Privacy Policy

1. Introduction

AuPairSync (“we,” “our,” or “us”) is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and our iOS and Android apps.

We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, you consent to the data practices described in this policy.

2. Data We Collect

2.1 Information You Provide

• Account Information: Email address, name, and role (parent or au pair) when you create an account. We also store your device’s preferred language and region (for example, pt-BR) once at sign-up, or on the next app start if your existing account has no value yet, to help us choose future translations. This is a language setting, not your location; it does not change the app’s display language.
• Birthday (optional): As a parent or au pair you can add your birthday to your profile, as day and month. The year is not stored, and you can remove the birthday at any time. The other members of your family can see it: in the seven days before your birthday and on the day itself, their dashboard shows your name and the date, never an age. For children, the dashboard uses the birth date from the child’s profile and also shows the age the child turns. Your birthday is part of your data export. Connected AI apps (see 2.5) do not receive it.
• Email confirmation: If you signed up with an email address and a password, you can have a confirmation email sent to that address from the app. It contains a link that works once and opens a page on our website, where you confirm that the address is yours. We send this email only when you ask for it, and without open or click tracking. You can use the app without confirming. From app version 4.3, the app asks every parent who signed up with a password, has not confirmed the address and is not in a family yet to confirm it. It asks whether or not the address has been invited. Confirming matters in one case: if a parent has invited your email address to join their family as a parent, we add you to that family once you have confirmed. The parent who invited you sees that the invitation is waiting for your confirmation. We store whether your address is confirmed. For each confirmation email we record your account ID, a one-way hash of the address and the time, and we count these emails per account and per address to limit how many can be sent. Legal basis: performance of contract (see section 12) for confirming the address and joining the family, and our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR) for the record and the limits.
• Invitations by email: A parent can invite another person to their family by entering that person’s email address, as an au pair or as another parent. We store the address with the invitation: the role, the family, the name and account ID of the parent who sent it, the invitation code, its status and its dates, and, if an AuPairSync account uses the address, a reference to that account and whether the invitation is waiting for that account to confirm its address (see “Email confirmation” above). On that account we note which invitation it was matched with. We send that address an email with the family’s name, the name of the parent who invited them and the code to join; a person we could add to the family directly gets a welcome email instead. If the person has not joined, we send a reminder after 3 days and a second one after 7 days. An invitation is valid for 30 days, and a parent of the family can withdraw it earlier; once it has expired or been withdrawn, we send the invited person no more emails about it. If an AuPairSync account already uses the address, that account can also get a push notification about the invitation. The parents of the family see the invited address and the status of the invitation in the app. The parent who sent it gets emails about it: that it was sent, after 14 days if the person has not joined, when it expires, and when the person joins. We send the reminders, the welcome email and the emails to the parent through a queue on our server; each entry holds the recipient’s address and, where there is one, account ID, the names, the invited address or the code shown in the email, the time and the delivery service’s message ID. An entry written since we introduced the limit on October 10, 2026 is deleted 90 days after it was written. Entries from before that have no time limit; they are deleted when the recipient deletes their AuPairSync account or the family they belong to is deleted. Legal basis: for the parent who sends the invitation, performance of contract (see section 12); for the invited person, the family’s legitimate interest in bringing the people who look after its children into the app (Art. 6(1)(f) GDPR). If you were invited and do not want further emails, or want your address removed, write to privacy@aupairsync.com.
• Family Data: Children’s names and ages, family preferences, schedules, tasks, and messages you create within the app
• Contact Information: If you contact us for support or inquiries

2.2 Automatically Collected Information

• Analytics Data: Page views, session duration, device type, browser type, and operating system via Google Analytics 4
• App Usage Data: Feature usage and device information via Firebase Analytics (iPhone and Android app), and crash reports via Firebase Crashlytics (iPhone app only). Both are on by default and stop when you switch off usage analytics in the app under Settings → Privacy & Data.
• Operations events: When you use the iPhone or Android app, we record whether certain steps worked: joining a family, setting up a family, adding the first child, uploading a photo, buying or restoring the subscription, planning a meal, and an au pair asking the family to renew. Each entry holds your account ID, your family ID where there is one, the app version and the outcome (with a short error code if the step failed), never content you entered. We use this to run the app reliably and to notice when something breaks. The legal basis is our legitimate interest in a working service (Art. 6(1)(f) GDPR). These events are recorded whether or not usage analytics is switched on. They are deleted automatically after 28 days, and straight away when you delete your account. You can object at any time by emailing privacy@aupairsync.com.
• UTM Parameters: Marketing campaign source, medium, and campaign name from URL parameters
• IP Address: Used to count a website visit once and to limit abusive request rates. We store only a one-way hash of it that changes daily, never the address itself, and delete that hash automatically after at most 30 days.
• Cookies: Google Analytics cookies that distinguish visitors (see section 5)

2.3 Data We Do NOT Collect

We practice data minimization. We do not collect:

• Payment card details. Purchases are made through the App Store or Google Play; we receive only the subscription status and the purchase token needed to verify it, never card details.
• Other sensitive personal data, such as racial or ethnic origin or religious beliefs. The exceptions are health data about children that parents choose to enter (see 2.4), what a care log may say about a child’s health (see 2.9) and the doses recorded in a medication log (see 2.11)
• Precise location data (we only infer country-level from IP address for analytics)
• Contacts or photos from your device (unless you explicitly share them in-app)

2.4 Health Data About Children

Parents can add health information to a child’s profile in the app: allergies and an allergy action plan, medical conditions, medications (including photos), medical notes, health insurance details and emergency contacts. This is health data, a special category of personal data under Art. 9 GDPR.

We store it so that whoever looks after the child knows what to do in everyday care and in an emergency. It is visible to the parents in the family and to the family’s au pair.

Legal basis: your consent as the parent (Art. 9(2)(a) GDPR), which you give by entering the data. You can withdraw it at any time by deleting the entries in the app. The medication log has its own switch and its own rules (see 2.11): deleting a single entry there leaves a line saying that an entry was deleted.

It is stored with your other family data in Firebase (Google Cloud), see sections 4 and 10. It is deleted when you delete the child’s profile or the family.

2.5 Connected AI Apps

Parents can connect an AI assistant of their choice to AuPairSync. Today these are ChatGPT (OpenAI) and Claude (Anthropic). A connected AI app can read part of the family’s data, listed below. It can add, change or delete entries only if the parent allowed that when connecting it (see “Adding, changing and deleting” below). The setting “Allow AI apps” is off by default. Only a parent can turn it on and connect an AI app, and only while the family has an active subscription or trial.

A connected AI app can read eight areas:

• Family overview: the family’s name and time zone, first names, roles and the children’s ages
• Day plan: each day’s events, routines and tasks, and which au pair has the day off
• Calendar: events with their title, times, place and children, who they are for and who brings and picks up, and the holiday breaks of repeating events with their name
• Tasks: title, kind, due date, priority, status, when they were completed and who they are for
• Shopping lists: the list’s name, its items and whether they are ticked off, the store, the status and who the list is for
• Expenses: amount, currency, category, status, when they were submitted and paid, and who submitted them
• Time off: dates, kind (vacation or other), status and who asked for it
• Announcements: title, text, who posted it and when, and the end date if it has one

Titles, places and names are free text: the title and place of a calendar event, the name of a holiday break, the title of a task, the name of a shopping list and of each item on it, and the name of a store. A connected AI app can read them as they were written, whoever in the family wrote them, the au pair included. If you are an au pair, it can also read your schedule, the tasks assigned to you, your time-off dates and their status, and the amount, date, category and status of the expenses you submitted.

An AI app never receives messages or chats, documents, photos or receipts, medical, allergy or insurance details, passport or visa details, or notes. Apart from announcements, the only free text it receives is the titles, places and names just listed. It never receives the description or notes of an event, a task or a shopping item, the description of an expense, the reason for a time-off request or the parent’s reply to that request, whoever wrote them. For announcements, it does not learn who read, acknowledged or hid them.

Adding, changing and deleting

The page where a parent connects an AI app has two more boxes, both unticked by default. With “Allow creating events, tasks and announcements” ticked, the AI app can add calendar events and tasks and post announcements to the family when the parent asks it to. With “Allow changing and deleting” ticked, it can change, cancel, complete, reopen or delete calendar events and tasks, with the same rights the parent has in the app; it cannot change or delete announcements. With neither box ticked, the connection can only read. An existing connection never gains these rights on its own: the parent has to connect the app again and tick a box. The same goes for announcements: a connection from before they were added on October 4, 2026 can neither read nor post them until the parent connects the app again.

For an event, the AI app supplies the title, start and end, whether it repeats and, if the parent mentions them, the place, the child and who drops off and picks up. For a repeating event, it can also add or remove a holiday break: the days without the event and, if the parent gives one, a name. For a task, it supplies the title, who it is for, the due date and whether it repeats. For an announcement, it supplies the title, the text and, if the parent gives one, the day it ends. It cannot write anything else: no notes, shopping lists, babysitting requests, time off or vacations, and nothing about health, documents or chats.

Each of these entries records which AI app added it or last changed it, and keeps that record after the connection ends. From app version 3.6, AuPairSync shows it on the entry, for example “Added by Claude” or “Changed by Claude”. On an announcement, the apps show which AI app added it from version 3.7. The entry can be edited and deleted in the app like any other, and the usual notifications go out, just as when a parent makes the entry in the app. An announcement posted through an AI app notifies everyone else in the family, the au pair included, like one a parent posts in the app; members who turned announcement notifications off are not notified.

When the AI app adds or changes an entry, it gets back a confirmation of what was saved: the title, the time and the people involved by first name. If an event falls on an au pair’s day off or free weekend, it gets a warning with her first name and the date instead, and the event is saved only after the parent confirms. For this check we read the au pair’s working-time settings and the family’s entries around that date; the AI app receives only the warning. An announcement is not posted at once either: the AI app first gets back the exact title and text and who will be notified, by first name and role, and the announcement is posted only after the parent confirms. How many announcements an AI app can post is limited per connection and per family. With “Allow changing and deleting”, the AI app also sees each event’s and task’s internal ID, so it changes the right entry. For every write we keep a record with the entry’s ID and the kind of change, without any content, for 30 days. It stops a repeated request from creating the same entry twice.

The AI provider receives this data as an independent controller, through the parent’s own account with it and under its own privacy terms. It is not our processor. Whether conversations are used to train its models is a setting the parent controls in that AI app. The provider may process the data outside the EU (see section 10). Our server that answers the AI app runs in the EU (Google Cloud, Belgium). We do not store or cache what an AI app reads. For each request we log which connection used which area, the result and the size of the answer, without any content, and delete this log after 30 days.

Legal basis for reading: the family’s legitimate interest in organising the care of its children (Art. 6(1)(f) GDPR). Entries an AI app adds, changes or deletes are processed on the same legal basis as the same entry made by a parent in the app (performance of contract, see section 12): the AI app is just another way for the parent to make it. The boxes record that the parent chose to give the AI app this access; they are not consent under Art. 6(1)(a) GDPR.

AuPairSync does not notify the au pair when a parent connects an AI app. Au pairs can see which AI apps are connected in the app under Settings → Legal → Connected AI apps. If a parent allowed it, their AI app can add entries that assign the au pair (dropping off or picking up for an event, or a task) and change or delete such entries. She then gets the same notifications as when a parent makes the entry in the app. An announcement a parent posts through an AI app notifies her like everyone else in the family. If you are an au pair, you can object at any time by writing to privacy@aupairsync.com. We then leave your expenses and your time off out of what connected AI apps can read and show you only as “au pair”, without your name, and no AI app can assign you any more. The family’s calendar, tasks and shopping lists stay readable, including entries you are assigned to and titles you wrote. Your family can still assign you in the app. An announcement posted through an AI app still reaches you after an objection: it is the parent’s message to the whole family, and in the list of who is notified the AI app then sees you only as “au pair”.

Any parent can revoke an AI app’s access at any time in the app under Settings → Legal → Connected AI apps. Turning off “Allow AI apps” revokes every connected app. Revoking deletes the app’s access tokens at once. We keep a record of the revoked connection (which app, when and who revoked it) for 90 days for security, then delete it. The record holds no family data.

2.6 Pickup and Drop-off Confirmation

A parent can switch on “Ask to confirm drop-off and pick-up” for an event. It is off by default, and for an event where it is off, nothing below is stored. For each drop-off or pick-up of an event where it is on and a parent named a specific person, the app stores that person’s answer: accepted, declined with an optional free-text reason, or done (shown as “Dropped off” or “Collected”). Each answer carries the time it was given, the times of the event it was given for, whether it was given in the app or from a notification, and the person’s user ID. We also store who last changed the setting, a marker that the person was reminded, and which parents count as having accepted because they assigned the drop-off or pick-up to themselves. We store no location data for this.

Our server also keeps a history of each answer. It records every step (accepted, declined, done, undone, or asked again after a parent changed the time or asked anew) with the time it reached our server, the times of the event as our server knows them, the reason typed on a decline, and a “late” marker when a drop-off or pick-up was marked as done more than 30 minutes after its time. Marking as done can be undone for a limited time and is final after that; a change our server did not accept stays in the history, marked as not accepted. The apps cannot write or change this history. For an event that asks for confirmation, our server also notes when the event’s times were last changed and whether a parent changed them; that note names nobody. When the person assigned to a drop-off or pick-up moves the event herself, the history of her answers records that as well: when she changed the times, the old and the new times, and whether her new times count for her drop-off or pick-up. This entry is kept with her own answers, so it belongs to her.

Every member of the family can read the current answers and the reminder markers. The history can be read by the parents and, for their own answers, by the person who gave them. Answers, their history and reminder markers are deleted automatically 30 days after the event. A history entry that has no answer, for example because she moved the event but never answered, is deleted 30 days after it was recorded. If you delete your account, your answers, their history and your reminder markers are deleted, in every family you were in. Your answers and their history are part of your data export. Connected AI apps (see 2.5) receive none of this.

2.7 Document Requests

A parent can ask an au pair in the family for a document, for example a passport, a visa or proof of insurance. For each request the app stores the document type and title, the purpose the parent wrote, the due date, the au pair it is for, the parent who asked and the parent who reviews it (with their names), the status (requested, uploaded, reviewed or cancelled) and a history of the steps with the time of each. Who took each step is kept in a separate server record that is deleted after 30 days. Once the au pair answers, the request points to the document she uploaded or picked from her own stored documents; the file itself stays in her secure document store under its existing permissions. A request gives no one access to any file. If the file of a reviewed request is replaced or deleted afterwards, the request goes back to waiting for review and shows that the file changed after the review and when; who changed it is not recorded. The reviewing parent is notified, or every parent of the family if that parent has left it. This also happens when the au pair deletes a document that was already reviewed: the request then waits for review again. Push notifications about a request do not contain the purpose, file names or document contents.

A request is kept with the au pair’s account. Only she and the parents of the family she is in now can read it; a request from an earlier family is closed to everyone. A request is deleted, together with its history, when she deletes her account. Requests from a family she is no longer in are also deleted when the handover note that family kept about her as a former au pair is erased: twelve months after she was archived, or earlier if a parent of that family erases it in the app. If the parent who asked or the parent who reviews it deletes their account, their name on the request is replaced by a placeholder (shown as “Former member” in the apps) and the request stays. The au pair’s data export includes the requests sent to her. A parent’s data export includes the requests they wrote or review; once the au pair is no longer in that parent’s family, it holds only what the parent did: what they wrote in a request they made, and when they reviewed one.

2.8 Appointment Preparation

A parent can prepare a child’s appointment for a person in the family. The preparation packet stores the child, the person it is for, the instructions (with who wrote them and when they were last changed), the questions, the checklist of things to bring with who ticked each item, and who reviewed the packet and marked it ready. A parent can link up to five documents; the packet stores only a pointer to each one, never the file, its name, a download link or a copy of medical details, and linking gives no one access to the file. A parent has to publish the packet before the assigned person can open it, and other au pairs cannot read it. After the appointment, the assigned person or a parent can write a note and propose a follow-up task with a title, an owner and a deadline. The note and the proposal are stored with the packet, with the names of the person who proposed it, the parent who reviewed it and the proposed owner, and only the parents and the person the packet is for can read them. A task is created only when a parent approves it. From app version 4.1, the approving parent writes the task’s description and the note stays in the packet; if a parent approves with an older app version, the note is copied into the task’s description as before. The task itself is visible to the whole family and is kept like any other task. A connected AI app (see 2.5) never receives a packet, a note or a task’s description. It sees the title of such a follow-up task only if a parent wrote it; otherwise it sees a neutral title.

A packet is deleted when its appointment is deleted, when the child is deleted, or when the account of the person it is for is deleted. Follow-up tasks approved from a packet stay when the appointment is deleted; they are deleted when the child is deleted. If someone else who wrote, ticked or reviewed something in a packet deletes their account, their name and ID in the packet are replaced by a placeholder (shown as “Former member” in the apps) and the wording stays, also in a family they have already left. On an approved follow-up task, the IDs of the person who proposed it and the parent who approved it are replaced in the same way. A packet is part of the data export of the parent who created it and, once it has been published, of the person it is for; follow-up notes and proposals are part of the export of the person who wrote them.

2.9 Care Log

For each child, a parent can switch on “Care logging” in the child’s profile. It is off by default, and while it is off, nobody can add entries. With it on, the parents and the family’s au pairs can record entries about the child’s day: meals, sleep (with start and end), bottles, diapers, activities and notes. Each entry holds its kind, the time, optional details and a free-text note, and who recorded it (name and user ID) and when. The care log is meant for babies and toddlers. Its entries are data about a child and can include details about the child’s health, for example what and how much the child ate or drank, or a note about a fever. Where they do, they are health data, a special category of personal data under Art. 9 GDPR.

The care log can be read by the parents in the family and by the family’s au pairs, and by nobody else. Connected AI apps (see 2.5) cannot read it. A parent can correct any entry, an au pair only the entries she recorded herself. A correction does not overwrite anything: the earlier version stays in the entry’s history with its author and time, visible to the same people.

The parents decide whether a care log is kept for a child. Legal basis: your consent as the parent (Art. 9(2)(a) GDPR), which you give by switching on “Care logging” for the child. Under the switch, the app tells you that entries can include health details about your child and that you can delete them at any time. You can withdraw it at any time: switch “Care logging” off, which stops new entries, and delete the care log. Switching it off alone deletes nothing; the existing entries stay readable until a parent deletes them.

Only parents can delete. A parent can delete a single entry at any time, and a child’s whole care log once “Care logging” is switched off for that child. Deleting removes the entry and all its earlier versions for everyone in the family and cannot be undone. The care log is also deleted when a parent deletes the child’s profile and when the family is deleted. If someone who recorded or corrected entries deletes their account, the entries stay with the family and their name and user ID on them are replaced by a placeholder (shown as “Former member” in the apps), also in a family they have already left. A parent’s data export contains the care log of the family’s children with all earlier versions; everyone’s data export contains the entries and corrections they wrote themselves. The care log is stored with your other family data in Firebase (Google Cloud), see sections 4 and 10.

2.10 Pets

A parent can add the household’s pets. A pet’s profile holds its name, species, breed (optional), a photo (optional), the household instructions for looking after it, and two contacts: the name and phone number of the vet and of a backup sitter. The profile also records which parent created it and last changed it and, shown under the instructions, who wrote them and when. The vet and the backup sitter are people outside the family: a parent decides whether to enter their name and number, and they are stored only so that whoever looks after the pet can reach them.

Only parents can create or change a pet’s profile and upload its photo. The parents and the family’s au pairs can read the profile, the contacts and the photo. A parent can add care tasks for a pet, once or repeating daily or weekly, and assign them to a member of the family. These are ordinary tasks: like any task they record who they are assigned to and who completed them and when, and everyone in the family can see them. A connected AI app (see 2.5) cannot read pet profiles, contacts or photos; it sees a pet’s care tasks like any other task, including their title.

The photo is stored with your other family data in Firebase (Google Cloud). When a parent replaces a pet’s photo, or leaves the form without saving, the app deletes the file that is no longer used. A parent can change a profile at any time, for example remove the contacts. A parent can also delete a pet in the app (“Delete pet”). This deletes the profile (name, species, breed, instructions and the vet and backup sitter contacts), its photo including earlier uploads, and the pet’s open care tasks. Completed care tasks stay in the family’s task history as ordinary tasks without the link to the pet; their title may still name the pet. Nobody is notified, and it cannot be undone. Pet profiles and their photos are also deleted when the family is deleted. If a parent who created or changed a profile or wrote its instructions deletes their account, the profile stays; their name is removed and their user ID is replaced by a placeholder (shown as “Former member” in the apps). A parent’s data export contains the family’s pet profiles.

2.11 Medication Log

For each child, a parent can switch on “Medication log” in the child’s profile. It is off by default, and while it is off, nobody can add entries. With it on, the parents and the family’s au pairs can record each dose they gave the child of a medication from the child’s profile (see 2.4). Each entry holds the medication with a copy of its details as they stood in the profile at that moment (for example name, dosage, schedule, instructions and who prescribed it), the amount given, the time it was given, an optional free-text note, and who gave and recorded the dose (name, user ID and role) and when. The app records the signed-in person as the one who gave the dose. The copy stays in the entry when the medication is later changed in the profile or removed from it. These entries are health data about a child, a special category of personal data under Art. 9 GDPR.

The medication log can be read by the parents in the family and by the family’s au pairs, and by nobody else. Connected AI apps (see 2.5) cannot read it. A parent can correct any entry, an au pair only the entries she recorded herself; an entry can be corrected at most 50 times. A correction does not overwrite anything: the entry gains the corrected amount, time and note together with who recorded the correction (name and user ID) and when, and the original values and every earlier correction stay visible to the same people.

The parents decide whether a medication log is kept for a child. Legal basis: your consent as the parent (Art. 9(2)(a) GDPR), which you give by switching on “Medication log” for the child. Under the switch, the app tells you that the entries are health details about your child, who sees them and how they can be deleted. You can withdraw it at any time: switch “Medication log” off, which stops new entries and corrections, and delete the medication log. Switching it off alone deletes nothing; the existing entries stay readable for the parents and au pairs of the family until a parent deletes them. Deleting a single entry does not remove everything either: a line stays (see the next paragraph). Only when the whole log, the child’s profile or the family is deleted is that line removed as well.

Only parents can delete. A parent can delete a single entry at any time, whether the log is switched on or off. This removes the content of the entry for everyone in the family: the medication with its copied details, the amount, the time, the note, who gave the dose and every correction. It cannot be undone. In the entry’s place the log keeps a line that says an entry was deleted, with the name and user ID of the parent who deleted it and the time of the deletion. The line also keeps the time at which the entry was originally recorded; the apps use it only to keep the line in its place and do not show it. Everyone who can read the log sees this line. We keep it so that a deleted dose does not look as if nothing had been given; for 24 hours after a deletion the apps also show a notice when someone records a dose for that child. The line cannot be changed or removed on its own. A parent can delete a child’s whole medication log once “Medication log” is switched off for that child; this removes every entry and every such line. The medication log, these lines included, is also deleted when a parent deletes the child’s profile and when the family is deleted. There is no retention period: unless one of these happens, entries and lines stay stored. If someone who recorded a dose, recorded a correction or deleted an entry deletes their account, the entries and lines stay with the family and their name and user ID on them are replaced by a placeholder, also in a family they have already left; whether they were a parent or an au pair stays on the doses they recorded. A parent’s data export contains the medication log of the family’s children with all corrections and the lines about deleted entries; everyone’s data export contains the doses they recorded, the corrections they wrote and a list of the entries they deleted. The medication log is stored with your other family data in Firebase (Google Cloud), see sections 4 and 10.

2.12 Recent changes (“Since your last visit”)

To show family members what changed in the family’s plans while they were away, AuPairSync keeps a short record of changes to events, activities, routines and chores. Each entry holds what kind of change it was (for example a new time, a new place, a different person responsible, or that an event was added or cancelled), the item’s details before and after the change, the children it concerns, when it was made and, if a family member made it, who.

An entry is shown only to the parents and au pairs of the same family. A change made by a family member is shown with their name while they belong to the family or, if they made it through a connected AI app, with that app’s name. Changes the app makes by itself, for example when a member leaves the family, carry no name. Nobody outside the family can see these entries, and they are not used for any other purpose.

Entries are no longer shown after 30 days and are deleted shortly afterwards. They are also deleted when the family is deleted, and entries that name you are deleted when you delete your account. The changes you made yourself are part of your data export.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing the Service: To operate the app, manage your account, sync family data, and deliver notifications
• Communication: To send you important updates, onboarding tips and reminders about AuPairSync, and to respond to support requests
• Analytics and Improvement: To understand user behavior, fix bugs, and improve the app experience
• Legal Compliance: To comply with legal obligations and protect our rights

We do not sell, rent, or share your personal data with third parties for their marketing purposes.

4. Data Storage and Security

4.1 Where We Store Your Data

• Primary Storage: Firebase Firestore (Google Cloud Platform)
• Authentication: Firebase Authentication (email/password, Apple Sign-In, Google Sign-In)
• Email Service: MailerSend (email delivery service)
• Analytics: Google Analytics 4 and Firebase Analytics
• Error Monitoring: Firebase Crashlytics (crash reports from the iPhone app, see 2.2)

4.2 Data Retention

• Account Data: Retained while your account is active. A birthday you added (see 2.1) is deleted when you remove it, and otherwise with your account. The counters for confirmation emails (see 2.1) are deleted with your account; a one-hour limit on the address that is still running ends first and is deleted within a day after that. If a note that an invitation was waiting for you is still stored from the time before version 4.3, it is deleted with your account at the latest. The record of a confirmation email sent since we introduced the limit on October 10, 2026 is deleted 90 days after the email was sent; if you delete your account before that, it stays until then without your account ID and without the hash of your address. A record from before that has no time limit: it stays, and after you delete your account it stays without your account ID and without the hash of your address. After you delete your account we keep a record that the deletion was requested and carried out — user ID, role, family ID, dates, status and a list of what was removed; no name or e-mail address — as proof.
• Invitations by email: The invitation, with the invited address, is kept after it has been used, has expired or was withdrawn. It is deleted when the parent who sent it deletes their account, when the invited person deletes the AuPairSync account registered with that address, or when the family is deleted. The queue entries for the emails about it are deleted 90 days after they were written if they were written since we introduced the limit on October 10, 2026; older entries have no time limit (see 2.1)
• Family Data: Retained while the family exists. When the last parent of a family deletes their account, the family and its data are deleted. When any other member deletes their account, what they entered stays with the family in anonymised form (see “After you leave a family” below)
• Analytics Data: Retained for 26 months (Google Analytics default)
• Operations events: Deleted automatically after 28 days (see 2.2)
• Pickup and drop-off confirmations: Answers, their history and reminder markers are deleted automatically 30 days after the event (see 2.6)
• Pickup instruction photos: Photos uploaded for pickup instructions that are not attached to saved instructions are deleted automatically after 24 hours
• Document requests: Kept with the au pair’s account and deleted with it when she deletes her account. Requests from a family she is no longer in are deleted earlier, when that family’s handover note about her is erased (see 2.7)
• Appointment preparation packets: Deleted when the appointment or the child is deleted, or when the account of the person the packet is for is deleted. Approved follow-up tasks are deleted when the child is deleted (see 2.8)
• Care log: Kept until a parent deletes an entry or the whole care log, or until the child’s profile or the family is deleted (see 2.9)
• Medication log: No retention period: entries are kept until a parent deletes them. A deleted entry leaves a line (that an entry was deleted, by whom and when), which is kept until a parent deletes the whole medication log. Entries and lines are also deleted when the child’s profile or the family is deleted (see 2.11)
• Pet profiles: Kept until a parent deletes the pet or the family is deleted. Deleting a pet also deletes its photo and its open care tasks; completed care tasks stay as ordinary tasks. A photo that was replaced or not saved is deleted by the app (see 2.10)
• Recent changes: Entries are no longer shown after 30 days and are deleted shortly afterwards. They are also deleted when the family is deleted, and entries that name you are deleted when you delete your account (see 2.12)
• Former au pair’s profile data: When a family archives an au pair, the family keeps a record that she was their au pair (her name, the programme dates, the reason and when she was archived) and the handover note. The handover note is erased automatically after twelve months, or earlier if a parent erases it in the app. Her own profile details, stored documents and profile photo stay with her account and are deleted when she deletes it. The family’s record stays until she deletes her account or the family is deleted
• After you leave a family: If an au pair is archived or a parent is removed from a family, what they entered stays with that family. We keep a record of the families an account belonged to; no app can read it, only our server, and it is part of your data export. When you later delete your account, that record is deleted, and your name and user ID in what those families still hold (for example tasks, calendar events, packing lists, pet profiles, working-time settings, care log entries and appointment packets) are replaced by a placeholder (shown as “Former member” in the apps). Calendar events and series that named you go back to “any parent”, and your own time-off and babysitting entries in the calendar are deleted. One exception: on an ordinary task, the internal ID of the person who created or completed it stays, without a name, because the apps use it to handle repeating tasks
• Connected AI apps: A connection is kept while it is active. After it is revoked, a record of it (which app, when, who revoked it) is kept for 90 days for security, then deleted. Deleting your account or the family deletes it at once. Events and tasks an AI app added or changed and announcements it posted are kept like any other entry. The record of each write (the entry’s ID and the kind of change, no content) is deleted after 30 days (see 2.5)
• Support Communications: Retained for 2 years for record-keeping purposes

4.3 Security Measures

We implement industry-standard security practices:

• Encrypted data transmission (HTTPS/TLS)
• Firebase Security Rules to restrict unauthorized access
• Secure authentication with support for Apple Sign-In and Google Sign-In
• API key restrictions and domain whitelisting
• Regular security audits and updates
• Rate limiting on API endpoints to prevent abuse

6. Third-Party Services

We use the following third-party services that may process your data:

7. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights regarding your personal data:

8. Data Requests and Contact

To exercise any of your GDPR rights or for privacy-related inquiries, please contact us at:

How to Request Data Deletion

You can delete your account yourself in the app. Our account deletion page explains how, and what happens to your data. You can also request deletion by email:

1. Email privacy@aupairsync.com with subject “Data Deletion Request” privacy@aupairsync.com
2. Include the email address associated with your account
3. We will confirm your identity and process deletion within 30 days
4. You will receive confirmation once deletion is complete

9. Children’s Privacy

AuPairSync is designed for use by parents and au pairs (adults). While the app manages information about children (names, ages and photos, schedules and routines and, where parents choose to enter them, health data (see 2.4), a care log (see 2.9) and a medication log (see 2.11)), this data is entered by the adults in the family and controlled by the parent account holder. We do not knowingly collect personal data directly from children under 16. If you believe we have collected data from a child, please contact us immediately at privacy@aupairsync.com.

10. International Data Transfers

Your data may be transferred to and processed in the United States where our servers and third-party services are located. We ensure adequate safeguards are in place:

• Google Cloud Platform (Firebase) complies with EU-US Data Privacy Framework
• Standard Contractual Clauses (SCCs) with third-party processors
• GDPR-compliant Data Processing Agreements (DPAs) with all vendors

GitHub (see 6): the feedback and support messages you send from the app go to GitHub, Inc. in the US. According to its privacy statement, GitHub, Inc. is certified under the EU-US Data Privacy Framework.

AI apps a parent connects (see 2.5): OpenAI (ChatGPT) and Anthropic (Claude) are not certified under the EU-US Data Privacy Framework, and we have no Standard Contractual Clauses with them. The data reaches them because a parent instructs us to send it to their own account with that provider, and it may be processed outside the EU, for example in the US. This includes the confirmations and warnings an AI app gets back when it adds or changes an entry. We will review this if a provider joins the Data Privacy Framework.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Updating the “Last Updated” date at the top of this page
• Sending an email notification to registered users (for material changes)
• Displaying a notice in the app or on our website

Continued use of our services after changes constitutes acceptance of the updated policy.

12. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Consent: Email signup on our website (you explicitly opt in)
• Contractual Necessity: Providing the Service, managing your account, and syncing family data, including document requests, appointment preparation packets and pet profiles (see 2.7, 2.8 and 2.10)
• Legitimate Interest: Security, and analytics and app improvement: Google Analytics on our website (see section 5), and in the apps Firebase Analytics and, on iPhone, Crashlytics crash reports. In the apps these are on by default; you can object at any time by switching off usage analytics under Settings → Privacy & Data, which stops the collection on that device (balanced against your privacy rights)
• Connected AI Apps: For what an AI app reads: legitimate interest (Art. 6(1)(f) GDPR), the family’s interest in organising its care with an AI assistant a parent chose (see 2.5). Au pairs can object at privacy@aupairsync.com. For events and tasks an AI app adds, changes or deletes and announcements it posts when a parent asks: the same basis as the same entry made in the app (performance of contract). The boxes a parent ticks when connecting record that choice; they are not consent under Art. 6(1)(a) GDPR
• Emails about AuPairSync: If you have an account, we send you emails about AuPairSync: onboarding tips and reminders to come back to the app. We do not ask for separate consent for these. The legal basis is § 7(3) of the German Act Against Unfair Competition (UWG) together with our legitimate interest in telling our users about our own service (Art. 6(1)(f) GDPR). You can object at any time, at no cost other than the basic cost of transmission: use the unsubscribe link in any of these emails, or write to privacy@aupairsync.com.
• Legal Obligation: Compliance with applicable laws and regulations

13. Contact Information

For any questions, concerns, or requests related to this Privacy Policy or your personal data: