Privacy policy

VertiTech Innovations, LLC, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States, controls the personal information described in this policy. For questions, privacy requests, or concerns about data use, email [email protected].

Nurtumi is not a health care provider, insurer, or emergency service. Family information is protected under this policy and applicable privacy and security laws.

This policy covers Nurtumi's marketing website, the web application under /app, operational communications, and related features. It does not cover third-party services a person opens outside Nurtumi that have their own terms.

Nurtumi is intended exclusively for adults who have the capacity and authority to care for the children whose data they record. Children may not create accounts or use Nurtumi directly.

We process only information reasonably necessary to provide, protect, and improve the requested service. The specific information depends on the features each person chooses to use.

• Account and profile: name, email, protected credentials, language, time zone, units, preferences, and account status.
• Family and children: a baby's name or family identifier, birth date, sex, avatar, feeding preferences, authorized members, and invitations.
• Family records and content: sleep, awakenings, feeding, routines, experiments, assessments, goals, notes, ratings, selected health signals, assistant questions, and educational progress.
• Use and deliverables: plans, metrics, recommendations, reports, private files, share links, courses, audio, notifications, and consent choices.
• Technical and security data: IP address, browser, device, operating system, session or installation identifiers, time zone, approximate network-derived location, activity, errors, and audit logs.
• Commerce and communications: customer and purchase identifiers, plan, payment status, access period, tax, invoices, email delivery events, and support requests. Stripe processes full payment card details; Nurtumi does not store them.
• Analytics and campaigns: controlled usage events, campaign parameters, and measurement identifiers only when required consent exists.

Information comes from the account holder, other caregivers the account holder authorizes in a family, the browser or device, and providers that carry out requested functions such as authentication, payments, email, or notifications. We also generate metrics and summaries from submitted records.

Anyone who adds information about a child or another person confirms they have sufficient authority to do so and that the information is relevant to shared care. Each member should avoid recording unnecessary third-party data.

We use information to create and maintain accounts; organize family records; enable authorized collaboration; calculate metrics; provide content, plans, and tools; process memberships; send operational communications; provide support; prevent fraud and abuse; maintain security; comply with legal obligations; and defend rights.

Depending on where a person lives, these activities rely on performance of the requested contract, compliance with legal obligations, legitimate interests such as security and limited service improvement, and consent where required by law. Consent supports optional categories such as analytics or marketing, device notifications, and AI-assisted wording, and sensitive information where applicable.

Consent may be withdrawn at any time without affecting prior processing. Withdrawal may disable the related optional feature, but core metrics and deterministic educational guidance remain available without AI.

With specific consent, Nurtumi may send OpenAI a question and limited structured context—such as approximate age, aggregate metrics, a plan, and editorial content—to draft an answer or summary. Nurtumi seeks to exclude direct names, free-form notes, and health signals from these requests. Health signals first trigger a deterministic response and are not sent to the AI provider.

Calculations, permissions, and safety rules remain under Nurtumi's control; AI does not write directly to the database or make decisions with legal or similarly significant effects. Its responses may be incomplete or inaccurate and are educational support, never a diagnosis, prescription, or emergency instruction.

Lesson narration may be generated with AI from editorial scripts that contain no family personal information.

We do not sell the contents of family records or health signals, and we do not use that content for targeted advertising. We may disclose the minimum necessary information to contractually bound providers, including MongoDB for databases, Vercel for hosting and files, Resend for email, Stripe for payments, Cloudflare for abuse prevention, OpenAI for consented AI features, and browser providers for web push.

Google Tag Manager and, when configured, Google or Meta services activate only for authorized non-essential categories. With marketing consent, registration and purchase events sent to Meta may include SHA-256-transformed email and account ID, IP address, user agent, measurement identifiers, conversion type, currency, amount, and technical purchase ID. They do not include children's names or identifiers, family records, notes, questions, or health signals.

We also disclose information to expressly authorized family members; recipients of private links a person chooses to create; when required by law, valid process, or security needs; to investigate abuse or protect rights; or in a business reorganization subject to appropriate safeguards. A share link grants access to anyone who possesses it until it expires or is revoked.

VertiTech Innovations, LLC operates from the United States and some providers may process information in other countries. Where required, we use recognized transfer mechanisms such as adequacy decisions, standard contractual clauses, or other appropriate safeguards.

Other countries' rules and authorities may differ from those in a person's place of residence. You may request more information about applicable safeguards through the contact email.

We retain product data while the account is active and as needed to provide requested features. Account deletion disables access and opens a 30-day recovery window. When that window ends, product data is permanently deleted through the operational process, except for records we must retain for legal, payment, fraud prevention, security, or claims purposes.

Technical session contexts are scheduled for deletion 90 days after a session expires or is revoked; technical email delivery events are retained for up to 90 days; invitations and share links have their own expiration periods. Restricted backup copies, where they exist, may remain until their ordinary overwrite cycle.

Deleting an account cannot retrieve copies someone else downloaded and does not by itself revoke information shared outside Nurtumi. Report links can be revoked through the service while the account and link remain available.

We apply reasonable technical, administrative, and organizational measures appropriate to the information, including family access controls, protected sessions, encrypted push subscriptions, expiring links, and minimization of data sent to providers. No internet-connected system can guarantee absolute security.

Each person supports security by using a unique password, protecting devices, signing out of shared devices, checking who they invite, and promptly revoking access or links that are no longer appropriate. Please notify us without delay if you suspect unauthorized use.

When a security incident triggers a legal notification duty, we will notify affected people and authorities in the form and time required.

Within Nurtumi, you can correct parts of the profile, manage family access, withdraw AI consent, configure notifications, control non-essential cookies, revoke links, and request account deletion. You may also contact us to request access, correction, deletion, portability, restriction, or objection, or to withdraw consent, as available under applicable law.

We may request reasonable information to verify identity, authority over the child, and the request's scope. We will respond within the legal period and explain any limitation. We will not discriminate against a person for exercising legally recognized rights.

People in the European Economic Area or United Kingdom may complain to their local data protection authority. Where a U.S. state law provides it, there may also be a right to appeal a decision or use an authorized agent. If you believe a request was not properly resolved, use “Privacy appeal” in the email subject.

Nurtumi is designed for an adult to manage information about a child in their care; it is not directed to children and does not knowingly collect information directly from them. The account must belong to an adult and must not be handed over to a child.

If we learn that a child created an account or directly provided information without required authorization, we will take reasonable steps to delete it or apply the legally required process. Anyone who identifies such a situation may contact us.

We may update this policy to reflect changes in the product, providers, or legal requirements. We will post the new date and, for material changes, provide reasonable notice or request fresh consent where appropriate.

For any privacy question or request, email [email protected] or write to VertiTech Innovations, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States.