Lullay Labs Privacy Policy

Effective date: July 21, 2026

This Privacy Policy explains how Lullay Labs (“Lullay Labs,” “Lullay,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use getlullay.com, the Lullay iOS app, the Lullay web beta, Nana, our website demo, and related support and beta services (collectively, the “Services”).

The short version: We do not sell personal information, serve behavioural advertising, or use your family’s information to train public AI models. The native iOS app keeps sleep logs and saved history on your iPhone, but Nana must process conversation content and selected family context through our AI provider to respond. The web beta stores account, child, tracking, plan, and conversation information on Lullay’s systems so it can work across browser sessions. You can request a copy of your information or delete it.

1. Who we are

Lullay Labs provides voice-first parenting tracking, education, and coaching for adult parents and caregivers. Lullay is not directed to children.

For privacy questions or requests, contact our Privacy Lead at [email protected]. General support is available at [email protected], and safety concerns can be sent to [email protected].

2. Information we collect

The information we collect depends on which Services you use and the choices you make.

Account and contact information

We may collect:

• your Sign in with Apple identifier and, if Apple provides it, your name or email address, including an Apple private-relay address;
• for the limited web beta, your name, email address, password hash, language, consent timestamp, and session information;
• language, time zone, account status, trial status, and preferences;
• waitlist information, support messages, privacy requests, safety reports, and beta feedback; and
• any contact information or attachments you choose to include when contacting us.

We do not receive your Apple Account password.

Child, caregiving, and tracking information

You may choose to provide information about a child and your family’s routines, including:

• the child’s name, date of birth, age, prematurity or adjusted-age information, and whether solids have started;
• sleep, nap, waking, feeding, mood, schedule, bedtime, plan, and routine information;
• sleep setting, sleep challenges, caregiver responses, goals, method preferences, and comfort with different approaches;
• notes, summaries, plan progress, guides, and facts you ask Nana to remember; and
• information you type, say, or confirm while using Nana or tracking features.

This information can reveal health, development, and family-routine details. We treat it as sensitive personal information and, where applicable, consumer health data.

Conversations, voice, and AI information

When you start a Nana voice or chat session, the Services may process:

• microphone audio and speech transcriptions;
• typed messages and Nana’s responses;
• the child’s name, age, prematurity, feeding and sleep context, recent tracking history, active plan, language, time zone, summaries, and relevant facts; and
• tool actions needed to log an event, update a plan, create a guide, or complete another request you make.

In the iOS app, raw voice audio is streamed for real-time processing and is not stored by Lullay Labs. Partial captions are discarded. Finalized conversation text is stored on your iPhone only if you enable conversation history; summaries may be stored locally so you can review prior sessions. The Lullay iOS backend is designed not to store raw audio, typed chat content, transcripts, or summaries.

The separate web beta stores typed messages and finalized voice transcript lines, summaries, guides, and plan information on Lullay’s systems so the beta experience can persist between browser sessions. The web beta never stores raw audio.

Purchase and subscription information

Apple processes App Store purchases. We may receive product identifiers, transaction and original-transaction identifiers, subscription state, expiration or revocation status, storefront or environment information, and an app-account token used to associate an entitlement with your Lullay account. We do not receive or store your full payment-card number.

Device, usage, and operational information

We may collect limited technical and operational information, including:

• app version, build number, operating-system version, device model, language, time zone, and timestamps;
• a pseudonymous or hashed account identifier;
• session start and end times, model tier, duration, token counts, estimated or measured service cost, trial usage, and rate-limit counters;
• content-free product events, counts, timings, and short categorical values if you opt in to app analytics; and
• IP address, browser type, security signals, essential session cookies, and approximate region inferred from IP when you use the website, web beta, waitlist, or demo.

Lullay’s in-app analytics are designed not to contain names, message text, notes, transcripts, or sleep details. The private operations dashboard displays aggregate usage, reliability, cost, subscriptions, consented product events, and the feedback message and optional reply email you intentionally submit. It does not display baby profiles, sleep history, Nana transcripts, recaps, or other family records.

Information we do not currently collect

The current Services do not intentionally collect contacts, HealthKit data, photos, camera images, Bluetooth data, precise device location, advertising identifiers, voiceprints, or biometric identifiers. Nana does not perform cry detection, speaker identification, emotion recognition, or voiceprint analysis. A child’s voice or other background sound may be incidentally captured while you intentionally hold the microphone control; avoid starting a session when others should not be recorded.

3. Where information is stored

Native iOS app

Child profiles, tracking history, local plans, Nana summaries, optional finalized conversation history, and local notes are stored on the iPhone using Apple’s device protections. Lullay Labs cannot remotely read that local database. Depending on your Apple settings, local app data may be included in a device backup controlled by Apple.

The native app sends selected context off-device when needed to authenticate, verify subscriptions, operate Nana, generate a recap, extract a fact, submit feedback, or send analytics you have enabled.

Web beta

The web beta stores account, child profile, tracking, plan, guide, conversation, consent, and product-event information in Lullay’s Cloudflare-hosted database. This architecture is separate from the native iOS app.

Website and demo

The public Nana demo does not require an account. Lullay does not store demo audio or transcripts. We use transient IP-based controls and security services to enforce session and spending limits. Waitlist submissions are stored so we can contact you about Lullay.

4. How we use information

We use information to:

• create and secure accounts and authenticate sign-ins;
• provide tracking, schedules, reminders, summaries, plans, guides, and Nana conversations;
• personalize the Services using the child and family context available to the selected product;
• process subscriptions, trials, restores, and entitlements;
• respond to support, privacy, safety, and beta-feedback requests;
• prevent abuse, fraud, and unauthorized access and enforce usage limits;
• measure reliability, service cost, and product performance;
• troubleshoot and improve the Services using content-free analytics and feedback you intentionally submit;
• comply with law, enforce our Terms, and protect users, children, Lullay Labs, and others; and
• communicate material service, safety, legal, or account changes.

We do not use child information, conversations, or sleep history for targeted advertising. We do not use customer content to train or fine-tune our own or a third party’s general-purpose model unless we first offer a separate, explicit opt-in. No such opt-in exists today.

5. Consent and processing choices

Core processing is necessary to provide the feature you request. For example, starting a Nana session directs us to process the conversation and the context needed to answer, and submitting feedback directs us to process that report. Optional product analytics are separate and off by default in the iOS app.

You may decline microphone access and use non-voice features. You may also stop a Nana session at any time. If you do not want conversation content and selected child context processed by our AI provider, do not start a Nana voice or chat session.

Where consent is the legal basis for processing, you may withdraw it for future processing by contacting [email protected]. Withdrawal does not affect processing already completed and may make some personalized or AI features unavailable.

6. AI and voice processing

Nana uses OpenAI’s API services. During a Nana session, microphone audio may travel directly from the device to OpenAI over an encrypted real-time connection, while Lullay’s backend handles authentication, safety instructions, selected context, tools, and connection signalling. Typed conversations and recap or fact-extraction requests pass through Lullay’s backend to OpenAI.

OpenAI states that API customer content is not used to train its models unless the API customer opts in. Under OpenAI’s default API controls, abuse-monitoring logs may contain prompts, responses, audio, transcriptions, and related metadata and may be retained for up to 30 days, unless law requires longer retention. Lullay Labs has not authorized OpenAI to train models on Lullay customer content.

Lullay personnel do not routinely listen to or read native iOS Nana conversations because Lullay does not store them. Access to web-beta conversation content, support messages, safety reports, or feedback is limited to authorized personnel who need it to provide support, investigate a reported problem, protect safety or security, or comply with law.

AI can be inaccurate or incomplete. Nana is an educational and coaching feature, not a healthcare professional or emergency service. See our Safety page and Terms of Service.

7. When we disclose information

We disclose personal information only as described here:

• OpenAI: real-time voice, transcription, chat, recap, fact extraction, and related AI processing;
• Cloudflare: website, web-beta, backend, database, security, logs, rate limiting, and content delivery;
• Apple: Sign in with Apple, App Store subscriptions, notifications, device services, and any Apple-controlled backups;
• Plausible: cookieless website analytics configured without advertising profiles;
• Support and communications providers: email delivery and the tools we use to answer messages; and
• Professional advisers and authorities: where reasonably necessary for legal, security, accounting, insurance, safety, or compliance purposes.

We may disclose information when you direct us to, when required by valid legal process, or when reasonably necessary to protect a person from serious harm, investigate fraud or abuse, or protect legal rights. If Lullay Labs is involved in a financing, merger, acquisition, reorganization, or sale of assets, information may be transferred subject to confidentiality and applicable law.

We do not sell personal information, share it for cross-context behavioural advertising, or allow third-party advertising trackers in the native app. We do not knowingly sell or share consumer health data.

8. Cookies and website analytics

The public website uses Plausible for aggregate, cookieless analytics and Cloudflare for security. The web beta uses an essential secure session cookie to keep you signed in. Cloudflare Turnstile may process technical and security signals when you use protected forms. We do not use advertising cookies or respond differently to browser “Do Not Track” signals because we do not track users across unrelated services for advertising.

9. Retention and deletion

We retain information for the period reasonably needed to provide the Services, meet the purposes described above, resolve disputes, maintain security, and comply with legal obligations.

• Native device data: remains on the iPhone until you delete individual records, use Delete everything, or remove the app or its data. Apple-controlled device backups may follow Apple’s retention settings.
• Native account and operational records: account, authentication, trial, subscription-entitlement, usage, consent, feedback, and optional analytics records remain while the account is active or until you use Delete everything, subject to legal, fraud-prevention, and backup requirements.
• Web-beta data: remains until you delete the web-beta account, we retire the beta, or it is no longer needed for the beta. Account deletion cascades through the associated child, tracking, plan, guide, and conversation records in the active database.
• OpenAI API content: under the default API configuration, eligible content may remain in abuse-monitoring logs for up to 30 days, unless legal or security obligations require longer retention.
• Website demo and security data: transient rate-limit data and ordinary infrastructure logs are retained for short operational and security periods controlled by Lullay or its providers.
• Waitlist and support records: remain until they are no longer needed for the request, relationship, or legal record, or until you request deletion where applicable.
• Transaction records: Apple and Lullay may retain entitlement and transaction records as needed for billing, fraud prevention, tax, accounting, and legal compliance.

Deletion from Lullay does not automatically cancel an App Store subscription. Cancel the subscription separately in your Apple subscription settings. Providers such as Apple and OpenAI may retain information under their own legal obligations and retention schedules. Residual copies may remain temporarily in protected backups until those backups cycle out.

10. Your privacy rights and choices

Depending on where you live, you may have rights to:

• know whether we process your personal information and obtain access to it;
• request a portable copy;
• correct inaccurate information;
• delete information;
• withdraw consent or object to certain processing;
• opt out of sale, targeted advertising, or certain sharing—although Lullay does not engage in those practices;
• appeal a denied privacy request; and
• make a complaint to the privacy or data-protection authority where you live.

The iOS app and web beta provide export and deletion controls where available. You can also email [email protected]. We may need to verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law, but we may ask for proof of authorization and may verify the request directly with you. We will not discriminate against you for exercising a privacy right.

11. Children and caregiver authority

The Services are for adults. You must be at least 18 or the age of legal majority where you live. Children may not create an account or intentionally use Nana.

By providing information about a child, you confirm that you are the child’s parent or legal guardian or are otherwise authorized by the parent or guardian to provide the information and use the Services for that child. Babysitters and other caregivers must have the parent’s or guardian’s permission.

We do not knowingly solicit personal information directly from children. If you believe a child has created an account, intentionally spoken to Nana without adult involvement, or provided personal information without appropriate authorization, contact [email protected]. We will investigate and delete information where required.

12. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encrypted network connections, Apple platform protections, access controls, pseudonymous account identifiers in the native backend, and data-minimization rules for analytics. No service can guarantee absolute security. Keep your device, Apple account, web-beta credentials, and email account secure, and contact us if you suspect unauthorized access.

13. International processing

Lullay Labs and its providers may process information in Canada, the United States, and other countries where our providers operate. Those countries may have privacy laws different from the laws where you live. Where required, we use contractual and other safeguards intended to protect information transferred across borders.

14. Third-party services and links

The Services may link to Apple, healthcare, crisis, educational, or other third-party resources. Their privacy practices apply to information you provide directly to them. This Policy does not govern third-party services that Lullay Labs does not control.

15. Changes to this Policy

We may update this Policy as the Services, vendors, or law change. We will post the revised Policy with a new effective date. If a change materially affects how we use sensitive information, we will provide additional notice in the app, by email, or through another reasonable channel before the change takes effect where required.

16. Contact us

Questions, requests, or complaints may be sent to:

Lullay Labs — Privacy Lead

[email protected]

For general support: [email protected]

For urgent product-safety concerns: [email protected]