Privacy Policy LuluLabs Inc. ("Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act ("PIPA") of the Republic of Korea, in order to protect the personal information of data subjects and to promptly handle related grievances.
Article 1
Purposes of Processing Personal Information
The Company processes personal information solely for the following purposes. If a purpose changes, the Company will obtain consent in advance.
- 1. Account creation and authentication — using an email address and social login identifier to create an account and verify identity.
- 2. Care logging — storing feeding, sleep, diaper, play, health, and pumping records and presenting them as lists and statistics.
- 3. Personal rhythm prediction (DreamCue) — using the baby's sleep and feeding records and corrected age to predict the next sleep time and nap window, and presenting it in the app card, home screen widget, lock screen, and notifications.
- 4. Growth and development tracking — plotting weight, height, and head circumference against World Health Organization and Fenton reference curves, and presenting developmental milestones and vaccination schedules.
- 5. Family sharing — sharing a baby's records with family members invited by the user.
- 6. Paid subscription management — verifying subscription status to grant access to paid features.
- 7. Service reliability — diagnosing application errors in order to fix defects.
- 8. Service notices — sending emails required to operate the service, such as family invitations and account verification.
Article 2
Categories of Personal Information Processed
- 1. Information entered by the user
[Required]
- Account: email address, social login identifier (Apple or Google)
- Baby information: name (or nickname), date of birth, sex, gestational weeks and days at birth, birth weight, multiple-birth status, vaccination schedule country
- Care records: feeding (time, type, amount, side), sleep (start and end time), diaper (time, type), play (time, type), pumping (time, amount)
[Optional]
- Display name shown when inviting family members
- Baby information: birth length, birth head circumference, date of arrival home
- Growth measurements: weight, height, head circumference
- Developmental milestone checks, vaccination records
- Notes attached to each record
- 2. Information generated or collected automatically
- App usage records (screen entries, feature usage times)
- Device information (operating system version, app version, device model)
- Error diagnostic information (time of error, error message, call path)
- 3. Information the Company does not collect
- Location information
- Advertising identifiers (such as IDFA)
- Contacts, photo library, call logs
- Unique identifiers including resident registration numbers
- 4. Audio in the cry analysis feature
Cry analysis is processed entirely on the device. Recorded audio is never transmitted to or stored on any server, and is deleted immediately after analysis.
Article 3
Processing of Sensitive Information
The Company treats the following as sensitive information (health information) under Article 23 of PIPA and processes it only with separate consent.
- Health records: body temperature, medication, hospital visits, symptoms
- Gestational weeks and birth weight (used to determine preterm or low-birth-weight status)
- Growth measurements (weight, height, head circumference)
Purpose: corrected age calculation, growth curve display, health record review
Retention: until account withdrawal
How consent is obtained: at sign-up, as a separate item distinct from the Terms of Service and this Privacy Policy.
Because this service is built on predicting sleep rhythm from corrected age and plotting growth curves, it cannot be provided without the above information. This consent is therefore required, and the service cannot be used without it. To withdraw consent, delete your account under "Settings > Delete account" in the app or contact privacy@lululabs.ai.
Article 4
Processing and Retention Periods
- Account information and care, growth, and health records: until account withdrawal
- Operational database: permanently deleted immediately upon withdrawal
- Encrypted backups: retained for disaster recovery and automatically destroyed within 30 days of withdrawal. If a backup is restored, data belonging to withdrawn members is deleted again immediately.
- Error diagnostic information: 90 days from collection
- Information retained under statute
- Records on contracts and withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
- Records on payment and supply of goods: 5 years (same Act)
- Records on consumer complaints or dispute resolution: 3 years (same Act)
- Service access logs: 3 months (Protection of Communications Secrets Act)
Article 5
Provision to Third Parties
The Company does not sell personal information to third parties and does not provide it for advertising purposes.
When a user invites family members through the family sharing feature, that baby's records are shared with those members. This occurs solely at the user's direction, and invitations and members can be revoked at any time within the app.
Where a statute so provides, or where an investigative agency makes a lawful request, the Company complies accordingly.
Article 6
Entrustment of Processing
The Company entrusts the processing of personal information as follows, and the entrustment agreements set out requirements for the secure management of personal information.
| Processor | Entrusted work | Categories processed |
|---|
| Supabase Inc. | Account authentication, database storage | Account information, baby information, care, growth, and health records |
| RevenueCat, Inc. | Paid subscription status | Account identifier, subscription status |
| Functional Software, Inc. (Sentry) | Application error diagnostics | Device information, error diagnostic information |
| Resend, Inc. | Transactional email delivery | Email address |
| Apple Inc. | App Store payment, social login | Payment information (the Company does not retain card numbers), login identifier |
| Google LLC | Social login | Login identifier |
Each processor receives only the minimum information necessary for its work. Any change to the entrusted work or processors will be disclosed through this Privacy Policy.
Article 7
Overseas Transfer of Personal Information
The Company transfers personal information overseas as follows.
| Recipient | Country | Categories | Time and method of transfer | Purpose | Retention |
|---|
| Supabase Inc. | United States (data stored in the Amazon Web Services Seoul region, ap-northeast-2) | Account information, baby information, care, growth, and health records | Transmitted over the network as the service is used | Account authentication, data storage | Until account withdrawal |
| RevenueCat, Inc. | United States | Account identifier, subscription status | Transmitted when subscription status is checked | Paid subscription management | Destroyed without delay after subscription ends |
| Functional Software, Inc. (Sentry) | United States | Device information, error diagnostic information | Transmitted when an error occurs | Application error diagnostics | 90 days |
| Resend, Inc. | United States | Email address | Transmitted when email is sent | Transactional email delivery | Destroyed without delay after sending |
| Apple Inc. | United States | Payment information, login identifier | Transmitted at payment and login | App Store payment, social login | Per Apple's policy |
| Google LLC | United States | Login identifier | Transmitted at login | Social login | Per Google's policy |
You may refuse the overseas transfer of your personal information. However, these transfers are essential to providing the service, so refusal means the service cannot be used. Please send any refusal to privacy@lululabs.ai.
Article 8
Destruction Procedure and Method
- Procedure: personal information is destroyed without delay once the retention period expires or the processing purpose is achieved. Upon a withdrawal request, data is deleted immediately from the operational database, and encrypted backups are automatically destroyed within 30 days.
- Method: electronic files are permanently deleted by means that make recovery and reproduction impossible.
- Self-service: users can execute this directly from "Settings > Delete account" in the app.
- Information that must be retained under statute is moved to separate storage and destroyed after the statutory period.
Article 9
Rights of Data Subjects and Legal Representatives, and How to Exercise Them
You may exercise the following rights at any time.
- 1. Right to access
- 2. Right to rectification
- 3. Right to erasure
- 4. Right to suspension of processing
- 5. Right to data portability
How to exercise
- Directly in the app: Settings > Delete account (erasure), Settings > Export data (access and portability)
- Email: privacy@lululabs.ai
- Post: LuluLabs Inc., 2F J801, 47 Gangnam-daero 112-gil, Gangnam-gu, Seoul, Republic of Korea
- Response time: within 10 days of receipt
For the personal information of children under the age of 14, a legal representative may exercise the above rights on the child's behalf.
Right to data portability
You may request that your personal information be transmitted to another personal information controller.
- Transferable categories: account information, baby information, care records (feeding, sleep, diaper, play, health, pumping), growth measurements, vaccination and development records
- Format: CSV
- Method: download directly from "Settings > Export data" in the app, or email privacy@lululabs.ai specifying the destination
- Response time: within 10 business days of the request
- Checking transfer status and history: recent export history is available on the "Settings > Export data" screen; for email requests, the Company replies with the outcome.
Article 10
Processing of Personal Information of Children Under 14
Users (members) of this service are caregivers of a baby. Children under the age of 14 may not register as members.
However, the baby information entered by a member constitutes the personal information of a child under 14. The Company processes it on the basis that it is entered and provided directly by the member as the child's legal representative, and the legal representative may at any time request access, rectification, erasure, or suspension of processing of the child's personal information. The methods are the same as in Article 9.
The Company does not use children's personal information for advertising or marketing, and does not sell or provide it to third parties.
Article 11
Automated Decision-Making
The Company carries out automated decision-making using personal information as follows.
DreamCue sleep rhythm prediction
- Criteria: the baby's sleep records (start and end times), feeding records, corrected age (calculated from date of birth and gestational weeks), and recently observed wake windows
- Procedure: (1) the user enters records; (2) the personal rhythm (wake window, night start and end) is derived from recent records; (3) it is compared against age-based reference ranges; (4) the next sleep time and recommended window are computed; (5) the result is presented in the app card, widget, lock screen, and notifications
- Method: rule-based statistical computation. No machine learning model is used, and user data is not used to train any model.
- Use of training data: none
- Nature of the decision: this prediction is guidance for reference only and is not a medical judgment. It does not restrict any right or obligation of the user.
Your rights
- Explanation: you may request an explanation of the criteria and basis of a prediction; the Company replies within 15 days.
- Refusal: if you do not want automated prediction, you can turn off prediction guidance in "Settings > Notifications" in the app, and you may request that the prediction feature be stopped by emailing privacy@lululabs.ai.
- Human review: you may request re-processing with human involvement; the Company notifies you of the outcome within 30 days of completion (extendable up to 60 days where justified, with the reason provided).
Article 12
Installation and Operation of Automatic Collection Devices, and Refusal
This service is provided as a mobile application and does not use web cookies. The Company does not collect advertising identifiers (IDFA), does not serve personalized advertising, and does not collect behavioral information.
App usage records and device information are used only for service operation and error diagnostics. Device-level tracking can be refused under iOS "Settings > Privacy & Security > Tracking".
Article 13
Measures to Ensure Safety
Administrative measures
- The Company establishes and implements an internal management plan for personal information.
- The number of personnel handling personal information is kept to a minimum, and access rights are limited to what each role requires.
- Personal information processing is reviewed periodically.
Technical measures
- Encryption in transit: HTTPS/TLS
- Protection at rest: database Row-Level Security restricts access to the account holder and invited family members.
- Access control: only authenticated accounts can access data; family invitations use short-lived, single-use links bound to an authenticated recipient account, and unauthenticated invitation lookups are not permitted.
- Retention of access logs and protection against forgery and alteration
- Encrypted storage of backups
Physical measures
- Servers storing personal information are located in the data centers of the processor (Supabase, Amazon Web Services Seoul region) and are subject to that facility's access control and disaster-preparedness systems.
Article 14
Chief Privacy Officer and Grievance Handling
Company information
- Name: LuluLabs Inc.
- Representative: Naejin Hyeon
- Business registration number: 571-87-03951
- Address: 2F J801, 47 Gangnam-daero 112-gil, Gangnam-gu, Seoul, Republic of Korea
The Company designates a Chief Privacy Officer who takes overall responsibility for personal information processing and handles complaints and remedies for data subjects.
Chief Privacy Officer
- Name: Naejin Hyeon
- Title: Chief Executive Officer
- Phone: +82-70-8064-4177
- Email: privacy@lululabs.ai
Grievance handling
- Team: Customer Support
- Email: support@lululabs.ai
- Response time: within 10 days of receipt
Article 15
Department Receiving and Handling Access Requests
You may submit a request for access under Article 35 of PIPA to the following. The Company will endeavor to process access requests promptly.
- Department: Privacy Office (reporting directly to the Chief Executive Officer)
- Email: privacy@lululabs.ai
- Response time: within 10 days of receipt
Article 16
Responsibility of the Business Owner and Representative
The Company's representative bears ultimate responsibility for personal information processing, secures qualified personnel for personal information protection, and provides the necessary budget. The Company ensures that the Chief Privacy Officer can perform their duties independently.
Article 17
Notification of Data Breach
Where the Company becomes aware of, or of circumstances suggesting, the loss, theft, leakage, forgery, alteration, or damage of personal information, it will notify data subjects without delay of the following.
- 1. The categories of personal information affected
- 2. When the incident occurred and how
- 3. Steps data subjects can take to minimize harm
- 4. The Company's response measures and remedial procedures
- 5. The department and contact details for reporting harm or seeking consultation
- 6. How to claim damages and apply for dispute mediation
Where an incident exceeds the scale prescribed by statute, the Company will also report it to the Personal Information Protection Commission or the Korea Internet & Security Agency.
Article 18
Remedies for Infringement of Rights
You may apply to the following bodies for dispute resolution or consultation regarding infringement of personal information.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
- National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)
A person whose rights or interests are infringed by a disposition or omission of the Company in response to a request under Articles 35, 36, or 37 of PIPA may file an administrative appeal under the Administrative Appeals Act.
Article 19
Changes to this Privacy Policy
This Privacy Policy applies from its effective date. Where content is added, deleted, or amended due to changes in law or in the service, the Company will give notice within the app from seven days before the change takes effect.
Revision history
- March 6, 2026: initial adoption
- July 14, 2026: updated the processor list and access-control description
- August 5, 2026: full revision. Added sensitive information processing, overseas transfer, data portability, children under 14, automated decision-making, the department receiving access requests, representative responsibility, and breach notification; restructured safety measures into administrative, technical, and physical measures.
Effective Date: August 5, 2026