PRIVACY NOTICE

Last updated June 07, 2026

French version: Politique de confidentialité en français

This Privacy Notice for Setty PON (doing business as Ysea) ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services").

Questions or concerns? Contact us at yseaapp_services@outlook.com.

1. DATA CONTROLLER

Setty PON, operating under the trade name Ysea
Email: yseaapp_services@outlook.com

2. WHAT DATA WE COLLECT

Account data

Email address and password (hashed by Supabase Auth)
Profile photo (optional)

Child profiles

Child's name, gender, date of birth
Expected due date (pregnancy profiles)
Child's profile photo (optional)

Daily face photos

The app offers an optional daily face photo feature to track the child's growth over time. These photos are stored on our servers (Supabase, EU region) and are never shared with third parties. You can delete individual photos at any time from the app.

Journal entries

Text, photos, audio recordings, and videos you add
GPS location data (optional): When enabled, your geographic coordinates are attached to journal entries to remember where a memory took place. This data is never used for advertising or behavioral tracking purposes.
User-defined tags

AI assistant usage

Messages sent to the assistant
Daily message usage counter

Subscription data

Purchases are managed by RevenueCat and the app stores (App Store / Google Play). We do not store your payment card details.

3. HOW WE USE YOUR DATA

To provide and operate the Services (account, profiles, journal, assistant)
To personalize AI responses with your child's context
To manage subscriptions and storage quotas
To send administrative notifications (security, policy updates)
To ensure security and prevent fraud

4. DATA SHARING AND INTERNATIONAL TRANSFERS

We do not sell your personal information. We work with the following processors:

Supabase (database and authentication)

All your data is stored with Supabase, hosted in the European Union (West EU Ireland region). Supabase is subject to EU data protection regulations.

RevenueCat (subscription management)

RevenueCat processes subscription information (user ID, tier, purchase history). Headquartered in the United States. Transfer governed by Standard Contractual Clauses (SCCs) approved by the European Commission.

Anthropic (AI assistant) — Transfer outside the EU

When you use the AI assistant, your child's name, age, gender, and profile, along with your message, are transmitted to Anthropic PBC (United States) to generate the response.

This transfer is governed by the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). Anthropic does not use your data to train its models and does not retain this data beyond the processing of the request.

Anthropic Privacy Policy: anthropic.com/privacy

5. DATA RETENTION

Active data: retained for as long as your account is active.
After account deletion: all your data (profiles, journal, photos, recordings) is deleted within 30 days.
Subscription data: retained by RevenueCat in accordance with their legal and tax obligations.
Security logs: retained for a maximum of 90 days for security purposes.

6. YOUR RIGHTS (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right of access (Art. 15): obtain a copy of your data.
Right to rectification (Art. 16): correct inaccurate data.
Right to erasure (Art. 17): delete your data — directly from Settings → Delete my account.
Right to data portability (Art. 20): receive your data in a structured format — from Settings → Export my data.
Right to object (Art. 21): object to processing based on legitimate interests.
Right to restriction (Art. 18): request temporary suspension of processing.
Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights: yseaapp_services@outlook.com

You also have the right to lodge a complaint with your local supervisory authority (in France: CNIL).

7. SECURITY

We implement appropriate technical and organizational measures to protect your data: TLS encryption in transit, per-user data isolation (Row Level Security), randomized access tokens for stored files, API keys server-side only.

No system is completely secure. In the event of a data breach affecting you, we will notify you in accordance with Article 34 of the GDPR.

8. CHILDREN'S DATA

Ysea is designed for parents and legal guardians. The app collects data about children (profile, photos, development milestones) at the direction of the parent who creates the account. This data is never used for commercial or advertising purposes.

If you believe data about a child has been collected without your consent, please contact us immediately.

9. COOKIES

The Ysea mobile app does not use cookies. Data is stored locally on your device (AsyncStorage) solely for app functionality (session, language preferences, notifications).

10. POLICY UPDATES

We may update this policy periodically. For material changes, we will notify you through the app. The last updated date is shown at the top of this document.

11. CONTACT

yseaapp_services@outlook.com