BabyMix Privacy Policy

1. Who processes your data

The data controller is Secure Online Managements SL, VAT ESB01794866, registered at C/ Creueta 20, 08870 Sitges (Barcelona), Spain ("we", "us"). Write to support@som.company about anything in this policy or about your rights.

This policy covers the Android app BabyMix (com.babymix.app) and the service behind it. It does not cover Google Play, your system gallery, or any app you choose to share a result with.

2. One-page summary

3. What we process, why, and on what legal basis

3.1 Session identifiers

The first time you open the app, your phone generates a random identifier (installId, a UUID v4) and stores it in Android's encrypted storage. That identifier travels to our server together with a Play Integrity verdict (section 3.2), and in return you get a session token (JWT) and an internal account identifier (userId).

• What we store: installId, userId, the account creation date and, if your phone sends one, an optional device identifier (deviceId). In the current version the Android app sends no deviceId; the server accepts one because other apps on the same backend use it.
• Why: to identify your account without forcing you to register, to keep your credit balance, and to attach your generations to someone.
• Legal basis: performance of a contract (GDPR art. 6(1)(b)). Without an identifier there is no way to know whose credits these are or who to hand the result to.

Abuse-prevention identifier. So that the 3 free welcome credits cannot be claimed over and over by deleting the account, we keep a separate row holding a SHA-256 hash of the install (or device) identifier. That row deliberately survives account deletion and contains only the app identifier and the hash: no photos, no balance, nothing that describes you. Legal basis: legitimate interest in preventing fraud (GDPR art. 6(1)(f)).

3.2 Play Integrity

Before creating a session we ask Google for a Play Integrity verdict about the installation and the device, and verify it against the Google Play Integrity API.

• What we store: the verdict as text (for example PLAY_RECOGNIZED,MEETS_DEVICE_INTEGRITY) and the time it was obtained.
• Why: to stop tampered installs and emulators from minting free credits in a loop. Without a valid verdict no session is created and no credits are granted.
• Legal basis: legitimate interest in preventing fraud (GDPR art. 6(1)(f)).
• Technical note: the integrity token is bound to your installId through a hash (base64url(sha256(installId))), so a token is useless for another installation.

3.3 The photos you upload

This is the most sensitive data we handle and the one with the strictest treatment.

Before it leaves your phone. The app checks the photo on the device with ML Kit (Google's offline face detection) to confirm there is a face, that it is frontal and that there is enough light. A photo that fails that check is never uploaded anywhere. The app also downscales the image to at most 1536 px on the long edge and re-encodes it as JPEG before uploading, so we never receive your camera original.

The upload. The photo is uploaded straight from your phone to our storage on Cloudflare R2 through a signed URL, capped at 10 MB and limited to JPEG, PNG or WebP. Each file is stored under a path that contains the app identifier and yours, and only your session can refer to it.

Moderation. Every input photo goes through automated moderation before any AI provider is called (section 4).

Generation. To produce the result we hand the AI provider a signed URL valid for one hour that it uses to download the photo, plus the generation instructions. The provider receives none of your identifiers, none of your balance, and none of our storage credentials (section 5).

How long they live. Input photos are deleted automatically after 24 hours. Results and intermediate files follow the rules in section 6.

• Why: to generate exactly what you asked for, and nothing else.
• Legal basis: performance of a contract (GDPR art. 6(1)(b)). Uploading is a deliberate act on your part: we do not browse your gallery, you pick each file in the system photo picker and only that file reaches us.
• What we do not do: we do not train models on your photos, we do not use them to improve our prompts, we do not sell them, we do not show them to anyone else, and we do not build a profile of you or a face database out of them.

Face recognition. BabyMix does not identify or recognise you: we keep no database of known faces to match against, and photos are never used to authenticate anyone. The "similarity %" feature compares the generated baby against the two photos of that same job and returns two percentages; the intermediate data of that comparison is not retained. Even so, we treat photos with the caution of special-category data: they delete themselves, they never leave the purpose you uploaded them for, and you can remove them whenever you want.

3.4 The generated results

We store the image (or the 5-second video) the model produces, together with the technical record of the job: template used, chosen parameters (sex, age, mix), which provider answered, duration, credit cost, whether it carries a watermark, and the similarity percentages.

The free version is served already watermarked by the server: the app never receives an unwatermarked image you have not paid for.

Results are deleted automatically after 24 hours (free) or 7 days (paid). The technical job record, with no files left attached to it, is kept for up to 30 days so credit disputes can be settled, and is then removed.

3.5 "My photos" lives on your phone

When you keep a result, the app stores it in the app's private storage, in a local SQLite database. That gallery does not sync, is not copied to our server, and we cannot see it. Uninstall the app or clear its data and it is gone. If you also tap "Save in HD" or "Save video", the file is copied into your phone's system gallery, where it is yours to manage.

Android cloud backup and device-to-device transfer are disabled for this app, so none of that local data is copied to another phone or to Google's servers on your behalf.

3.6 Credits and purchases

Purchases happen inside Google Play, through RevenueCat. We never see or store your card or payment account details: Google handles them and tells us the outcome.

• What we store: the store transaction identifier, the product purchased (babymix_weekly, babymix_annual or babymix_pack_100), the status and period end, and the matching credit movements (grant, spend, refund) with their reason.
• Why: to give you what you paid for, to apply the consumption order and expiry rules, to stop the same purchase being credited twice, and to handle a dispute or a refund.
• Legal basis: performance of a contract (GDPR art. 6(1)(b)) and legal obligation for accounting and tax records (art. 6(1)(c)).

3.7 Rewarded ads

BabyMix shows only Google AdMob rewarded ads, and only when you tap the button to watch one in exchange for a credit. There are no banners, no interstitials and no app-open ads, in this version or any other.

When you finish watching an ad, AdMob sends us a signed server-side verification (SSV) callback containing your userId, an ad transaction identifier and the label babymix. We store that transaction identifier and a daily counter so the same credit is not granted twice and the limit of 3 ads per day holds.

Google AdMob is a controller for the advertising data it collects on its own account, including the Android advertising ID. The app declares the com.google.android.gms.permission.AD_ID permission because Google's and AppsFlyer's libraries require it (section 3.8). Google's policies are at https://policies.google.com/technologies/partner-sites, and your device's ad settings let you reset or delete that identifier.

EU advertising consent. In the European Economic Area, the United Kingdom and Switzerland, personalised advertising requires your prior consent. The app asks for it with Google's consent form (User Messaging Platform) when the app opens, before loading any ad and before turning on the campaign measurement of section 3.8: without your answer no ad is requested, and if you do not consent, the ad requested is non-personalised. You can review your choice later from Profile (privacy options).

3.8 Analytics, crashes and alerts

• Firebase Analytics. We log usage events (install, onboarding finished, photos uploaded, generation requested / finished / failed, result viewed, share, paywall viewed, purchase, rewarded ad, HD save). We can provide the exact list of events and their parameters on request. Every event carries three common parameters: the app identifier, the country, and whether you have an active plan. Events are joined to your account by setting Firebase's user_id to your userId. We never send to analytics: photos, signed URLs, storage keys, prompts, your installId, the session token, or the detailed reason behind a moderation rejection.
• Firebase Crashlytics. Crash reports: the exception trace, device model and OS version. Used to fix what breaks.
• Firebase Cloud Messaging. If you allow notifications, we store your device's messaging token so we can tell you a generation has finished. The message is data-only: it carries the job identifier and its status, and the app writes the notice in your language. The token is deleted with the account, and also when Google tells us it has expired.
• Firebase Remote Config. Remote configuration values (starting prices, test copy). It sends no personal data.
• AppsFlyer (campaign measurement). If you came to BabyMix from an ad, AppsFlyer tells us which campaign brought you, so we pay each ad network only for the installs it really delivers. When the app opens, its SDK receives Google Play's install referrer, the Android advertising ID, the AppsFlyer identifier of that install, the IP address, the device model, the OS and app versions, and your userId; after that it records each time the app is opened. RevenueCat reports trials, purchases and renewals with their amount to it, server to server, joined to that AppsFlyer identifier. If you came from an ad, AppsFlyer notifies the ad network that showed it (for example, AppLovin) of the install and of those purchases, with their amount and the advertising ID, so it can charge us for the install and optimise its campaigns. In the EEA, the United Kingdom and Switzerland AppsFlyer does not start without your consent in Google's form of section 3.7, and it stops if you withdraw it from the privacy options; elsewhere it runs from the first launch. It receives no photos, prompts or session token.
• Legal basis: legitimate interest in understanding how the product is used and keeping it running (GDPR art. 6(1)(f)); consent (art. 6(1)(a)) wherever local law requires it, through the form mentioned in section 3.7.

3.9 Approximate country

Our server derives a two-letter country code from the geographic header our network provider adds (for example cf-ipcountry), which is derived from the connection's IP address. We store it alongside the account.

• Why: to know which markets the app is used in, to honour the geographic limitation in section 13, and to detect abuse.
• What it is not: it is not your precise location. The app requests and uses no location permission, does not access GPS and records no coordinates.
• The app also sends analytics the region configured on your device, which is likewise country-level information.

3.10 Google Sign-In (optional)

You can link a Google account only if you want to recover your credits when changing phone. It is not required for anything else in the app.

If you do, we verify Google's token and store only the account's stable identifier (the token's sub claim). We do not store your email, your name or your profile picture: even though Google's token may contain them, our server discards them. Legal basis: performance of a contract (GDPR art. 6(1)(b)).

3.11 What we do not process

We neither ask for nor collect: name, surname, email, phone number, postal address, date of birth, contacts, calendar, SMS, call history, microphone, precise location, health data, or any list of installed apps. The app does not read your gallery: you pick each photo in the system picker and only that one arrives.

4. Automated moderation

No photo reaches an AI model without moderation first, and no result is served without a second pass.

• On input. Each photo is analysed with Sightengine for nudity, sexual content, violence and gore, and to estimate the apparent age of the faces. In the "mum" and "dad" roles, a face the classifier considers a minor causes the generation to be rejected automatically. If moderation rejects a photo, no AI provider is called and the credit is refunded; the app shows a neutral message without detailing what triggered the rejection.
• On output. The result is analysed again before it is stored anywhere the app can read it. Output moderation currently covers images; for generated videos the provider's video endpoint is still pending, which is why video is offered only with an active plan.
• If moderation cannot answer, the generation stops: we would rather fail and refund the credit than serve something nobody reviewed.
• What we store from this. Only a verdict keyed by a SHA-256 hash of the content, expiring after 24 hours, so the same image is not analysed (and paid for) twice. That row contains neither your identifier nor the photo.
• Generation parameters are closed. You pick sex, age and mix ratio from a list; there is no free-text field that reaches the model. The model instructions live on our server only and always fix a family-portrait context with the baby clothed.
• Legal basis: legitimate interest and compliance with Google Play policy and our child-safety obligations (GDPR arts. 6(1)(f) and 6(1)(c)).

5. AI providers

Generation runs on third-party models. Each call uses a single provider, with a fallback if the first one fails:

What they receive: a one-hour signed URL per input photo (which they use to download it) and the generation instructions. What they do not receive: your installId, your userId, your balance, your email, your country, or our storage credentials.

Our commitment, which must be reflected in the data processing agreement with each provider before the app ships: photos are used solely to produce your result, are never used to train or fine-tune models, and are not retained beyond what that call requires.

6. How long we keep each thing

7. Who we share with

We do not sell personal data. We share it only with providers that process it on our behalf and on our instructions, or where the law requires it.

We may also disclose data to competent authorities where a legal obligation exists, and to our advisers in the event of a claim.

8. International transfers

Some of those providers are outside the European Economic Area. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission, on an adequacy decision where one exists, or on the EU-US Data Privacy Framework where the provider is certified. Write to support@som.company for a copy of the applicable safeguards.

9. Security

• All traffic between the app and the service is encrypted with TLS. Release builds refuse plaintext HTTP outright through Android's network security configuration.
• Files live in a private bucket. The app never receives storage credentials: only signed, expiring URLs (15 minutes to upload, 1 hour to download).
• Every file key embeds its owner's identifier and the server checks that ownership on each request: one session cannot read or moderate another session's file.
• The session is a JWT with a unique identifier per issue; the installId is kept in Android's encrypted storage.
• Balance and credit charging are always decided on the server; the app never adds or subtracts credits on its own.
• Rate limits protect the sensitive endpoints, and daily spend caps protect the AI providers.

If we detect a security breach that poses a risk to your rights, we will notify the Spanish Data Protection Agency (AEPD, https://www.aepd.es) within 72 hours and, where the risk is high, you as well.

10. Minors

BabyMix is an app for adults. It is not directed at anyone under 18, it is not part of Google Play's "Designed for Families" programme, and we do not knowingly collect data from minors.

• Photos in the mum and dad roles must be of adults. The age classifier automatically rejects those that look like a minor, the credit is refunded and nothing is generated.
• The "My baby" mode accepts a photo of a baby or toddler only if you are their parent or legal guardian and you upload it in that capacity. By using it you state that you are.
• We do not allow uploading a photo of a child who is not in your care, nor using the app to create images of minors in any other context. The model instructions always fix a family portrait with the baby clothed, and there is no free-text field with which to steer them elsewhere.
• If you believe a minor has given us data, write to support@som.company and we will delete it.

11. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict or object to its processing, to portability, and to withdraw consent where processing relies on it, without affecting what was done before.

The fastest route is the app itself: Profile → "Privacy" → "Manage my data". You can also use the public form at https://babymix-30feb.web.app/delete-account or write to support@som.company.

Exactly what DELETE /account erases:

What is deliberately kept, and why:

• The hash of the install identifier that stops free credits from being claimed again. It is an irreversible value with no readable personal data (legitimate interest in preventing fraud).
• The identifier of purchase events already processed, with no link to your account, so that a replay from the store cannot credit the same purchase twice.
• The moderation verdicts, keyed by content hash and expiring after 24 hours, which contain no identifier of yours.
• The device's daily rewarded-ad counter, which rotates every day. Today that row also holds the identifier of the first user who created it that day; we plan to stop storing it.
• Accounting entries for purchases already made, to the extent tax law requires them, by then disassociated from your account.

If you believe we have handled your request poorly, you may complain to the Spanish Data Protection Agency (AEPD, https://www.aepd.es) or to the supervisory authority of your country of residence.

12. California and other US state residents

In the last twelve months we have collected the categories described in section 3: identifiers (install and account identifiers, advertising identifier), commercial information (purchase history), internet activity (usage events), approximate geolocation (country) and audiovisual information (the photos you upload). The source and purpose of each category are in that same section.

• We do not sell personal information and we do not share it for cross-context behavioural advertising, as the CCPA/CPRA defines those terms.
• You have the right to know, to delete and to correct your information, and not to be discriminated against for exercising those rights. Use the same route as in section 11.
• Sensitive information: photos containing faces may qualify as sensitive personal information. We use them only to provide the service you asked for and never to infer characteristics about you for our own purposes, so a limit-the-use request does not apply.

13. Where the app is available

BabyMix is published in a limited set of countries (United States, United Kingdom, Canada, Australia, Germany, France, Spain, Italy and the Netherlands) and its interface is available in Spanish, English, German and French. That limitation is applied through Google Play's distribution settings. The app is not intended for use outside those markets.

14. Changes to this policy

If we change something material, we will publish the new version at https://babymix-30feb.web.app/privacy with a new effective date and, where the change affects you significantly, tell you inside the app. The version in force is always the one published at that address.

15. Contact

Secure Online Managements SL C/ Creueta 20, 08870 Sitges (Barcelona), Spain Email: support@som.company Account deletion: https://babymix-30feb.web.app/delete-account