Privacy Policy
Last revised: 11 November 2026.
Who is responsible
Nudli is operated by COGNIOPS STUDIO LTD, company number 16884405. Registered office and legal correspondence: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact support@nudli.co for service or privacy questions. We are responsible for deciding how Nudli account and family information is used.
Information we use
For parents and carers, we use account email, display name, authentication and session information, account settings and support correspondence. Security records support verified email, personal invitations where applicable, Parent PIN protection, independent recovery and abuse prevention.
For children, we use nicknames, broad age bands, illustrated avatars, routines, instructions, schedules, recorded steps and assistance choices, parent reviews, goals, achievements and optional family rewards. Please do not enter full child names, schools, exact birth dates, diagnoses or health information. Free text can still reveal sensitive information: contact us if it needs removing. Nudli is an organisational tool, not a medical or safeguarding assessment service.
For membership, we use plan, immutable personally addressed contract/cancellation confirmations and accepted terms, trial and coverage dates, Stripe customer/invoice/payment identifiers and verified payment or reconciliation status. Stripe handles card details; Nudli does not store complete card numbers or card security codes. A protected payment-method fingerprint supports trial/referral abuse prevention. Historical reservations remain separate; they are not automatically converted or charged.
Why we use it and our lawful bases
| Purpose | Basis |
|---|---|
| Provide a parent's requested account, membership and essential account emails | Performance of the contract with the parent, including requested steps before joining |
| Provide child routines, progress and parent-controlled rewards | Legitimate interests in providing the requested family service, subject to a documented assessment giving particular weight to children's rights and best interests |
| Secure access, verify identities, enforce Parent Mode, prevent misuse and investigate incidents | Legitimate interests in protecting families and the service; a particular legal obligation only where one actually applies |
| Keep required accounting/tax records | Legal obligation |
| Handle complaints and necessary financial or contractual evidence | Contract, legal obligation where applicable, or legitimate interests in resolving and defending claims |
| Optional website analytics, advertising measurement or promotional email | Consent; optional and separate from access to family features |
We do not treat a parent's subscription as a blanket lawful basis for all children's information. We do not request health/diagnosis information. An incident involving such information requires separate assessment and appropriate handling; this notice does not authorise its routine collection.
Children, security and shared devices
Child Mode operates within the parent's family account; it is not a separate confidential account for each child. Parents can see their family's saved information. Parent settings, reviews and billing require the parent security checks. Explain this arrangement to children and secure shared devices. Children can select the permitted family profiles available in Child Mode; unrelated families must remain isolated.
Nudli uses server-side authorisation, database isolation, protected credential verification, session controls and encrypted connections. No system can promise absolute security. We do not use children's routine content for advertising or sell it. Family rewards and progress are separate from commercial referral rewards.
Providers and locations
We use Supabase for the new family application's authentication/database, Vercel for hosting and server-side processing, Stripe for payment processing, and Namecheap Private Email for transactional email. When billing is enabled, Healthchecks.io receives operational run identifiers and aggregate billing-health counts, not children's routine content. When public registration is enabled, Cloudflare Turnstile supports bot protection. Optional Google Analytics and Meta Pixel are limited to the marketing site after consent.
The new family database is in London, UK. This does not mean all processing stays in the UK: the observed Vercel application functions run in the US region iad1, and other providers may process internationally. Historical reservation systems are separate. Where a transfer to a separate recipient outside the UK requires protection, we use the applicable UK adequacy arrangements or approved contractual safeguards. You can ask us about the arrangements applicable to your information. Hosting a database in London alone does not mean all processing takes place in the UK.
Cookies, analytics and marketing
Essential cookies support authentication, security and requested account functions. Optional analytics and advertising measurement are not required to use family features and load only after acceptance on the marketing website. Child Mode must not load marketing trackers. We do not send child names, routine free text, passwords, PINs or recovery codes to analytics.
You can change your choice through Cookie settings in the website footer. Withdrawal stops subsequent optional loading; previously set provider cookies may remain until they expire or you clear them. Consent to website measurement is not consent to upload customer lists or to promotional email. We do not treat registration as marketing-email consent.
Our first-party limits are six months for consent preferences and 30 days for stored attribution. Provider-controlled storage and retention are explained in their own privacy information; these first-party limits are not a promise about all Google or Meta systems.
Retention, closure and erasure
Retention is reviewed and operated by the owner; Nudli does not currently offer an automatic account-reset or timed-purge system. Contact support@nudli.co to request closure or erasure. Archiving a routine or deactivating a child preserves history and is not erasure.
| Information | Retention and review |
|---|---|
| Family profiles, routines, goals and child activity | Keep for the active service. Our target is to remove unnecessary family content within 90 days of confirmed closure, after addressing continuing membership obligations. A valid erasure request is assessed sooner; the 90-day target does not postpone statutory rights. |
| Routine progress, assistance and achievements | Review after 24 months. Keep only if continuing family use justifies it; otherwise remove or de-identify. The closure target still applies. |
| Authentication, invitations, PIN/recovery and security records | Keep what is necessary for active access and security. For approved closure/erasure, invalidate invitations and admission, remove Parent PIN/recovery and application sessions, and remove unnecessary contact/profile information. Where no required dependency remains, permanently delete the Auth identity. Where necessary financial or legal evidence requires its identifier, use irreversible provider soft deletion to clear identifying Auth fields and credentials while preserving a restricted pseudonymous reference. Record the reason and review date for retained evidence; a database dependency alone is not a legal reason to keep it. |
| Ordinary operational logs | Target no more than 90 days in systems we control. Provider services may retain less or apply their own schedules; we do not promise a setting that a provider does not offer. |
| Support and Beta feedback | Review for removal 12 months after resolution. Separate any evidence that needs a justified longer retention period. |
| Contract confirmations, required accounting, payments and necessary financial audit | Normally six years from the end of the relevant company financial year, with longer periods where a specific legal requirement applies. Keep only the evidence required, including the accepted contract and cancellation evidence; this is not a reason to retain children's routine content. Contract confirmations contain account identifiers and terms, not child routine content, passwords, PINs or card details. |
| Other incident and abuse-prevention evidence | Retain only what is necessary for the identified incident or risk, with a recorded reason and next review date. No blanket accounting exception applies. |
| Owner-held encrypted backups | A rolling 90-day disposal target. Backups awaiting replacement or subject to a specific justified hold are recorded and reviewed. They are not used for ordinary account access. Relevant erasure restrictions must be reapplied before restored data is returned to service. |
| First-party marketing attribution and consent preferences | 30 days and six calendar months respectively. Optional provider-controlled analytics storage follows the applicable provider information and our configured choices. |
| Abandoned registrations, expired admissions and marketing preferences | Review for removal when no longer needed for admission, security or the recorded consent purpose; preserve only necessary suppression evidence after an opt-out. |
We verify the requester's authority, identify the affected records, and distinguish removable family content from necessary financial, security or legal evidence. Erasure can include associated routine history, goals and achievements when that is the approved scope; financial refunds do not automatically remove those records.
We respond without undue delay, normally within one calendar month, and explain any lawful extension, restriction or refusal. If some records must be retained, we explain the reason and applicable review or retention period. A pseudonymous identifier or payment reference can still be personal data. We retain it only for an identified necessary purpose and review period, not as an indefinite technical exception. Removal is verified in stages; an incomplete provider operation remains restricted and under owner review until its outcome is confirmed.
Where individual removal from an encrypted backup is not practical, it is restricted from ordinary use until disposal under the recorded backup schedule. A restore must account for subsequent erasure decisions. We do not promise immediate removal from every provider backup or full Supabase platform recovery. Requests affecting processors or separate historical reservation records are assessed with those recipients without automatically deleting required payment evidence.
Your choices and rights
You can ask for access, correction, erasure, restriction or portability where applicable, object to processing based on legitimate interests and withdraw consent for future optional processing. Children's rights belong to them; a parent may act where appropriate to the child's interests and understanding. Contact support@nudli.co. You may also complain to the Information Commissioner's Office at Information Commissioner’s Office.
We will update this notice when material processing changes. New uses of children's information or sensitive information require assessment and a suitable lawful basis, not an assumption that this notice permits them.