Nurta – Privacy Policy

Effective Date: 01 July 2025
Last Updated: 01 July 2025

1. Introduction

Nurta is a mobile application owned and operated by Uosipa, Inc. ("Nurta," "we," "our," "us"). Nurta helps parents and caregivers track their baby’s sleep, feeding, growth and daily activities. This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you use Nurta (the "Products").

By creating an account or using the Products you acknowledge that you have read and understood this Privacy Policy. If you reside outside the United States, you agree that your data may be processed in the United States and other countries whose privacy laws may be less protective than those in your jurisdiction.

2. Key Definitions

Term	Meaning
Personal Data / Personal Information	Any information that can identify, relate to, describe or be reasonably linked to an individual (e.g., name, email, IP address).
Children’s Data	Personal data relating to a child under 13 years (US COPPA) or, where applicable, under 16 years (GDPR Art. 8).
Anonymous / De-identified Data	Data altered so it can no longer reasonably identify an individual.
Controller	The entity that determines the purposes and means of processing (Uosipa, Inc.).
Processor	Third parties that process data on our behalf (e.g., cloud hosting).

3. Who We Are & Contact Details

Uosipa, Inc.
1111B S Governors Ave, STE 23093
Dover, DE 19904, USA

Representative: Daria Konavalova
Company phone: +1 (740) 272-5886
Data Protection Officer (DPO): privacy@uosipa.com
EU/UK Article 27 representative: privacy@uosipa.com

All contact details are current and were verified on 01 July 2025.

4. Information We Collect

4.1 Information You Provide

Parent / Guardian

Full name or nickname
Email address and hashed password / SSO token
Notification preferences

Child

Name or nickname
Date of birth and age
Gender (optional)
Weight, height (optional)
Sleep events (bedtime, wake-time, nap duration)
Feeding data (time, quantity, breast/bottle/solid)
Activities (play, bathing, outdoor time) and notes you choose to enter
Support messages & surveys – content of emails, in-app chats or survey responses

4.2 Automatically Collected Data

Device information (model, OS, language, time-zone)
App interactions (screen views, taps, crash logs)
IP address, date/time stamps, and coarse location derived from IP
Cookies and similar technologies on our public website only (see § 10)

4.3 Sensitive Data We Do Not Collect

Exact geolocation, camera images, biometric templates, or audio recordings, unless you explicitly enable a feature that requires them.

5. Legal Bases for Processing (GDPR/UK GDPR)

Purpose	Legal Basis
Account registration & core tracking features	Performance of a contract (Art. 6 (1)(b))
Parental consent for Children’s Data	Consent (Art. 6 (1)(a) + Art. 8)
Product analytics & troubleshooting	Legitimate interest (Art. 6 (1)(f)) – we balance against user rights per EDPB Guidelines 1/2024
Compliance with US/EU laws and tax obligations	Legal obligation (Art. 6 (1)(c))

We do not rely on “selling” or “sharing” data (CCPA §§ 1798.140). We never use Children’s Data for targeted advertising.

6. How We Use Data

Display personalised dashboards of your baby’s sleep, feeding and growth.
Send reminders and push notifications that you enable (e.g., "next nap in 30 min").
Provide customer support and respond to your requests.
Improve and secure the Products through aggregated analytics and error reports.
Generate de-identified statistics for research on infant sleep (published only in aggregate). See PMC 7864397.

We do not use data to train external AI models or for behavioural advertising.

7. How & With Whom We Share Data

Recipient	Purpose	Safeguards
Google Cloud Platform (USA)	Primary hosting & backup	Data Processing Addendum, encryption at-rest & in-transit, SOC 2
Firebase Analytics & Crashlytics (USA/EU)	Aggregated app diagnostics	IP-masking, pseudonymised IDs
Firebase Cloud Messaging / Apple APNs	Push notifications	Device token only (no personal data)
Payment processor (Stripe)	Subscription fees	PCI-DSS compliant; we never store full card numbers

Processors may access data solely to perform services for us and are contractually forbidden to use it for their own purposes.

We may also disclose data:
(a) when required by law or valid legal process,
(b) to protect the rights, property or safety of Nurta or others,
(c) in connection with a corporate transaction (e.g., merger). Any successor entity will be bound by this Policy.

8. International Transfers

EU-US & UK-US Data Privacy Framework certification for Google services (see bluewhaleapps.com).
Standard Contractual Clauses (SCCs) with all processors.
Additional technical measures (TLS 1.3, AES-256, access controls).

9. Data Retention

Active account data – retained until you delete your account.
After deletion – erased from live systems within 30 days; encrypted backups purged within 90 days.
De-identified analytics – retained indefinitely.

Parental email addresses used solely for consent under COPPA are deleted once verifiable consent is confirmed. See FTC COPPA FAQs.

10. Cookies & Tracking Technologies

Our mobile apps do not use cookies. The public website uses only:

Essential cookies – required for navigation and security.
Analytics cookies (Google Analytics 4 IP-masking) – help us understand traffic in aggregate.

You can disable non-essential cookies via the cookie banner or browser settings. The site honours Global Privacy Control (GPC) signals to opt out of analytics for California and Colorado residents. We do not respond to legacy Do Not Track (DNT) headers because we do not track users across third-party sites.

For more on kids’ privacy and tracking, see the Wired article and AP News coverage.

11. Security Measures

TLS 1.3 encryption for all data-in-transit.
AES-256 encryption at-rest (database & object storage).
Role-based access, MFA for staff accounts, logging and audits.
Annual penetration tests and continuous vulnerability scanning.
Incident response plan: notify affected users + regulators within 72 hours of a breach (GDPR Art. 33).

For additional tips on securing baby-monitoring apps see StaySafe.org guidelines.

12. Your Rights & Choices

12.1 EU/UK Residents

You have the right to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Submit requests in-app or at privacy@uosipa.com. We respond within 30 days.

12.2 US States (CA CPRA, VA VCDPA, CO CPA, CT CTDPA, UT UCPA)

Know what personal information we collect.
Request deletion.
Correct inaccuracies.
Opt out of processing of sensitive personal data.
Limit use/disclosure of data for advertising (which we do not engage in).

Appeal instructions will accompany any denial.

12.3 Managing Your Data

Edit or delete account: Settings > Account.
Email preferences – opt-in/out of newsletters and promotions. Transactional messages (e.g., password resets) are mandatory.
Cookie settings – via banner or browser preferences.

13. Children’s Privacy & Parental Consent

Nurta is intended for use by parents/guardians, not children. We collect Children’s Data only from the parent or caregiver who creates the account. Under COPPA we:

Obtain verifiable parental consent before any collection.
Provide direct notice of our practices.
Allow parents to review, delete or refuse further collection at any time.

We do not enable child-to-parent social features, nor do we serve behavioural ads to children. For more, see the FTC COPPA Compliance Plan.

14. Changes to This Policy

We may update this Policy periodically. If we make material changes, we will notify you via:

In-app banner and/or email at least 5 calendar days before they take effect.
Posting the new version with a new "Last Updated" date.

Your continued use after the effective date means you accept the revised Policy. If you disagree, you may delete your account at any time.

15. Contact Us

Questions, concerns, or requests?

Email: privacy@uosipa.com
Address: Uosipa, Inc., 1111B S Governors Ave, STE 23093, Dover, DE 19904, USA
Phone: +1 (740) 272-5886