Privacy Policy
Last updated: September 2026
This policy exists in German and English. The controlling company is a German sole proprietorship, and German law applies. In case of any discrepancy between the two versions, the German version is authoritative.
1. Controller {#s1}
DoryAI
Georg Ortner
Rigaer Straße 47A
10247 Berlin, Germany
Email: georg@dory-ai.com
2. Overview {#s2}
Nura Sleep is a platform for family sleep and lactation consulting. Parents use the mobile app to log their child’s sleep, feeding and activity data. Coaches use the web dashboard to support families. This privacy policy applies to the app, the dashboard and this website.
3. What data we collect {#s3}
3.1 Account data {#s3-1}
At registration: email address, name, role (parent or coach). For coaches, additionally: preferred language and an optional free-text note about their practice or website, which we use to review the account before activating it. For parents, additionally: the child’s name and date of birth.
3.2 Log data (events) {#s3-2}
Parents record data about their child’s day: sleep times (night sleep, naps), meals (type, duration), activities and notes. This data is stored in a structured form.
3.3 Voice recordings {#s3-3}
Parents can create log entries by speaking. The audio file is sent to our transcription provider and automatically deleted after 30 days.
3.4 Chat messages {#s3-4}
Messages between parents and coaches are stored to enable the coaching communication.
3.5 Technical data {#s3-5}
Device type (iOS/Android), anonymised error reports, and push-notification tokens used to deliver notifications.
4. Purpose of processing {#s4}
- Providing the coaching platform (performance of contract)
- Logging the child’s day for sleep/lactation coaching
- Communication between parents and coaches
- Improving the application and fixing errors (legitimate interest)
5. Legal bases {#s5}
- Art. 6(1)(b) GDPR — Performance of contract: the processing is necessary to provide our service.
- Art. 6(1)(f) GDPR — Legitimate interest: fixing errors, security and improving the application.
6. Processors and third-party providers {#s6}
We use the following providers, who process data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, realtime communication | Frankfurt, EU |
| Render | Hosting (API server, dashboard, this website) | Frankfurt, EU |
| Groq | Speech transcription (audio to text) | USA |
| OpenRouter | AI text processing (data extraction from text input); routes requests to the model providers Google and, as a fallback, OpenAI | USA |
| Expo | Push notifications (device tokens only) | USA |
| Sentry | Error monitoring (anonymised technical data) | EU |
| Pydantic (Logfire) | Application monitoring and logging (technical data; for administrative actions also coaches’ email addresses) | EU |
| Resend | Email delivery (parent invitations, the coach activation email, and an internal overview of coaches awaiting activation, including their signup details) | Ireland, EU |
Only text input is sent to Groq and OpenRouter (including the model providers behind it) for processing. Personal data such as names or email addresses is never passed to AI services. Audio files are sent only for transcription and are not stored permanently.
7. Data storage {#s7}
All data is stored primarily in the EU (Frankfurt, eu-central-1). Voice recordings are automatically deleted after 30 days. Account data is kept for as long as the account is in use and deleted on request.
8. Your rights {#s8}
Under the GDPR, you have the following rights:
- Access (Art. 15) — what data we hold about you
- Rectification (Art. 16) — correction of inaccurate data
- Erasure (Art. 17) — deletion of your data
- Data portability (Art. 20) — export of your data in a common format
- Objection (Art. 21) — objection to certain processing
- Complaint — you may contact your competent data protection authority at any time
9. Data security {#s9}
We use technical and organisational measures to protect your data: encrypted transmission (TLS), database-level access control (Row Level Security) and secure authentication.
10. Children {#s10}
Nura Sleep processes children’s data (name, date of birth, daily log) only at the instruction and with the consent of a parent or legal guardian. Children do not use the app themselves.
11. This website (nura-sleep.app) {#s11}
This website is a static page with no login. It is hosted by Render as a static site, which produces technically necessary server logs (e.g. IP address, timestamp, page requested) for security and error analysis (Art. 6(1)(f) GDPR). This website sets no cookies, uses no analytics or tracking tool and has no forms, and loads no fonts or other content from third parties — all fonts are served from this site. The link to the dashboard leads to coach.nura-sleep.app, to which sections 2 through 10 of this policy apply.
12. Contact {#s12}
For privacy inquiries, please contact:
DoryAI · Georg Ortner
Email: georg@dory-ai.com