Sabinitty | Tu Diario de Maternidad

Last updated: April 26, 2026

This Privacy Policy explains how S.R. Arguello Durán, trading as Pikkakola, a sole proprietorship (eenmanszaak) registered in Almere, the Netherlands, collects, uses, and protects your personal data when you use Sabinitty, our pregnancy and family wellness application.

We are committed to complying with the European General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the Dutch Uitvoeringswet AVG (UAVG).

1. Data Controller

S.R. Arguello Durán
P.S. Gerbrandypad 24, 1314 NL, Almere, the Netherlands
BTW-identificatienummer: NL584683741B01
Contact: privacy@sabinitty.com

2. Data We Collect

Category	Data	Lawful Basis (GDPR Art. 6)
Account Data	Name, email address, hashed password	Contract performance (Art. 6(1)(b))
Payment Data	Processed by Stripe. We do NOT store card numbers.	Contract performance (Art. 6(1)(b))
Usage Data	Generation counts, feature usage, login timestamps	Legitimate interest (Art. 6(1)(f))
Your Content	Journal entries, letters, photos, milestones and notes you create	Contract performance (Art. 6(1)(b))
Health Data (special category)	Pregnancy tracking, appointments, symptoms, weight, blood pressure, baby logs	Explicit consent (Art. 6(1)(a) + Art. 9(2)(a))

3. How We Use Your Data

To provide and improve our services
To process subscription payments via Stripe
To personalize your pregnancy and parenting experience
To send transactional emails (billing, account changes)
To comply with legal obligations (tax records under KOR)

We do NOT sell your data. We do NOT use your data for third-party advertising. We do NOT share your health or family data with other users.

4. Data Processors (Sub-processors)

Processor	Purpose	Location
Supabase Inc.	Database, authentication	EU (Frankfurt)
Vercel Inc.	Hosting, CDN	EU (available regions)
Stripe Inc.	Payment processing	EU/US (EU data residency available)
Google (Gemini API)	AI-powered features (premium, when enabled)	EU/US
OpenAI (GPT)	AI-powered features (premium, when enabled)	US

For US-based processors, data transfers are protected under the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs).

5. Data Retention

Account data: Retained while your account is active. Deleted within 30 days of account deletion.
Your content: Retained while your account is active. Deleted upon account deletion.
Payment records: Retained for 7 years as required by Dutch tax law (Algemene wet inzake rijksbelastingen).
Audit logs: Retained for 12 months for security purposes.

6. Your Rights (GDPR Articles 15-22)

You have the right to:

Access your personal data (Art. 15) — available via your account settings
Rectify inaccurate data (Art. 16) — editable in your profile
Erase your data (Art. 17) — "Delete Account" in settings triggers full deletion
Port your data (Art. 20) — export available in account settings
Object to processing (Art. 21) — contact us at privacy@sabinitty.com
Withdraw consent at any time without affecting prior processing

We respond to all data subject requests within 30 days as required by GDPR.

7. Cookies

We use essential cookies required for authentication and session management (Supabase auth tokens). Any non-essential analytics cookies are used only with your consent, which you can give or refuse via our cookie banner. We do not use advertising cookies.

8. Security Measures

All data encrypted in transit (TLS 1.3) and at rest
Row-Level Security (RLS) on all database tables
Rate limiting and payload size restrictions on all API endpoints
Service role keys never exposed to the client

9. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children under 16. If we become aware of such collection, we will delete the data immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect.

11. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl

12. Contact

For any privacy-related questions or to exercise your rights, contact: privacy@sabinitty.com