Explicit Consent Form

On the basis of the explicit-consent and disclosure obligations set out in the applicable privacy legislation, we need you to consent freely to the data processing activities described below so that we can provide the Growbaby mobile application and its services. This consent is obtained by you actively ticking the checkboxes on the sign-up screen; the consents you tick are recorded together with the version of the text you accepted and the date.

1. Age Declaration and General Policy Consent

By ticking the "I have read and accept the Terms of Service and the Privacy Policy" box on the sign-up screen, I declare and accept that I am over 18 and have legal capacity; that I have read and understood the Growbaby Terms of Service and the comprehensive Privacy Policy; and that I have been fully informed about how my own and my child's personal data, sensitive data and acoustic features derived from sound are processed.

2. Child Data and Verifiable Parental Consent

By ticking the "I am the parent or legal guardian of the child I register, and I give explicit consent for their development and health information to be processed to provide the service, as described in the Explicit Consent text" box on the sign-up screen, I declare and confirm that I am the legal parent or guardian of the child or children I register. For European and United Kingdom users, under GDPR Article 8, and for United States users, under Federal COPPA (16 CFR Part 312), I expressly consent to the collection, processing and storage by this application of the personal data, health and development information and media content of my child who is under 16 (or under 13 where local law so provides), and under 13 respectively. (Legal note for US users: this checkbox constitutes a Digital Self-Verification / Electronic Parental Declaration performed by you under COPPA, and no child data is collected without that declaration.)

3. Data Processing Categories and Preference Management

The processing activities under this form are carried out in three categories. You may manage your preferences for the non-mandatory activities at any time from within the app after sign-up:

A. Core service and mandatory processing. The processing of the basic identifiers (name, e-mail, account identifier) required to operate core account management, to obtain the parental declaration and to run security functions falls within the consent you give at sign-up. The service cannot be provided without this processing.

B. Growy AI chatbot conversation memory and personalization. Contextual memory is built from your conversations with the Growy assistant and stored on Supabase infrastructure in order to offer personalized parenting suggestions in later sessions. You can remove these memory records and all of your chatbot data at once and instantly using "Delete All Chatbot Data" under Profile > Manage My Data; you can delete the growth journal photos on your device using "Delete All My Photos" on the same screen. The content of a deleted record is permanently destroyed, and all that remains is a contentless marker that prevents the same information from being learned again from your chat history. When you delete your account, the memory is destroyed in full. Chatbot memory is not used for ad targeting or marketing and is not shared with any third party for those purposes.

C. Analytics and advertising attribution. You can turn off the processing carried out to measure which advertising campaign the app was installed from (Airbridge) and for product analytics (Mixpanel) at any time from Profile > Manage My Data > Share usage analytics. When that switch is off, both SDKs stop collecting data entirely. Access to the advertising identifier (IDFA) on iOS devices is separately subject to the App Tracking Transparency permission described in Article 9. Turning these preferences off, or declining tracking permission, does not prevent you from using the core features of the app.

4. Disclosure and Consent for Audio and Image Processing

4.1. Cry analysis (Edge AI). I understand that the sound signals captured through the device microphone in order to detect my baby's crying and generate the soothing sound are processed only on the device (Edge AI) as instantaneous acoustic frequency features (Hz); that no "voiceprint" or persistent audio file is created; and that the raw audio recording never leaves the device under any circumstances. I also know that, for as long as my "Contribute soothing research" preference described in Article 7 is on, numerical measurements derived from sound and containing no identity are transmitted to a separate research database.

4.2. Skin analysis and image processing. I consent to the photographs I upload to the Growy Chatbot Skin Analysis module being transmitted to and processed by the third-party AI provider (OpenAI API) over secure API bridges for instantaneous analysis, without being permanently stored on Company servers. I accept that no biometric facial recognition or facial geometry analysis whatsoever is performed in this process.

4.3. Notice for residents of Illinois, Texas and Washington. The application's audio analysis architecture does not create, store, transmit or disclose to third parties any voiceprint or any biometric identifier capable of identifying an individual. Because of this architecture, the creation or storage of a biometric identifier falling within the scope of the relevant biometric information protection laws (740 ILCS 14 and comparable regulations) is neither intended nor technically performed.

4.4. All images processed within the photo upload and video collage features that use camera and gallery access in the application are processed exclusively on the device (On-Device). On Android, selecting a photo from the gallery takes place through the operating system's own photo picker; only the file you select is passed to the app, and read access to your entire photo library is not requested. These images are at no stage transmitted to or stored on Company servers or cloud databases. I know that the data is not sold to third parties, and I consent to the activation of on-device permissions so that it may be processed to these local standards.

4.5. I expressly permit the photographs I upload when using the Growy AI chatbot in the application and the "Skin Analysis" module within the chatbot to be transmitted to and processed by the third-party AI provider (OpenAI) over secure API bridges for the purpose of instantaneous artificial-intelligence analysis and interpretation, on condition that they are not retained or stored by the Company.

4.6. I know and confirm that no "facial geometry" or biometric identification whatsoever is performed in this process and that the images are not sold to third parties. Those skin photographs are in no way written to disk or stored by the Company.

5. Sensitive Minor Data and Absolute Medical Disclaimer

Under the Washington My Health My Data Act (MHMDA) and CPRA for US users, and under GDPR for European and UK users, I expressly consent to the processing of the information I share through the chatbot (AI assistant) or enter in the profile area concerning illness, physical and mental condition, sleep and feeding patterns and my baby's developmental week (Consumer Health Data / Special Category Personal Data).

I fully understand that this system does not perform clinical diagnosis, triage or medical assessment, and that the weekly activity suggestions provided are pedagogical content for general information purposes. I know that I must consult a health professional (such as a pediatrician) on every significant matter concerning my child's health, and that I must seek medical help immediately in an emergency.

I understand that all risk and responsibility arising from actions I take in reliance on the artificial intelligence and system outputs rests with me, and that the answers given by the AI chatbot are in no way a clinical diagnosis, triage or medical assessment. Reserving the inalienable rights arising from the mandatory laws of my country of residence, and to the maximum extent permitted by applicable law, I accept and undertake that I hold the Growbaby application and the company that owns it harmless from medical and legal liability arising from my actions based on those outputs.

6. Consent to International Cross-Border Data Transfer

I know that the data-controller parent company is established in Turkey; that my data may be accessed by teams in Turkey for technical support and operational activities; that the primary database servers are located in the European Union (Frankfurt, Germany – Supabase) and the separate research database holding the research measurements derived from sound is likewise located in the European Union (Ireland); and that the artificial intelligence (API) processing servers are located in the United States (OpenAI). I expressly consent to my personal data being transferred across borders outside the European Economic Area (EEA) and the UK, to Turkey and the United States, and to being processed there.

7. Data Deletion, Retention and Preference Management Policy

The user always has the right to request the deletion of their personal data. Deletion can be performed instantly from the Profile > Delete Account menu in the app, or requested through the form at growbaby.ai/delete-account or through support@growbaby.ai.

Deletion process. When you delete your account, your data is deleted from our primary database systems instantly, completely and irreversibly (hard delete). Backup copies expire on their own within our infrastructure provider's backup cycle and are kept inaccessible during that period.

Exceptions to deletion. (i) In shared family structures, the family record and shared records are preserved by being transferred to the other caregiver in order to protect that caregiver's rights and data; (ii) subscription event records are retained for revenue tracking with their direct link to the personal account severed; (iii) subscription and attribution service providers (RevenueCat, Airbridge) may continue to hold user identifier records in their own systems subject to their own retention policies; (iv) copies in the backup infrastructure expire on their own within their cycle as described above. Apart from these, no personal data is retained in the system.

Subscription warning. Deleting your account does not by itself cancel a subscription running through the App Store or Google Play; you must cancel your subscription separately from the subscription settings of the relevant store.

Legal exceptions. A limited number of financial and transaction records subject to a retention obligation under the Tax Procedure Law, the Turkish Commercial Code or for the resolution of legal disputes may be retained for the period prescribed by the relevant legislation.

In-app preference management (opt-out). Our users can easily manage their research and data-sharing preferences from within the app at any time. Specifically:

Product analytics and attribution preference (Share usage analytics). When you turn off Profile > Manage My Data > Share usage analytics in the app, both the product analytics (Mixpanel) and the attribution SDK (Airbridge) stop collecting data entirely.

Sound research contribution preference (Contribute soothing research). This switch is a separate preference mechanism controlling the transmission of identity-free numerical research measurements derived from sound to the separate research database, and can be managed at any time from Profile > Manage My Data > Contribute soothing research. This contribution is on by default and can be turned off permanently at any time.

Operating-system level controls. For iOS devices: you can turn off "Allow Apps to Request to Track" under Settings > Privacy & Security > Tracking, or withdraw the permission for the specific app (Apple ATT Framework). For Android devices: you can disable ad personalization, reset or delete the advertising identifier (GAID) through the privacy or Google advertising options in your device settings. These operating-system controls and the in-app Share usage analytics switch are independent of one another: the ATT and advertising identifier controls govern only access to the advertising identifier, while the Share usage analytics switch governs data collection by the analytics and attribution SDKs.

Notice regarding third-party SDKs. Third-party attribution and analytics SDK providers may independently perform probabilistic attribution within their own technological infrastructure using parameters such as IP address, device configuration and timestamp; these activities fall within the relevant provider's own privacy policy. SNAIPER TEKNOLOJI A.S. does not have direct control over such server-side technical processing activities by third-party SDK providers. The data categories collected by the application itself are declared in the privacy manifest required by Apple. The manifest declarations of third-party SDKs are the responsibility of the relevant providers.

8. Notice Regarding the Development of Artificial Intelligence Models

As of today, your conversation content and personal data are not used by the Company to train artificial intelligence models. Our API provider OpenAI likewise, under its own published policy, does not use data transmitted through the API to train its models. The Company's own sound-cleaning model is developed solely from the identity-free research measurements collected under the "Contribute soothing research" preference described in Article 7. Should your personal data ever be used for any other model training purpose in the future, your separate and explicit approval will be sought before that use begins.

9. Advertising Attribution, Tracking Permission (ATT) and Analytics Consent

Attribution measurement is carried out through Airbridge and product analytics through Mixpanel, in order to determine which advertising channel the application was installed from, to optimize digital marketing budgets and to prevent ad fraud. The user identifier is transmitted to Mixpanel only as a hashed value.

9.1. iOS App Tracking Transparency (ATT) and the advertising identifier (IDFA). On iOS devices the application shows you a tracking permission screen under Apple's App Tracking Transparency (ATT) framework. Your device's advertising identifier (IDFA) is read only if you expressly grant permission on that screen, and is shared with our attribution provider (Airbridge) in order to measure which advertisement or link the installation came from. If you do not grant permission, or later withdraw it from iOS Settings > Privacy & Security > Tracking, the application does not access your advertising identifier and no advertising-identifier-based tracking is performed. On Android devices, the advertising identifier (GAID) is subject to the advertising identifier controls in the device settings.

9.2. Limited measurement carried out where permission is not granted. I am expressly informed that not granting or withdrawing tracking permission does not mean that all data processing ceases. Even in that case, attribution and analytics providers may perform limited measurement and probabilistic attribution within their own technological infrastructure, without using the advertising identifier, by means of device and installation identifiers they generate themselves together with non- advertising-identifier parameters such as IP address, device configuration and timestamp. These server-side processing activities are carried out within, and under the responsibility of, the relevant provider's own privacy policy. I may use Profile > Manage My Data > Share usage analytics to stop all analytics and attribution data collection within the app, and I may additionally take operating-system level measures (resetting the advertising identifier, using a VPN and so on) to limit measurement.

9.3. Scope of responsibility. The Company is obliged to perform the app-side requirements of my tracking permission choice (not accessing the advertising identifier unless permission is granted, and configuring the integrated SDKs in accordance with my permission status). I know and accept that the Company has no direct control over the processing activities that third-party providers (Airbridge, Mixpanel) carry out on their own server infrastructure, and that those activities are subject to the relevant provider's own terms of service, data processing agreements (DPA) and privacy policies. Reserving my rights arising from the mandatory laws of my country of residence, I accept that the Company cannot, to the maximum extent permitted by applicable law, be held responsible for provider conduct outside its control on account of these third-party processing activities, which are disclosed fully and transparently in this article. Exercising this preference or declining permission does not prevent me from using the features of the application, including the Pro subscription.

9.4. Subscription infrastructure (RevenueCat). The subscription management infrastructure (RevenueCat) is not an attribution or analytics tool and does not carry out "tracking" within Apple's definition; it operates as a necessary part of the performance of the contract in order to verify your purchase and subscription status, and for that reason cannot be turned off. Your card details never reach the Company; payments are made exclusively through the Apple App Store and Google Play Billing.

10. Withdrawal of Consent and Precedence of Mandatory Maximum Periods

The consents I give under this form are revocable. I know that I have the right to withdraw my consents and preferences in whole or in part (opt out) at any time through the relevant settings of the application or by sending an e-mail to support@growbaby.ai. Withdrawing consents that are mandatory for the provision of the core service results in the service not being provided and the account being deleted. Withdrawal of consent does not affect processing activities lawfully carried out up to that point.

When a user deletes their account or withdraws this explicit consent, their personal data in our primary systems is deleted instantly and irreversibly. That said, other than the exceptions of (i) the necessity of protecting the rights and data of the other caregiver in shared family structures, (ii) subscription event records whose direct link to the personal account has been severed, (iii) user identifier records held by subscription and attribution service providers (RevenueCat, Airbridge) in their own systems, and (iv) the temporary retention periods within the backup infrastructures' own cycles, all data is completely removed from the primary database. I understand and approve this.

11. Independence, Divisibility and Severability of Consents

Each consent obtained under this form and each preference managed through the application settings (health data processing, cross-border transfer, analytics and attribution, research contribution and so on) is independent, separable and subject to independent legal consequences. Should any consent article or sub-clause be found invalid, excessive or unlawful by a competent data protection authority (for example EU Data Protection Boards, the ICO, the FTC) or by a court, that invalidity will remain limited to the article concerned and will in no way impair the legal validity of the other consents given and preferences made by the user.

12. Updates to This Consent Form

The explicit consents given under this form may be updated by the Company in line with technical changes to the artificial intelligence (Growy AI), skin analysis or data processing infrastructures offered by the Company, or in line with the Company's own legal compliance policies. Wording corrections, formatting changes and updates that describe existing practice more clearly are not treated as material changes. Where, by contrast, a material revision is made that expands the scope of data processing or changes the way sensitive personal data (such as health data) is processed, implied (silent) consent is not applied to users. Such changes will be notified to users within the application and, where mandatory laws so require, users will be actively asked to consent again before the expanded processing begins. Until the user actively approves the new consent form, the Company may only continue processing data within the limits of the consent the user previously gave, or may suspend the new technical features for that user.

13. Medical Disclaimer

Growbaby is a general wellness and parenting-support tool. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Everything generated in this app, including Growy AI answers, cry analysis, skin analysis, and sleep or development suggestions, is produced by artificial intelligence, is probabilistic in nature, and may be incomplete or inaccurate. It is intended for general informational purposes only and is never a substitute for the professional judgment of a pediatrician or other qualified healthcare provider. Always consult a healthcare professional with any questions or concerns about your baby's health, and never delay or disregard professional medical advice because of something you see in this app. If you believe your baby may be experiencing a medical emergency, call your local emergency number immediately.

By continuing, you acknowledge and accept these limitations.

For the full picture please also read our Privacy Policy and App Terms.