Privacy Policy

Rawdly | Operated by Nabucore Tech SARL
Effective Date: 4 April 2026
Last Updated: 15 October 2026
Version: 1.3

---

This Privacy Policy applies to the Rawdly website accessible at https://rawdly.com, the Rawdly web application for daycare administrators and staff at https://app.rawdly.com, and the Rawdly Parent mobile application available on the Apple App Store and Google Play Store (collectively, the "Platform" or the "Service").

---

Table of Contents

1. About Us
2. Scope and Application of This Policy
3. Definitions
4. Data Controller Information
5. Categories of Personal Data We Collect
6. How We Collect Personal Data
7. Legal Bases for Processing Personal Data (GDPR)
8. Purposes for Which We Use Your Personal Data
9. Children's Data, Special Provisions
10. Cookies, Tracking Technologies, and Remarketing
11. Third-Party Services and Processors
12. International Data Transfers
13. Data Retention
14. Data Security
15. Your Rights Under GDPR and UK GDPR
16. Your Rights Under CCPA and CPRA (California Residents)
17. Your Rights Under CalOPPA
18. Marketing Communications and Remarketing Opt-Out
19. Third-Party Links and Integrations
20. Changes to This Privacy Policy
21. Contact Us and Privacy Inquiries

---

1. About Us

Rawdly is a Software-as-a-Service (SaaS) platform built for daycare and childcare centre management. The Platform enables daycare operators, authorised staff, and parents or guardians to manage daily attendance, activity records, child profiles, staff accounts, and operational workflows through a unified web and mobile application.

The Platform is developed and operated by Nabucore Tech SARL, a company registered in Morocco.

For all privacy-related enquiries, please contact us at: contact@rawdly.com

---

2. Scope and Application of This Policy

This Privacy Policy describes how Nabucore Tech SARL ("Rawdly", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you:

• Access or use the Rawdly website at https://rawdly.com;
• Use the Rawdly web application for daycare administrators and staff at https://app.rawdly.com;
• Download and use the Rawdly Parent mobile application on iOS or Android devices;
• Register for or subscribe to the Rawdly service in any capacity (administrator, daycare staff, or parent/guardian);
• Interact with our remarketing communications or advertising content on third-party platforms.

This Policy applies to all users of the Platform, including daycare administrators, staff members, and parents or guardians who have been granted access by an authorised operator. The intended users of the Platform are adults only. The Platform does not solicit, invite, or knowingly accept direct registrations from minors.

This Policy does not apply to the independent data practices of third-party services or websites to which we may link. We encourage you to review the privacy policies of any third-party services you access independently.

---

3. Definitions

---

4. Data Controller Information

Nabucore Tech SARL acts as the Data Controller with respect to personal data processed through the Platform.

Registered Legal Name: Nabucore Tech SARL
Registered Address: Av Mansour Dahbi, Imm Figuige 14, Bur 3, Kénitra, Morocco
Country of Registration: Morocco
Website: https://rawdly.com
Privacy Contact: contact@rawdly.com

Where daycare operators use the Platform to manage data about their staff and the children enrolled in their care, those operators may independently act as Data Controllers for their own processing activities. In such cases, Rawdly acts as a Data Processor pursuant to a binding service agreement.

---

5. Categories of Personal Data We Collect

5.1 User Identification Data

• First name and last name
• Email address
• Phone number

5.2 Account and Access Data

• Login credentials (stored exclusively as a cryptographic hash; plaintext passwords are never stored or logged)
• User role and access permissions within the Platform (e.g., administrator, staff member, parent/guardian)

5.3 Children's Operational Data

The following data is entered into the Platform exclusively by authorised adult users, daycare staff or verified parents/guardians, acting in their professional or parental capacity:

• Child's first and last name
• Child's date of birth and age group
• Attendance records (check-in and check-out times)
• Daily activity logs and developmental notes
• Daily care records, such as meals and how much was eaten, naps, diaper changes and moods
• Incident reports, which can describe injuries or other health-related events
• Summaries, translations and other content created from these records with the help of artificial intelligence (AI) services (see Section 11.6)
• Whether a parent or guardian has consented to AI features for the child, and when consent was given or withdrawn
• Associated parent or guardian contact details

This category of data is treated with heightened sensitivity and is subject to the specific safeguards described in Section 9 of this Policy. Enrolled children are not users of the Platform, do not interact with it directly, and do not provide any personal data to us themselves.

5.4 Billing and Payment Data

When you subscribe to a paid tier of Rawdly, payment transactions are processed by Paddle, which acts as our Merchant of Record and authorised third-party payment processor. We do not directly collect, store, or process full payment card numbers, CVV codes, or bank account details. We may retain records of transaction identifiers, subscription tier, billing cycle, and payment status for accounting and support purposes.

5.5 Technical and Usage Data

The following technical data is automatically collected when you access and use the Platform:

• IP address
• Device type, model, and operating system
• Browser type and version
• Session identifiers and authentication tokens
• Feature usage logs and navigation patterns
• Application crash and error reports, including device and app details (see Section 11.7)
• Time-stamped access logs

5.6 Communications Data

Content of support requests, feedback submissions, or correspondence sent to us via email or in-app channels.

5.7 Voice Recordings

When a daycare staff member chooses to dictate an incident report in the Rawdly web application, we record and store the audio and send it to Groq to be transcribed (see Section 11.6). A recording contains the speaker's voice and anything they say, including names and details of the incident. The Rawdly Parent mobile application does not record audio.

---

6. How We Collect Personal Data

6.1 Direct Input by Users

Personal data is collected directly from you when you:

• Register for a Rawdly account;
• Complete your user profile or organisation settings;
• Enter child or staff records into the Platform as an authorised operator or parent/guardian;
• Dictate or type an incident report in the Rawdly web application, as a daycare staff member;
• Accept or withdraw consent to AI features in the Rawdly Parent application, as a parent or guardian;
• Submit a support request or communicate with us via email;
• Complete a subscription or billing action.

6.2 Automatic Collection via Tracking Technologies

When you access the Platform, certain technical and behavioural data is collected automatically through:

• Session and authentication cookies, to maintain logged-in sessions and user preferences;
• Analytics tools, including Google Analytics, which collect aggregated data about Platform usage, user flows, and feature engagement;
• Heatmaps and session recordings, Microsoft Clarity, which records how you click, scroll and move through pages of the Rawdly website and the Rawdly web application, with on-screen content masked as described in Section 11.1. Clarity runs only if you accept analytics cookies;
• Crash reporting, Sentry, which receives technical reports when the Rawdly Parent application crashes or encounters an error, and can also receive error reports and performance data from the Rawdly web application and our servers (see Section 11.7);
• Remarketing pixels and tracking scripts, including pixels from Google Ads, Facebook/Meta, and TikTok, which are used to measure advertising effectiveness and enable remarketing campaigns;
• Security services, Google Invisible reCAPTCHA, which processes behavioural signals to distinguish human users from automated bots, without requiring user interaction.

For full details on cookies and tracking, please refer to Section 10 of this Policy.

6.3 From Third-Party Advertising Platforms

We may receive limited engagement data (such as ad click events or conversion signals) from Google Ads, Facebook/Meta, and TikTok when you interact with our advertisements on those platforms.

---

7. Legal Bases for Processing Personal Data (GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, we have conducted a balancing assessment and determined that such interests are not overridden by the rights and freedoms of data subjects. You may request further information about any such assessment by contacting contact@rawdly.com.

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

---

8. Purposes for Which We Use Your Personal Data

8.1 Provision and Operation of the Service

To create, activate, and manage your account; to authenticate your identity and authorise access to permitted features; to deliver core Platform functionality including attendance tracking, activity management, and reporting; and to provide technical support and respond to service enquiries.

8.2 Payment Processing and Subscription Management

To manage your subscription, process billing events through Paddle, maintain records of subscription status, and handle renewals, upgrades, or cancellations.

8.3 Transactional and Service Communications

To send account verification emails, password reset instructions, billing confirmations, system notifications, and other communications necessary to deliver the Service. These communications are delivered via Resend and are not marketing in nature. They cannot be fully opted out of while maintaining an active account.

8.4 Security, Fraud Prevention, and Platform Integrity

To detect and prevent unauthorised access, fraudulent activity, abuse of the Platform, or violations of our Terms of Service. We use IP addresses, login logs, reCAPTCHA signals, and behavioural data to identify suspicious activity and protect user accounts and enrolled children's data.

8.5 Product Improvement and Analytics

To understand how users interact with the Platform, identify usability issues, measure feature adoption, diagnose technical errors, and improve the overall product experience. Analytics are conducted using aggregated and, where possible, pseudonymised data via Google Analytics. If you accept analytics cookies, we also use Microsoft Clarity heatmaps and session recordings to see how pages are used and where they are hard to use (see Section 11.1). We use Sentry to receive crash and error reports so that we can find and fix technical problems (see Section 11.7).

8.6 Remarketing and Targeted Advertising

To serve targeted advertisements to prospective and existing users on Google Ads, Facebook/Meta, and TikTok, including the use of conversion tracking pixels. This processing is based on your consent, which may be withdrawn at any time (see Section 18).

8.7 Legal and Regulatory Compliance

To comply with applicable laws and regulations, respond to lawful requests from public authorities or courts, enforce our Terms of Service, and exercise or defend legal claims.

8.8 AI-Assisted Features

To write daily and weekly summaries of a child's day and week for parents and guardians, to translate those summaries into the language a parent or guardian chooses, to help staff transcribe and draft incident reports, to create illustrated and narrated story books, to suggest curriculum activities to staff, and to translate chat messages and other text on request. These features use the third-party AI services described in Section 11.6. Summaries and translations created from a child's records are produced only with the consent of the child's parent or guardian (see Section 9.6).

---

9. Children's Data, Special Provisions

9.1 Nature and Source of Children's Data

Rawdly is a daycare management platform, and the processing of operational data pertaining to enrolled children is a core function of the Service. This data is entered exclusively by adult users, specifically authorised daycare staff or verified parents/guardians, acting in their professional or parental capacity.

Enrolled children are not users of the Platform, do not create accounts, and do not provide personal data to Rawdly directly or independently. We do not solicit, encourage, or knowingly collect data directly from children.

9.2 Who May Enter Children's Data

Children's data may only be entered into the Platform by:

• Daycare administrators and staff acting in their professional capacity at a licensed daycare centre operating under a Rawdly subscription; or
• Parents or guardians who have been explicitly invited and authorised by the relevant daycare operator to access their child's records through the Rawdly Parent application.

9.3 Access Controls and Data Minimisation

Access to children's data within the Platform is governed by a role-based access control system:

• Only users with an explicitly assigned role (administrator, staff, or verified parent/guardian) may access children's records;
• Parent and guardian accounts are strictly limited to records relating to their own children only;
• Administrators may not grant Platform access to unverified third parties;
• We collect only the operational data necessary to deliver the daycare management features described in this Policy.

9.4 Parental Rights Regarding Children's Data

Parents and guardians retain the right to access, correct, or request the deletion of data held about their child within the Platform, subject to the legitimate operational requirements of the relevant daycare centre. Requests may be submitted to contact@rawdly.com or directed to the daycare operator managing the relevant account.

9.5 Prohibition on Advertising Use of Children's Data

Children's operational data (as defined in Section 5.3) is strictly prohibited from use in any advertising, profiling, remarketing, or marketing activity. This data is fully isolated from all advertising and analytics pipelines and is used exclusively in connection with the operational management features of the Platform.

9.6 Use of Artificial Intelligence (AI) Services

Rawdly sends an enrolled child's records to a third-party AI service, Groq, to write daily and weekly summaries and to translate summaries, only after a parent or guardian of that child has agreed in the Rawdly Parent application. For this processing we rely on that consent (GDPR Art. 6(1)(a)), given by the parent or guardian on the child's behalf. Section 11.6 lists which data each service receives for these features. These records can show that a child was unwell or hurt, for example a "sick" mood or an incident note, and are sent as recorded.

• What you are told: the consent screen names each AI provider, what it does and the categories of data it receives, and links to this Policy.
• Who can consent: consent is given from a parent or guardian account that the child's daycare centre has linked to the child, and it counts only while that link is active. Consent is recorded separately for each child, and one parent's or guardian's consent covers the child. Rawdly can also record a consent that a parent or guardian gives outside the application, for example in writing; such a consent is not tied to an account link and counts until it is withdrawn.
• Saying no: if you choose "Not now", you do not give consent, and AI summaries (daily and weekly) and translations stay off for your child unless another parent or guardian of the child accepts.
• Checks: Rawdly checks for consent before each summary or translation is started, including when daycare staff start a summary and when summaries are created automatically. For weekly summaries, consent is checked when daycare staff start the summaries for the week.
• Withdrawing consent: you can withdraw consent at any time in the Rawdly Parent application under Profile > Privacy & Security > AI summaries and translations. If any parent or guardian of a child withdraws, no new AI summaries or translations are created for that child until a parent or guardian accepts again. Withdrawal does not affect processing carried out before it, and summaries that already exist remain available. To ask for existing summaries to be deleted, contact your daycare centre or us at contact@rawdly.com.
• Changes: if we add an AI provider or a category of data to these features, we will ask for consent again before using it.
• Records: we keep a record of each consent and withdrawal so that we and the daycare centre can show what was agreed and when.

Some staff tools also use AI services but are not covered by this consent, because they send what a staff member dictates or types rather than the child's stored records: incident report drafting, story books and curriculum suggestions (see Section 11.6). Staff may still mention a child in what they dictate or type, and incident reports can include health information such as injuries. The translation of chat messages and other text on request, described in Section 11.6, is not covered by this consent either.

The AI features produce text, translations, illustrations and audio. They are not used to make decisions about a child or a family.

---

10. Cookies, Tracking Technologies, and Remarketing

10.1 What Are Cookies

Cookies are small text files stored on your device when you access the Platform. We also use related technologies such as pixel tags, web beacons, and local storage objects (collectively, "tracking technologies").

10.2 Categories of Cookies We Use

Strictly Necessary Cookies
Essential for the Platform to function. They enable user authentication, session management, and security controls. These cookies cannot be disabled without significantly impairing service functionality.

Examples: session tokens, CSRF protection cookies, Google Invisible reCAPTCHA signals.

Functional and Preference Cookies
Allow the Platform to remember your settings and preferences, such as language or UI configuration.

Analytics Cookies
Collect information about how you use the Platform to help us understand usage patterns and improve the product experience. These cookies are set only if you accept analytics cookies.

Services used: Google Analytics, Microsoft Clarity.

Microsoft Clarity sets two first-party cookies: _clck, which holds a random Clarity user identifier and lasts about one year, and _clsk, which links the pages you view in one visit into a single recording and lasts about one day. Microsoft may also set third-party cookies on its own domains, such as clarity.ms and bing.com (CLID, MUID, ANONCHK, MR and SM), which Microsoft uses to recognise a browser across websites that use Clarity and across Microsoft sites (Microsoft, Clarity cookies).

Remarketing and Advertising Cookies
Placed by our advertising partners to track your engagement with our advertising content and enable targeted or remarketing campaigns. These technologies may track activity across multiple websites and platforms.

Services used: Google Ads (conversion tracking and remarketing), Meta Pixel (Facebook and Instagram), TikTok Pixel.

10.3 Managing Your Cookie Preferences

When you first access the Platform, you will be presented with a cookie consent notice through which you may accept, reject, or customise your cookie preferences (with the exception of strictly necessary cookies). You may update your preferences at any time through the cookie settings interface accessible from the Platform.

You may also manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For further guidance, visit www.allaboutcookies.org.

10.4 Do Not Track

Some browsers transmit a "Do Not Track" signal. As there is no universally accepted standard for responding to such signals, the Platform does not currently modify its data collection practices in response to Do Not Track browser signals.

---

11. Third-Party Services and Processors

We engage the following third-party service providers acting as data processors on our behalf. Our use of each provider is governed by our agreement with that provider.

11.1 Analytics

Microsoft Clarity. Clarity starts only after you accept analytics cookies in the cookie consent notice, and stops if you withdraw that consent (see Section 18.3). It records how you interact with each page: clicks, taps, scrolling, mouse movement, the layout of the page and the web address of each page you view, together with your browser, device and screen details and your IP address, which Microsoft uses to estimate your location. Microsoft turns this into heatmaps and session recordings that we can replay. Rawdly does not send your name, email address or account to Clarity, so recordings are not linked to your Rawdly account. We always tell Clarity that consent to advertising storage is denied.

• Rawdly web application (app.rawdly.com): everything on screen is masked, so recordings show the layout of each page and where you clicked and scrolled, but no text, images, links or values typed into forms. Page web addresses can contain the internal identifier of a record, such as a child profile, but not the record's content. Clarity does not run on password reset pages, on the checkout page, or on any page whose web address contains details other than the selected tab, chart metric or checkout result, such as a search term.
• Rawdly website (rawdly.com): what you type into forms and the options you choose in drop-down menus are masked. Other page content, such as headings and buttons, can appear in recordings. Clarity does not run on the enrolment application and document signing pages, which can contain children's details.

Under Clarity's terms of use, Microsoft may also use the data it collects through Clarity for its own purposes, including to improve its products and services and for advertising, as described in the Microsoft Privacy Statement. For that use, Microsoft may act as an independent data controller. Retention is described in Section 13.

The Rawdly Parent mobile application does not include an analytics or advertising software development kit (SDK), and Microsoft Clarity is not used in it. Firebase is used only to deliver push notifications (see Section 11.8).

11.2 Email Delivery

Resend receives the recipient's email address and the content of each message. It does not have access to our databases. Some messages contain children's operational data: for example, the weekly summary email names the child and the daycare centre in its subject line and contains the AI-written summary of the child's week (see Section 11.6). Parents and guardians who turn off email notifications do not receive these emails.

11.3 Security

11.4 Payment Processing

All payment card data is processed directly by Paddle in accordance with PCI-DSS standards. Rawdly does not store, transmit, or have access to full card numbers or sensitive authentication data.

11.5 Remarketing and Advertising Platforms

These advertising platforms may independently act as data controllers in relation to data collected through their pixels and tags. We encourage you to review their respective privacy policies directly.

11.6 Artificial Intelligence Providers

Some Rawdly features use third-party artificial intelligence (AI) services to write or translate text, transcribe speech, or create illustrations and audio. Rawdly uses these services for the features described below. They return the result to us, and we store it in Rawdly with the daycare centre's other records (see Section 13). No photos or videos of children are sent to any AI service.

Features that use a child's records (only with a parent's or guardian's consent)

These features run for a child only after a parent or guardian of that child has accepted the AI consent in the Rawdly Parent application. See Section 9.6 for how consent works and how to withdraw it.

• Daily summary (Groq): the child's first name, the date, the check-in time, the type of each meal and how much was eaten, the total nap time, the type and title of up to three activity notes, and the number of diaper changes. A summary can be requested by a parent or guardian or by staff, or created automatically after the child is checked out.
• Translation of a summary (Groq): the text of the summary, which includes the child's first name, when a parent, guardian or staff member asks to read it in another language. When a parent or guardian changes their summary language, the summaries of the last seven days are also translated. Translations are stored, so the same summary is not sent again.
• Weekly summary (Groq): started by daycare staff. The child's first name, the week, the days attended, meals (type, how much was eaten and the food items), naps (quality and length), the types of diaper changes, and activity notes with the child's mood. The summary is stored and emailed to the child's parents and guardians (see Section 11.2).

For these features we do not send the child's last name or date of birth, or the allergy and medical records held in Rawdly. Activity note titles and food items are sent as staff wrote them, and note types, moods and the types of diaper changes are sent as recorded. They can show that a child was unwell or hurt, for example a "sick" mood, a toileting accident or an incident note.

Staff tools (not covered by the parental consent)

These tools are used by daycare staff in the Rawdly web application. They send what the staff member dictates or types, not the child's stored records.

• Incident report drafting (Groq): a staff member can dictate or type an account of an incident and select the children involved. Dictated audio is sent to Groq for transcription as recorded. The transcript or typed account, and the type of incident, are then sent to Groq to draft the report. Before this step, Rawdly replaces the names of the selected children with placeholders (such as "Child 1") wherever it recognises them, and puts their full names back after the draft is returned. Names spelled differently from the child's record, very short names, nicknames and the names of other people are not replaced. Everything else in the account is sent as written, including descriptions of injuries. Rawdly stores the audio, the transcript, the draft and the final report. The notification that the parents and guardians of each child involved receive about an incident can include the AI-drafted summary of what happened, which can name the children involved.
• Story books (Groq, Replicate and OpenAI): a staff member enters either a title, an age, a main character's name, a theme, a lesson and any extra instructions, or a title and a free-text description of the story. These are sent to Groq to write the story. The story text, what the staff member entered and descriptions of the story's characters are then sent to Replicate to create the illustrations. For the audio narration, the story text is sent to Groq if the story is written in English or Arabic, and to OpenAI if it is written in another language. Because staff write these details, they may enter a child's real first name. Selecting children for a book only controls which families can see it. Rawdly stores the pages, illustrations, PDF and audio.
• Curriculum suggestions (Groq): Groq receives the classroom's age band, the titles of the centre's activities and their learning-goal tags, and the classroom's overall learning-goal coverage. No information about individual children is sent.

Translation of messages and other text (not covered by the parental consent)

• Translation on request (Groq): when a signed-in user of a daycare centre asks Rawdly to translate a chat message or other text, Rawdly sends that text to Groq as written, including any names or other details it contains. Rawdly stores the translation.

How the AI providers handle data

According to each provider's published terms, as checked on 4 October 2026:

• OpenAI states that data sent to its API is not used to train its models unless the customer opts in, and that it keeps abuse-monitoring logs for up to 30 days (OpenAI, Your data).
• Groq states that by default it does not retain data from inference requests, but that it may keep inputs and outputs in temporary logs for up to 30 days to troubleshoot errors or investigate suspected abuse, unless Zero Data Retention is enabled. Groq stores any data it retains in Google Cloud in the United States (Groq, Your data). Under section 4.2 of its Services Agreement, Groq may not use inputs or outputs to train models unless the customer permits it (Groq Services Agreement).
• Replicate states that it removes API inputs, outputs, files and logs after one hour by default (Replicate, Data retention). The illustration model Rawdly uses on Replicate, OpenAI's GPT Image model, is run through OpenAI (Replicate, openai/gpt-image-1.5 API), so OpenAI also receives the illustration requests, and OpenAI's terms above, including abuse-monitoring logs for up to 30 days, may also apply to them.

11.7 Crash Reporting and Diagnostics

Rawdly Parent mobile application. Crash reporting is switched on only in released versions of the application, not in development builds. When the application crashes, stops responding or hits an unexpected error, it sends a report to Sentry's EU data region (Frankfurt, Germany). A report contains:

• the error and where in the application's code it happened;
• the application version, the device model, the operating system and its version, and device state such as memory, storage, battery and network type;
• a random identifier created for that installation of the application;
• a short trail of recent technical events, such as which on-screen elements were tapped (by component name, not by their text) and the method, address and result of recent network requests made by the application, without their parameters. These addresses can contain the internal identifier of a record, such as a child profile or a conversation, but not the record's content.

Sentry may also record when the application is opened and closed so that we can measure how often it crashes.

The application does not attach your name, email address, phone number or Rawdly account to reports. Sentry's option to send default personal information is switched off, and the application does not send screenshots, screen layouts, session recordings or performance traces. Reports of errors in the application's own code are also filtered on the device to remove email addresses, login tokens, cookies, request contents and web address parameters. Sentry receives the IP address of the device as part of the network connection when a report is sent.

Rawdly web application and servers. The Rawdly web application used by daycare staff and our servers can also send error reports to Sentry. Depending on the error, these reports can include the signed-in user's account identifiers and email address, IP address, browser and device details, and details of the request being handled, including its content, which may include data about children. Error reports from our servers' background tasks can include the data the task was working on, such as the activity records of a child whose summary was being written. The web application and our servers also send performance traces for a share of page loads and requests, which record, for example, which pages and server addresses were used and how long each step took. The web application can also record a replay of a share of sessions and of sessions in which an error occurs. In these replays all text and form inputs are masked and images and media are blocked.

Sentry stores event data for organisations in its EU region in Frankfurt, Germany, and keeps user accounts and some organisation metadata in the United States (Sentry, Data storage location). Retention is described in Section 13.

11.8 Push Notifications

To deliver notifications, these services receive a device token for your installation of the application and the content of each notification. Google also receives a Firebase installation identifier and basic device and app details, such as the device model, operating system version and app version. The visible text of a notification can include a child's name, the name of the person who sent a message and the first part of that message, an activity title, or a summary of an incident, which can give the full names of the children involved.

---

12. International Data Transfers

Nabucore Tech SARL is registered in Morocco. Certain third-party service providers listed in Section 11, including Google, Microsoft, Meta, TikTok, Paddle, Resend, OpenAI, Groq, and Replicate, are based in, or process data in, the United States or other countries that may not provide the same level of data protection as your country of residence.

For Microsoft Clarity and the AI and crash reporting providers described in Sections 11.1, 11.6 and 11.7, the locations are:

• Microsoft Clarity: Microsoft stores Clarity data in its Azure cloud service (Microsoft, Clarity FAQ) and may process it in the United States and in other countries where Microsoft or its service providers operate (Microsoft Privacy Statement).

• OpenAI and Replicate: both are based in the United States and may process data there or in other countries where they or their service providers operate. Replicate passes illustration requests to OpenAI (see Section 11.6).

• Groq: may process requests in any of its data centres, including outside the United States (Groq has announced data centres in the United States, Canada, Saudi Arabia and Finland: Groq, European data centre). Groq states that any data it retains is stored in Google Cloud in the United States.

• Sentry: crash and error reports from the Rawdly Parent application are stored in Sentry's EU data region in Frankfurt, Germany. Sentry keeps user accounts and some organisation metadata in the United States.

Where we transfer personal data internationally and applicable law requires a transfer safeguard, we rely on the safeguards recognised by that law, where available, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission and/or the UK Information Commissioner's Office (ICO);
• Adequacy decisions issued by the relevant supervisory authority, where applicable;
• Binding Corporate Rules or other approved transfer mechanisms where relevant.

You may request further information about the safeguards applicable to any specific international transfer by contacting us at contact@rawdly.com.

---

13. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including compliance with any legal, accounting, or regulatory obligations.

If you delete your account in the Rawdly Parent application, we anonymise it immediately: your name, email address, phone number and photo are removed, your sessions are ended, your links to children are deactivated, any AI consent you gave is withdrawn, and your messages, notifications, comments, feedback, preferences and device tokens are deleted. Invoices, payments, receipts and payment proofs, enrolment records, consent records, and security and audit logs are kept under the anonymised identity for the periods above. The IP address and browser details in audit logs are removed, but a security record of an account lockout after repeated failed sign-in attempts can still contain the email address used, and enrolment or admission documents the daycare centre keeps (such as signed forms) still show the names and contact details written on them. Accounts that belong to a daycare centre's team cannot be deleted in the application; contact us to close them.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data must be retained beyond the standard period for legal purposes, it is isolated from active use and restricted from further processing.

---

14. Data Security

We implement a comprehensive set of technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure.

14.1 Technical Measures

• Encryption in transit: All data transmitted between users and the Platform is protected using TLS 1.2 or higher (HTTPS) on all connections.
• Encryption at rest: Sensitive data stored in our databases, including user credentials and children's records, is encrypted at rest using industry-standard encryption algorithms.
• Password security: User passwords are stored exclusively as cryptographic hashes using a strong adaptive algorithm (such as bcrypt or Argon2). Plaintext passwords are never stored, logged, or transmitted.
• Role-based access control (RBAC): Access to personal data is restricted to authorised personnel or systems that require it for a defined operational purpose.
• Secure infrastructure: The Platform is hosted on managed cloud infrastructure with automated security patching, intrusion detection monitoring, and regular vulnerability assessments.
• API security: All API endpoints are protected by authenticated sessions, rate limiting, and input validation controls.

14.2 Organisational Measures

• Access to production systems and personal data is limited to authorised personnel on a strict need-to-know basis.
• All personnel with access to personal data are subject to confidentiality obligations.
• We conduct periodic reviews of our security practices and update our measures in response to emerging threats.
• In the event of a personal data breach likely to result in risk to individuals' rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach and will inform affected data subjects without undue delay where required by applicable law.

No method of electronic transmission or storage is completely secure. While we apply industry-standard safeguards, we cannot guarantee the absolute security of data transmitted to or through the Platform.

---

15. Your Rights Under GDPR and UK GDPR

If you are located in the European Union or the United Kingdom, you have the following rights in relation to your personal data, subject to applicable legal exceptions:

15.1 Right of Access

You may request a copy of the personal data we hold about you and information about how it is processed (a "Subject Access Request").

15.2 Right to Rectification

You may request that we correct inaccurate or incomplete personal data we hold about you.

15.3 Right to Erasure ("Right to be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is otherwise unlawful. This right is subject to exceptions where retention is required to comply with a legal obligation or to exercise or defend legal claims.

15.4 Right to Restriction of Processing

You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest its accuracy or where processing is unlawful and you prefer restriction to erasure.

15.5 Right to Data Portability

You may request your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.

15.6 Right to Object

You may object at any time to the processing of your personal data where we rely on legitimate interests. You also have an absolute right to object to processing for direct marketing purposes, including related profiling.

15.7 Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on you, except where necessary for a contract, authorised by law, or where you have given explicit consent.

15.8 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Parents and guardians can withdraw consent to the AI features described in Section 9.6 at any time in the Rawdly Parent application under Profile > Privacy & Security > AI summaries and translations, or by contacting us.

15.9 Right to Lodge a Complaint

If you consider that we have violated your data protection rights, you may lodge a complaint with the relevant supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO), https://ico.org.uk
• European Union: The supervisory authority in your EU member state of habitual residence, place of work, or place of the alleged infringement.

15.10 How to Exercise Your Rights

Submit a written request to:

Email: contact@rawdly.com
Subject Line: Data Subject Rights Request, [Right Being Exercised]

We will respond within 30 calendar days of receipt. Where complexity or volume necessitates an extension, we will notify you within the initial 30-day period, with a response deadline not exceeding a further 60 days.

We may request reasonable verification of your identity before processing your request.

---

16. Your Rights Under CCPA and CPRA (California Residents)

This section applies to residents of the State of California and supplements the rest of this Privacy Policy in accordance with the CCPA as amended by the CPRA, effective 1 January 2023.

16.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined under the CCPA:

We disclose personal information to service providers for the business purposes described in Section 11, including Microsoft Clarity, which records heatmaps and session recordings only if you accept analytics cookies (see Section 11.1), the AI providers (OpenAI, Groq and Replicate) and the crash reporting provider (Sentry) described in Sections 11.6 and 11.7. Some of this information concerns enrolled children (see Section 5.3). AI summaries and translations created from a child's records require the consent of the child's parent or guardian, which can be withdrawn at any time (see Section 9.6).

We do not sell personal information for monetary compensation. However, the sharing of personal information with advertising platforms (Google Ads, Facebook/Meta, TikTok) for remarketing purposes may constitute a "sale" or "sharing" under the CCPA/CPRA definition. You have the right to opt out of such sharing (see Section 18).

16.2 Your CCPA/CPRA Rights

As a California resident, you have the right to:

• Know, request disclosure of the categories and specific pieces of personal information we have collected, used, disclosed, or sold/shared about you.
• Delete, request deletion of your personal information, subject to certain exceptions.
• Correct, request that we correct inaccurate personal information we maintain about you.
• Opt Out, opt out of the sale or sharing of your personal information for cross-context behavioural advertising.
• Limit Use of Sensitive Personal Information, where applicable, request that we limit the use and disclosure of sensitive personal information to permitted purposes only.
• Non-Discrimination, we will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge different prices, or provide a different level of service as a result of exercising these rights.

16.3 How to Submit a CCPA/CPRA Request

Email us at contact@rawdly.com with the subject line: CCPA Rights Request.

We will respond to verified requests within 45 calendar days. Where additional time is required, we will notify you of the extension (up to a further 45 days) and the reason for it.

You may designate an authorised agent to submit a request on your behalf. We may require written proof of the agent's authorisation and verification of your identity before processing such requests.

---

17. Your Rights Under CalOPPA

This section applies to California residents under the California Online Privacy Protection Act (CalOPPA), in effect since 1 January 2014.

In accordance with CalOPPA:

• Users may visit our website anonymously where technically possible.
• This Privacy Policy is accessible from the homepage of https://rawdly.com via a clearly labelled link.
• This Privacy Policy link includes the word "Privacy" and can be easily found on the page where it is listed.
• You will be notified of any material changes to this Privacy Policy via a notice on our website and/or by email, using the "Last Updated" date displayed at the top of this document.
• You can update your personal information by logging into your account settings or by contacting us at contact@rawdly.com.

Regarding Do Not Track signals: as noted in Section 10.4, the Platform does not currently alter its data collection practices in response to Do Not Track browser signals, as no uniform standard for responding to such signals has been established.

---

18. Marketing Communications and Remarketing Opt-Out

18.1 Transactional Emails

Service-related emails (account verification, password resets, billing confirmations, system notifications) are necessary for the operation of the Service and cannot be unsubscribed from while you maintain an active account.

18.2 Remarketing Opt-Out

If you wish to opt out of targeted or remarketing advertising through our advertising platforms, you may do so through the following mechanisms:

• Google Ads: Visit https://adssettings.google.com or install the Google Analytics Opt-Out Add-on at https://tools.google.com/dlpage/gaoptout
• Facebook / Meta: Adjust your ad preferences at https://www.facebook.com/ads/preferences
• TikTok: Manage ad settings within the TikTok app or visit https://www.tiktok.com/legal/privacy-policy
• Network-wide opt-out: Visit the Digital Advertising Alliance portal at https://optout.aboutads.info or the NAI portal at https://optout.networkadvertising.org

Opting out of personalised advertising does not mean you will stop seeing advertisements altogether; it means advertisements shown to you will be less tailored to your inferred interests.

18.3 Withdrawing Cookie Consent

You may withdraw consent for non-essential cookies at any time by accessing the cookie settings interface on the Platform. Withdrawal applies prospectively and does not affect data already collected.

If you withdraw consent to analytics cookies, Microsoft Clarity stops recording, Google Analytics stops using analytics cookies, and we delete their cookies on our own domains, including Clarity's _clck and _clsk. We cannot delete cookies that Microsoft set on its own domains; you can remove them in your browser settings. To learn how Microsoft handles data collected through Clarity, and how to exercise your rights with Microsoft, see the Microsoft Privacy Statement at https://privacy.microsoft.com/privacystatement.

---

19. Third-Party Links and Integrations

The Platform may contain links to third-party websites, services, or integrations that are not operated or controlled by Rawdly. This Privacy Policy applies solely to the Platform. We have no responsibility for, and make no representations regarding, the privacy practices or content of any third-party websites or services. We encourage you to review the privacy policy of any third-party service before providing personal information to it.

---

20. Changes to This Privacy Policy

We reserve the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the features of the Service. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document;
• Post a prominent notice on the Platform; and/or
• Where appropriate, send a notification to the email address associated with your account.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated terms. We encourage you to review this Policy periodically.

Record of Changes

---

21. Contact Us and Privacy Inquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact us:

Nabucore Tech SARL
Av Mansour Dahbi, Imm Figuige 14, Bur 3
Kénitra
Morocco

Email: contact@rawdly.com
Website: https://rawdly.com

We are committed to resolving privacy-related concerns promptly and transparently. If you are not satisfied with our response, you retain the right to escalate your concern to the relevant data protection supervisory authority as described in Section 15.9 of this Policy.

---

This Privacy Policy was last reviewed and updated on 4 October 2026. Previous versions are available upon request.