outside the EEA, including in the United States.

10.2 Where personal data is transferred outside the EEA, we rely on appropriate safeguards recognised under the GDPR - in particular the European Commission's Standard Contractual Clauses, and where relevant an adequacy decision - together with additional technical and organisational measures where needed. You can ask us for more information or a copy of the relevant safeguards at support@victoriababycare.com.

11. HOW LONG WE KEEP YOUR DATA (RETENTION)

11.1 We keep personal data only for as long as necessary for the purposes described in this policy, and then delete or anonymise it. The main retention periods are:

  • Account, profile and tracking data (baby-care, maternal, milestones): kept while your account is active. If you delete your account, this data is permanently deleted, generally within a short period after deletion, except where longer retention is required as set out below.
  • Uploaded photos: deleted when you delete the item, the entry or your account, subject to the exceptions below.
  • Marketplace transaction, payment, invoicing and accounting records: kept for the period required by French commercial, tax and accounting law (generally up to 10 years).
  • Seller identity/KYC and anti-money-laundering records: kept for the period required by the applicable financial-services and AML rules (generally 5 years after the end of the relationship).
  • DAC7 tax-reporting data: kept for the period required by the applicable tax-reporting rules.
  • Dispute, claim and Buyer Protection evidence: kept for as long as needed to handle the dispute and to establish, exercise or defend legal claims, and thereafter for the applicable limitation period.
  • Content confirmed to be illegal (including CSAM) and related records: preserved and retained as required to meet our legal obligations and to cooperate with the authorities, as described in Section 7.
  • Diagnostic and usage logs: kept for a limited period needed for security, debugging and improvement, then deleted or aggregated.
  • Support communications: kept for as long as needed to handle your request and for a reasonable period thereafter.

11.2 Where we are legally required to keep certain data (for example for tax, accounting, AML or legal-claim purposes), that data is retained even after you delete your account, and is deleted at the end of the applicable period.

12. YOUR RIGHTS

12.1 Under the GDPR, you have the following rights in respect of your personal data:

  • Right of access - to obtain confirmation of whether we process your data and a copy of it.
  • Right to rectification - to have inaccurate data corrected and incomplete data completed.
  • Right to erasure ("right to be forgotten") - to have your data deleted in the cases provided by law.
  • Right to restriction - to have processing limited in certain cases.
  • Right to data portability - to receive certain data you provided in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
  • Right to object - to object, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
  • Right to withdraw consent - where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

12.2 Some of these rights are subject to conditions and exceptions under the law. For example, we may be unable to erase data we are legally required to keep (see Section 11), and rights may be limited where they would adversely affect the rights of others.

12.3 To exercise your rights, contact us at support@victoriababycare.com. You can also access, correct and delete much of your data directly in the app, including deleting your account. We may need to verify your identity before acting on a request. We will respond within the time limits set by the GDPR (in principle within one month).

12.4 You have the right to lodge a complaint with a supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. You may also complain to the supervisory authority of your habitual residence or workplace.

13. EMAILS AND NOTIFICATIONS

13.1 We send transactional and service messages that are necessary to provide the Service - for example order and delivery updates, dispute notices, security alerts, and important changes to the Service or this policy. You cannot opt out of these while you use the Service, because they are part of the contract.

13.2 We send marketing or promotional emails only if you have agreed to receive them. You can withdraw your consent at any time using the unsubscribe link in the email or by contacting us.

13.3 Push notifications and reminders are controlled by you in the app and in your device settings.

14. COOKIES, SDKS AND ANALYTICS

14.1 The mobile app is not a website and does not use browser cookies in the traditional sense. It does use software development kits (SDKs) and technical identifiers that are necessary to run the app, keep you signed in, deliver push notifications, process payments, and secure the Service. These are strictly necessary and do not require consent.

14.2 For analytics and diagnostics, and for any non-essential SDKs, we act in accordance with applicable law. Where the law requires consent (for example for non-essential trackers), we ask for it and you can change your choice at any time in the app or device settings.

14.3 Our website, where applicable, uses only strictly necessary cookies by default and asks for your consent before setting any non-essential cookies, in line with CNIL guidance.

15. HOW WE PROTECT YOUR DATA (SECURITY)

15.1 We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. These include:

  • encryption of data in transit (HTTPS/TLS) and at rest on our infrastructure;
  • access controls so that your account data is accessible only to you and to authorised members you link, and internal access is restricted on a need-to-know basis;
  • reliance on established, security-certified infrastructure (for example Google Cloud / Firebase);
  • payment and identity data handled by Stripe under its own security and compliance framework;
  • logging, monitoring and regular review of our security practices.

15.2 No system can be guaranteed to be completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the CNIL and, where required, you, in accordance with the GDPR.

16. CHANGES TO THIS POLICY

16.1 We may update this policy from time to time to reflect changes in the Service, our providers, or the law. When we make material changes, we will update the effective date and, where appropriate, notify you in the app or by email.

16.2 The version in force is the one published with the most recent effective date. Your continued use of the Service after an update means you are aware of the current policy; it does not waive any mandatory right you have under the law.

17. CONTACT

For any question about this Privacy Policy, about how we handle your personal data, or to exercise your rights, contact:

Victoria Baby Care Nantes, France Company registration number: [COMPANY REGISTRATION NUMBER] Email: support@victoriababycare.com

Effective date: 4 July 2026

——— This document is available in French and English. In case of any discrepancy, the French version prevails.