Early version — the service is just launching. Some features may be unstable.
Last updated: 7 May 2026
We care about transparency. In short: we collect only the data necessary for the service to work, we do not sell it to anyone, children's names are anonymised before being passed to AI models, and you can export or delete your data at any time.
The controller of your personal data is:
Szymon Wąsik Systemy Informatyczne, ul. Stalowa 34/34, 05-800 Pruszków, Poland, NIP 7792188559, REGON 528805350, phone +48 572 514 230, GDPR email: rodo@misjarodzina.ai, general email: kontakt@misjarodzina.ai.
We have not appointed a Data Protection Officer (DPO) because we are not required to (see the DPO-need analysis). Send any questions about personal data to rodo@misjarodzina.ai.
| Data category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, Google ID | Authentication, communication with you | Art. 6(1)(b) – contract performance |
| Date and time of registration, terms acceptance | Demonstration of consent and contract performance | Art. 6(1)(c) – legal obligation |
| Preferred parenting style | Personalisation of AI Assistant responses | Art. 6(1)(b) – contract performance |
| Subscription status | Management of access to paid features | Art. 6(1)(b) – contract performance |
We collect only the data necessary for the AI Assistant to operate (data minimisation principle):
| Data | Notes |
|---|---|
| Child's alias / first name | First name or invented alias only – never a surname. Before being sent to AI, replaced with the [CHILD:<grammatical-form>] placeholder (e.g. [CHILD:nom], [CHILD:dat]) — the mechanism handles full Polish inflection. |
| Month and year of birth | Used to tailor advice to the child's age. We collect month and year only – the exact date of birth is neither required nor stored. |
| Main parenting challenge | Picked from a predefined list. |
| Neurodiversity notes (optional) | Provided voluntarily; may constitute sensitive data (GDPR art. 9) – processed solely on the User's explicit consent for the purpose of personalising advice. |
We store the content of conversations to give you access to history and to continue threads. Conversations are linked to your account and child profile. Legal basis: GDPR art. 6(1)(b).
Assistant response ratings (👍/👎): If you mark an assistant response as helpful or unhelpful, we store that rating with the message ID. The rating can be changed or removed at any time by clicking again. If you submit a rating, you authorise us to review the entire context of that conversation (including earlier messages in that session) solely to improve the quality of assistant responses. No conversation content is passed to third parties for this purpose; the review is performed exclusively by the Family Mission team. Legal basis: GDPR art. 6(1)(f) (legitimate interest – service improvement).
Full card processing (card number, CVV, 3-D Secure authentication data) is performed exclusively by our payment provider — Stripe Payments Europe, Limited. We do not store or process card numbers. On our side we store:
Legal basis: GDPR art. 6(1)(b) (contract performance) and art. 6(1)(c) (legal obligation — accounting records under the Polish Accounting Act).
After the first successful payment, we retain the reference that allows automatic charges, returned by Stripe (a payment-method identifier attached to the Stripe customer). This reference:
Legal basis: GDPR art. 6(1)(b) (contract performance — recurring billing). You can cancel your subscription in account settings at any time — the reference will then no longer be used for new charges.
We automatically record IP addresses, browser type, and session identifiers for security and diagnostics. Logs are kept for up to 12 months. Legal basis: GDPR art. 6(1)(f) (legitimate interest – system security).
To measure how users use the Service, we use Vercel Web Analytics. The tool does not use cookies and does not create persistent identifiers that allow users to be tracked across sessions. The information collected includes: URL of the visited page, referrer, device and browser type, and a short-lived identifier generated from a hashed IP address (rotated daily). On that basis we produce only aggregated traffic statistics – they do not allow identification of a natural person. Legal basis: GDPR art. 6(1)(f) (legitimate interest – evaluation and improvement of the Service).
[CHILD:<grammatical-form>] — the mechanism handles Polish inflection (7 cases), diminutives, and typos. After the response is received, the placeholder is mapped back to the name in the correct form. AI models never receive the real name or the exact date of birth of your child — only the month and year of birth.We use external services as data processors within the meaning of GDPR art. 28. We have concluded appropriate data processing agreements with them.
eu-central-1). The direct data transfer takes place entirely within the EU.__cf_bm used exclusively for bot protection. The cookie is technically necessary and is not used for profiling or advertising.kontakt@misjarodzina.ai and rodo@misjarodzina.ai mailboxes that receive correspondence from Users exercising the right of contact with the controller (including requests under GDPR art. 15–22).We promote the service through Google Ads — campaigns appear in Google Search and across Google's display network outside of misjarodzina.ai. We do not place any ads on the site itself (no Google AdSense, no Meta Pixel) and we do not collect data for remarketing or conversion-measurement purposes.
When you click our ad and land on the site, the URL may contain a ?gclid=... parameter — that is an identifier assigned by Google for click attribution on the Google Ads side. We do not use this parameter on our side (no conversion tag), we do not store it and do not link it to your account.
Google Ads is not a data processor acting on our behalf — that's a B2B relationship between the controller and Google as an advertising platform.
| Data | Infrastructure provider | Location |
|---|---|---|
| Accounts, child profiles, conversation history | Supabase (PostgreSQL) | EU – Frankfurt (AWS eu-central-1) |
| Generated PDF files | Cloudflare R2 | EU |
| Vectors (knowledge base) | Supabase pgvector | EU – Frankfurt |
| User interface, aggregated traffic statistics | Vercel Inc. | USA (SCC + DPA) |
| API layer (backend application code) | Render Services, Inc. | USA (SCC + DPA) |
| DNS, CDN proxy | Cloudflare, Inc. | Global network (SCC + DPA) |
| Authentication email delivery logs | Resend, Inc. | USA (SCC + DPA) |
| Payment data (subscriptions) | Stripe Payments Europe, Limited | Ireland (EEA) |
| Invoice data | inFakt Sp. z o.o. | Poland (EEA) + AWS USA (sub-processor, SCC) |
| Correspondence (kontakt@, rodo@) | Google Workspace (Gmail) | Workspace Data Region: Europe (SCC + DPF) |
| Data category | Retention period |
|---|---|
| Account data and child profiles | Until account deletion + a 30-day grace period (for removal from backups) |
| AI Assistant conversation history | Until account deletion, or earlier on request |
| Generated PDF files | Until account deletion, or earlier on request |
| Accounting records (invoices, payments) | 5 years from the end of the tax year (legal obligation) |
| Reference for automatic charges (Stripe) | Until subscription cancellation + 24 months, or immediately on request to rodo@misjarodzina.ai |
| Technical and security logs | 12 months |
| Correspondence to rodo@misjarodzina.ai | 3 years from the last message in the thread |
| Data on the Anthropic / OpenAI side | Up to 30 days (provider policy) |
We do not sell or rent your personal data. We share data exclusively:
As a data subject you have the following rights:
| Right | What it means |
|---|---|
| Access (art. 15) | You may request a copy of the data we hold about you. |
| Rectification (art. 16) | You may ask us to correct inaccurate data. |
| Erasure (art. 17) | The “right to be forgotten” – you may request deletion of your data. We will erase it unless the law requires us to retain it. |
| Restriction of processing (art. 18) | You may request restriction of the processing of your data. |
| Portability (art. 20) | You may export your data in a structured format (JSON) via account settings or by email request. |
| Objection (art. 21) | You may object to processing based on the controller's legitimate interest. |
| Complaint to the supervisory authority | You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. |
To exercise the rights above, write to rodo@misjarodzina.ai. We will respond within 30 days.
The Service uses only technically necessary and functional (first-party) cookies. We do not use analytical, advertising, or third-party tracking cookies. The traffic measurement tool we use (Vercel Web Analytics, described in points 2.6 and 4.4) also does not write any cookies. Below is the full list of cookies used in the Service:
| Cookie name | Provider | Purpose | Lifetime |
|---|---|---|---|
sb-<project>-auth-token | Supabase Auth | Stores the authentication session token. Necessary to keep you signed in between pages. | Until sign-out or session expiry (max 7 days) |
sb-<project>-auth-token-code-verifier | Supabase Auth | PKCE verifier used during Google OAuth sign-in. Removed after the sign-in flow completes. | Duration of the OAuth flow (a few minutes) |
__cf_bm | Cloudflare | Set when the domain is behind the Cloudflare proxy layer. Used solely for bot protection. Not used for profiling or advertising. | 30 minutes from the last request |
active_child | Family Mission (first-party) | Functional cookie. Remembers which child profile is currently selected in the dashboard so we can filter the content shown. Stores only the selected profile's identifier and is set after your action. | 1 year |
NEXT_LOCALE | Family Mission (next-intl) | Functional cookie. Remembers your chosen interface language (Polish, English, Spanish). | 1 year |
Local Storage (technology related to cookies): the cookie_notice_dismissed key (boolean value) remembers that you dismissed the information banner so we don't show it again. The value does not identify the user.
The cookies above are either technically necessary to provide the service you've requested (sign-in, session persistence) or functional — they remember your preferences (chosen language, selected child profile) and are set only in response to your actions in the Service. They are first-party cookies that are not used for tracking. Under art. 173(3) of the Polish Telecommunications Act and recital 25 of the ePrivacy Directive, the use of technically necessary cookies does not require your consent – we are only required to inform you of their use, which we hereby do.
You can remove or block cookies in your browser settings. Note that blocking the above cookies will prevent sign-in to the Service.
Instructions for popular browsers:
We will notify you of material changes to the Privacy Policy by email at least 14 days in advance. The date of the most recent update is always visible at the top of this page.
For matters concerning personal data protection, please contact us:
Szymon Wąsik Systemy Informatyczne, ul. Stalowa 34/34, 05-800 Pruszków, Poland, NIP 7792188559, REGON 528805350, phone +48 572 514 230, GDPR email: rodo@misjarodzina.ai, general email: kontakt@misjarodzina.ai.