GDPR Compliant
Privacy Policy.
Last updated: [publication date] · Version 1.0 · Questions? Get in touch.
1. Data Controller
The data controller responsible for your personal data is:
Jebby — co-parenting platform
Controller: José Salgueiro
Address: Portugal
Email: legal@jebby.app
Jebby is currently in launch phase, with formal legal entity registration underway. This policy is valid and binding from the date of publication.
2. Data We Collect
Jebby collects only the data necessary to provide the co-parenting service.
Adult user data
| Category | Data collected | Required |
|---|---|---|
| Identity | Full name, email address | Required |
| Authentication | Google Sign-In or OTP email authentication data | Required |
| Profile | Profile photo (optional) | Optional |
| Analytics | App usage data, device, OS, session identifiers | Automatic |
Children's data
Jebby does not collect data directly from minors. Data relating to children — name, custody schedule, and any health information relevant to co-parenting coordination — is entered exclusively by parents or legal guardians.
3. Legal Basis and Purposes
| Purpose | Legal basis (GDPR) |
|---|---|
| Account creation and authentication | Performance of contract (Art. 6(1)(b)) |
| Service delivery — calendar, sync, events, child profiles | Performance of contract (Art. 6(1)(b)) |
| Push notifications about schedule changes | Performance of contract (Art. 6(1)(b)) |
| Children's health data for parental coordination | Explicit consent (Art. 9(2)(a)) |
| Analytics and service improvement | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not use your data for direct marketing without consent. We never sell data to third parties.
4. Children's Data
Jebby is designed for parents and legal guardians. Minors are not permitted to create accounts on the platform.
Data relating to children is entered by parents, who are the sole account holders and responsible for managing that data. They can delete it at any time.
Jebby applies technical measures to ensure that children's data is not accessible to unauthorised third parties, including the other parent, except in features explicitly shared between co-parents.
5. Sharing with Third Parties
Authentication services: Jebby uses Google Sign-In. Google LLC processes authentication data according to its own Privacy Policy. Jebby only receives name, email and Google account identifier.
Sharing between co-parents: Some information (calendar, events, swap requests) is shared with the other parent — this is inherent to the service and always controlled by the user. We never share data with external third parties without consent.
Infrastructure: Subcontractors are selected with mandatory GDPR compliance, Data Processing Agreements, and a preference for EU-based servers. This policy will be updated with the full subcontractor list once the technical infrastructure is finalised.
6. International Transfers
Where any service involves transfer of data outside the EEA, we ensure GDPR safeguards apply: adequacy decision (Art. 45), Standard Contractual Clauses (Art. 46(2)), or equivalent mechanism.
Google Sign-In is provided by Google LLC (USA), certified under the EU-US Data Privacy Framework — a valid adequacy decision.
7. Data Retention
| Data type | Retention period | Justification |
|---|---|---|
| Account data | Duration + 30 days after deletion | Performance of contract |
| Calendar and custody schedule | Duration of account | Service delivery |
| Children's health data | Until consent is withdrawn | Consent |
| Analytics | 13 months | Legitimate interest |
| Security logs | 12 months | Service security |
8. Your Rights (GDPR)
Under GDPR, you have the following rights. Most can be exercised directly in the app:
Right of access
Obtain a copy of your personal data processed by Jebby.
Right to rectification
Correct inaccurate data in your account settings.
Right to erasure
Delete your account and all associated data — available in the app.
Right to portability
Receive your data in a machine-readable format (JSON/CSV).
Right to object
Object to processing based on legitimate interest (analytics).
Right to restriction
Temporarily suspend processing in cases provided for under GDPR.
Withdrawal of consent
Withdraw consent for children's health data at any time.
Right to complain
Lodge a complaint with the CNPD in Portugal.
Contact us at legal@jebby.app. We respond within 30 days, extendable by 60 days in complex cases.
9. Security
- Encryption in transit: all communications protected by TLS 1.2 or higher
- Secure authentication: Google Sign-In with OAuth 2.0 tokens and OTP email verification
- Restricted access: only staff with operational need, under confidentiality obligations
- Security testing: periodic reviews before each release
In the event of a breach, we notify the CNPD within 72 hours and affected users without undue delay, as required by GDPR Art. 33 and 34.
10. Cookies
| Type | Purpose | Duration |
|---|---|---|
| Essential | Authentication, session security, preferences | Session / persistent |
| Analytics | Usage analysis and service improvement (subject to consent) | 13 months |
We do not use advertising or third-party tracking cookies for commercial purposes.
11. Changes to this Policy
For material changes, we notify registered users by email with a minimum of 30 days' notice. Continued use after that period implies acceptance of the updated policy.
Version history is available on request at legal@jebby.app.
12. Contact and Supervisory Authority
For privacy-related questions or to exercise your rights:
legal@jebby.app — response within 30 working days.
Supervisory authority (Portugal):
Comissão Nacional de Proteção de Dados (CNPD)
Rua de São Bento, nº 148-3.º, 1200-821 Lisboa
www.cnpd.pt · geral@cnpd.pt
© 2026 Jebby. All rights reserved.