Privacy Notice
This notice explains how SlumberPal uses personal information. It is written for the parents, guardians and carers who set SlumberPal up for a child. If anything here is unclear, email privacy@slumberpal.app.
1. Who we are
Slumber Pal Ltd, trading as SlumberPal, is a company registered in Northern Ireland (company number NI744994) with its registered office at 1 Lyndhurst Road, Londonderry, BT47 5HS, United Kingdom. We are the controller of the personal information described here.
- Privacy questions and requests: privacy@slumberpal.app
- Help with the app: support@slumberpal.app
We have not appointed a data protection officer; the address above reaches the person responsible for privacy at SlumberPal. Because we are based in the United Kingdom, we are appointing a representative in the European Union under Article 27 of the EU General Data Protection Regulation and will name them here. Until then, people in the EU can contact us directly at the address above.
This notice covers the SlumberPal app (its Parent mode and its Pal Screen mode), our support and this website. The website’s cookies and Google Analytics are explained on the Cookies page.
2. Where SlumberPal is offered
SlumberPal is offered in the United Kingdom and in other countries where the App Store or Google Play lists it, except the United States. SlumberPal is not offered in the United States, and we do not knowingly provide the service to families there.
3. Our approach for children
SlumberPal is set up and managed by an adult. The child only sees the Pal Screen: a calm display with a pal, the stars, sounds and a gentle activity.
- The Pal Screen never asks a child for information. It has no advertising, chat, purchases, web links or public sharing.
- A child’s taps on the Pal Screen operate it on the device. We do not turn them into analytics about the child or use them to profile a child.
- For each child we ask only for a first name, so you can tell profiles apart. We do not ask for a child’s surname, date of birth, gender, photo, voice, contact details or precise location.
- The app contains no advertising or analytics kit.
We follow the UK Information Commissioner’s Age Appropriate Design Code (the Children’s Code) and keep children’s settings private by default.
4. What we use and why
| Information | What we use it for | Lawful basis |
|---|---|---|
| Your adult account: your sign-in identifier from Google or Apple, email address, your role in the family and account-security events | Create and secure your account, manage who in the family can do what, and answer support and privacy requests | Contract with you; legitimate interests in keeping accounts secure |
| A child’s first name, schedules, sound and brightness choices, the current scene and activity, and which Screen the child uses | Run the sleep clock you set up and tell children’s profiles apart | Legitimate interests in providing the service you asked for, assessed with the child’s best interests first |
| Screen information: the Screen’s name, model and capabilities, whether it is online, battery, clock and download readiness, and whether a change was applied | Pair a Screen, apply your changes, show you honest status and fix faults | Legitimate interests in running the service securely |
| Your parent PIN | Keep grown-up controls away from a child | Legitimate interests in access security. The PIN stays on the device and is never sent to us |
| Purchase records: store transaction IDs, which plan or item you bought, refunds and the records tax law requires | Give you what you paid for, restore purchases, prevent fraud and meet accounting duties | Contract with you; legal obligation |
| Support emails and anything you attach | Answer you and fix the problem you report | Contract with you; legitimate interests |
| Optional crash reports from Parent mode | Find and fix crashes | Your consent, off until you switch it on, and you can switch it off at any time |
| Totals across all families (for example, how many families finished setup), counted on our servers | See where people get stuck and improve the service | Legitimate interests. We keep only totals, nothing that identifies you, your family or your child, and we show no figure below 10 |
Custom pals. A custom pal is made from photos of a child’s soft toy. This feature is not open to the public yet. If it is offered to your family, we will ask for your consent before you upload any photos, and we use them only to check the photos, make your pal and deliver it. Photos must show a toy only, never a child or any other person; our checks and reviewers reject photos that show people. We never use your photos or your pal to train AI models and never put them in a public gallery.
We do not sell personal information, show advertising, or share a child’s information with advertisers.
5. Who we share it with
We use the service providers below to run SlumberPal. They act on our instructions under written data-processing terms and may not use your information for their own purposes.
| Provider | What they do for us | Information they handle | Where |
|---|---|---|---|
| Google Cloud and Firebase (Google Ireland Limited and Google LLC) | Hosting, database, file storage, sign-in, notifications to Screens, app attestation and the optional crash reports | Everything the service stores, listed in section 4 | Database and files in the Netherlands (EU); sign-in, notifications and crash reports may be processed worldwide, including the United States |
| Cloudflare, Inc. | Domain name, website hosting and the protective layer in front of our app’s servers | Internet addresses and request details passing through | Worldwide network, including the United States |
| Google Workspace (Google Ireland Limited) | Our email: the support, privacy and rights mailboxes | Your emails to us and our replies | Worldwide, including the United States |
| RevenueCat, Inc. | Checking App Store and Google Play purchases and keeping your plan up to date | A random purchase ID and store receipt details; never a child’s information | United States |
| Google Analytics (Google Ireland Limited) | Counting visits to this website, only if you accept analytics cookies | See the Cookies page | Worldwide, including the United States |
Only for families invited to try custom pals, these providers also take part in making the pal:
| Provider | What they do for us | Information they handle | Where |
|---|---|---|---|
| Google Cloud Vision | Automatic safety checks on toy photos | Toy photos | EU |
| Microsoft Azure AI Content Safety (Microsoft Ireland Operations Limited) | A second automatic safety check on toy photos | Toy photos | United Kingdom |
| Google Vertex AI (Gemini) | Describing the toy and drawing the pal’s still pictures | Toy photos and a description of the toy; never a child’s name | EU |
| fal.ai (Features and Labels, Inc.) | Turning the pal’s pictures into short animated clips | The pal’s generated pictures only, never your photos | United States |
App stores. Apple and Google run the App Store and Google Play under their own privacy policies. They take your payment and tell us what you bought; we never see your card details.
We may also disclose information where the law requires it, to protect a child or anyone else from harm, or as part of a sale or reorganisation of our business, in which case this notice continues to protect it.
6. International transfers
Where a provider handles information outside the United Kingdom or the European Economic Area, we rely on a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), on the European Commission’s adequacy decisions, or on the standard contractual clauses approved for the UK and the EU, with any extra safeguards the transfer needs.
7. How long we keep it
| Information | How long |
|---|---|
| Your account, your family’s settings and children’s profiles | While your account is open; deleted when you delete them or the account |
| Detailed sleep-session history | 30 days; you can clear it sooner |
| Screen health details | 7 days, then only rough totals for 30 days |
| Server logs | 14 days; access logs 30 days; security and audit logs 90 days |
| Support cases | 12 months after the case closes; deleting your account deletes them |
| Purchase, refund and tax records | Up to 6 years, as tax and accounting law requires, kept apart from children’s names and any photos |
| Totals across all families | 13 months; they identify no one |
| Backups | Point-in-time copies 7 days; daily backups 30 days |
| Toy photos (custom pals only) | Rejected photos up to 24 hours; accepted photos 30 days after your pal is delivered or the order ends; your finished pal for as long as you keep it |
8. Deleting your information
In Parent mode you can delete a child, a pal, your family or your whole account. Deleting a family or account stops all access at once and starts deletion across our systems, the providers above and our backups. We aim to finish within 30 days. Purchase and tax records we must keep by law are kept for the period above and then deleted.
A Screen that is switched off or offline cannot receive the deletion until it reconnects; its stored copy stops working within seven days either way. We cannot delete copies you made yourself, such as screenshots.
Deleting your SlumberPal account does not cancel an App Store or Google Play subscription. Cancel it in the store; see the Terms.
You can also ask us to delete everything by email; see Delete your data.
9. Your rights
Depending on where you live, you can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, or to move it to another service. Where we rely on your consent you can withdraw it at any time; this does not affect what we did before. As a parent or guardian you can make these requests for your child.
Email privacy@slumberpal.app. We reply within one month, and tell you within that month if we need longer and why. We may ask you to sign in or confirm details to protect your family from someone pretending to be you.
We make no decisions about you or your child by automated means that have legal or similarly significant effects. For custom pals, automatic checks only flag what they find; a person makes every decision to reject a photo.
If you are unhappy with how we handle your information, please tell us first. You can also complain to your data protection regulator. In the UK that is the Information Commissioner’s Office (ico.org.uk, 0303 123 1113); in the EU it is the supervisory authority in your country.
10. Security
We protect information with access controls, separate roles for each adult, encryption in transit and at rest, short-lived links to private files, monitoring and audit logs. No system is perfectly secure, so please keep your devices and sign-in secure.
11. Changes to this notice
If we change this notice, we will publish the new version here with its date. If a change matters to how we use your or your child’s information, we will tell you in the app before it takes effect and ask for your consent again where it is needed.