Effective from 1 October 2026
Privacy policy
Children’s data deserves special care. This document explains in plain language what data we collect, why, how long we keep it and what your rights are. If anything is unclear, write to our data protection officer.
Who is the data controller
The controller of your personal data is Parento sp. z o.o., ul. Ząbkowska 27/31, 03-736 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register under KRS number 0001043218, tax ID (NIP) 113 318 74 23, REGON 521487303, share capital PLN 50,000 (Parento or we).
For anything related to personal data, contact our data protection officer at iod@parento.app, or by post to our registered address marked “Data protection”.
What data we process
We only collect what we need for the app to work.
- Account: email address, first name or nickname, encrypted password, language and time zone.
- Child profile: first name or nickname, date of birth, clothing size. Optionally: allergies and notes (e.g. body temperature), which may be health data.
- Location: approximate device location, only while the app is in use, or a town entered manually.
- Device data: temperature and humidity readings from a connected Bluetooth thermometer.
- Conversations with Tula: your questions and the answers.
- Subscription: plan type and payment status. We never see card details, payments are handled by Apple and Google.
- Technical data: device model, system and app version, error logs.
- Website: email address from the newsletter form, data from contact forms and the cookies described below.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and providing the app | Art. 6(1)(b) (performance of a contract) |
| Processing your child’s health data (allergies, notes) | Art. 9(2)(a) (explicit consent) |
| Location for weather forecasts | Art. 6(1)(a) (consent given in your phone settings) |
| Newsletter | Art. 6(1)(a) (consent) |
| Website and app analytics | Art. 6(1)(a) (consent) |
| Replying to messages and partnership requests | Art. 6(1)(f) (legitimate interest: communication) |
| Service security, establishing and defending claims | Art. 6(1)(f) (legitimate interest) |
| Accounting and tax | Art. 6(1)(c) (legal obligation) |
You can withdraw consent at any time in the app settings or by writing to us. Withdrawal does not affect the lawfulness of processing before it.
Children’s data
Only adults can create a Parento account. A parent or legal guardian enters the child’s data and decides what to share. We never require the child’s surname, and you can use a nickname instead of a first name.
We do not use children’s data for marketing, we do not profile children and we do not show ads.
The Tula assistant
We process the questions you ask Tula in order to prepare an answer. Answers are generated with a language model from a provider acting as our processor, on servers in the European Economic Area, under a data processing agreement.
Conversations are never used to train models. We keep them for 90 days so you can return to them, unless you delete them sooner. Tula’s answers are automated but do not produce legal effects for you within the meaning of Art. 22 GDPR.
Who we share data with
We only entrust data to vetted providers under data processing agreements:
- our cloud infrastructure provider (data centre in Frankfurt),
- our email delivery provider,
- our weather and air quality data provider (receives rounded coordinates only, no account data),
- the language model provider for Tula,
- analytics providers (only with your consent),
- our accounting firm.
Apple and Google process payment data as independent controllers under their own privacy policies. We may also disclose data to public authorities where the law requires it.
Transfers outside the EEA
We do not transfer data outside the European Economic Area. If this ever becomes necessary, we will rely only on a European Commission adequacy decision or standard contractual clauses, and we will tell you in the app.
How long we keep data
- Account and child profile: until you delete your account, then up to 30 days in backups.
- Conversations with Tula: 90 days or until you delete them.
- Accounting records: 5 years from the end of the year in which the tax obligation arose.
- Newsletter: until you withdraw consent.
- Contact form messages: 12 months after the conversation ends.
- Technical logs: 90 days.
Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. You can exercise most of these yourself in the app settings (data export, account deletion). For anything else, write to iod@parento.app and we will reply within one month.
You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, or with the authority in your country of residence.
Cookies on the website
The website uses browser storage for two purposes:
- essential: remembering your cookie choice (key
parento-consent), - analytics: counting visits and the most-read guides, only with your consent.
You can change your choice at any time with the “Cookie settings” button in the footer or in your browser settings.
Security
We use TLS 1.3 for connections and encrypt data at rest (AES-256). Only authorised staff can access data, with two-factor authentication. Once a year we commission independent security testing.
Changes to this policy
We will announce significant changes in the app and by email at least 14 days before they take effect. This policy applies from 1 October 2026.
Write to us and we will reply in plain language.