Privacy policy

Draft text — to be validated by a qualified lawyer before any commercial launch. This document describes how the service is intended to operate. It has not yet been legally validated, it may change, and the items in square brackets remain to be completed.

Working version of 1 October 2026.

1. Data controller

The data controller is [to be completed: company name and address]. Contact for any question about your data: privacy@babyyouway.com. Data protection officer: [to be completed, where applicable].

A data protection impact assessment must be finalised before the service opens: [to be completed: reference and date].

2. The data we process

Account: email address, password (stored only as a hash, never in plain text), date of birth, country of residence, language.
Profile: first name or pseudonym, photos, introduction, intentions and pathways, approximate region, languages, timeline, expectations. You set the visibility of each piece of information.
Optional sensitive information: gender identity and orientation. They are never mandatory, are only recorded with your explicit and separate consent, are encrypted where they are free text, and are deleted if you withdraw that consent.
Exchanges: contact requests and messages. Messages are encrypted in our database.
Verification: status, type of verification, dates and the provider's reference. BabyYouWay keeps neither identity documents nor facial templates.
Subscription: plan, status and dates. Payment card data is processed solely by the payment provider.
Security: sessions, technical logs with no intimate content, IP address in pseudonymised form to limit abuse.
Waiting list: email address, country, pathway and language, in order to let you know when a pathway opens.

Your date of birth stays private: only your age can be displayed. Your exact location is never public. Location data contained in your photos is removed.

3. Why we process it

To provide the service (performance of the contract): account, profile, search, contact requests, messaging, subscription.
To protect members (legitimate interest and legal obligations): moderation before publication, prevention of fraud and spam, handling of reports, account security.
With your consent, which you can withdraw at any time in your settings: sensitive information, use of that information in suggestions, AI translation, verification by selfie comparison where it is offered, news emails.
To meet our obligations: accounting, responses to legal requests.

[to be completed: legal bases to be confirmed by legal counsel for each country in which the service is marketed]

4. Artificial intelligence

Moderation: photos and public text are analysed automatically before publication. Ambiguous cases are reviewed by a person; reasons are given for a rejection and you can ask for a human review. No permanent exclusion is decided by an automated system alone.
Translation: it is optional. No message is sent to the translation provider without your prior consent. The original message is never altered and remains available. Translations are indicative, particularly for medical and legal terms.
Suggestions: they are based on explainable criteria (compatible intentions, shared languages, timeline…). There is no score for fertility, health or personal worth.
Reuse of your data to train models: prohibited. [to be completed: contractual commitment of each processor]

5. Who can see your data

Other members: only what you have made visible, once your profile has been approved and published. Profiles and messages are neither public nor indexed by search engines.
Our team: it reviews content submitted for moderation and the specific items of a report. It does not read conversations freely. Exceptional access to a conversation requires a reasoned request, approved by a second person, limited in time and recorded in an audit log.
Our processors: no processor has been contractually appointed at this stage. The list will be published here before the service opens: hosting [to be completed], sending of emails [to be completed], payment [to be completed], AI moderation and translation [to be completed], age and identity verification [to be completed].
Transfers outside the European Union: [to be completed once the processors have been chosen].

Your data is neither sold nor used for advertising. No sensitive data is passed to audience measurement or advertising tools.

6. How long we keep it

Account and profile: for as long as your account exists. Deleting the account erases your profile, your photos, your sensitive information and the content of your messages.
Items of a report made against you: kept in encrypted form and for a limited period (twelve months by default), even if you delete your account, so that deletion cannot be used to erase evidence of abuse. The account is then anonymised, and deleted when the period expires.
Originals of rejected photos: thirty days, to allow time for a possible appeal.
Export file of your data: available for seven days.
Technical copies of emails sent: thirty days. Notifications: six months.
Audit log: twenty-four months by default.
Payment events: kept without identity, for the duration of accounting obligations [to be completed].
Verification media: not kept by BabyYouWay; retention period at the provider [to be completed].

[to be completed: final retention schedule, validated with the impact assessment]

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time.

Export your data: from your privacy settings, you obtain a downloadable file.
Delete your account: from your settings, with immediate effect, subject to the retention exceptions described above.
Withdraw a consent: from your settings. Withdrawal stops the processing concerned and deletes the data that depended on it.
Ask for a human review of a moderation decision.

You can also write to privacy@babyyouway.com. If you believe that your rights are not being respected, you can lodge a complaint with the data protection authority in your country, for example the CNIL in France.

8. Security

Exchanges with the site are encrypted. Messages and sensitive free-text information are encrypted in the database. Photos are stored in a private space and served through temporary links. Team accounts are protected by two-factor authentication and their sensitive actions are logged.

9. Minors

The service is strictly for adults only. If we learn that a minor has created an account, it is closed.

10. Cookies

Only strictly necessary cookies are used. See the cookie policy.

11. Changes

This policy is versioned. In the event of a significant change, you are informed before it comes into force.