Creative Apps Lab ("we", "us", or "our") operates the WonderBaby AI mobile application and related web services (the "Service"). We are committed to upholding the highest standards of digital privacy and data protection across all jurisdictions in which our users reside, including India (under the Digital Personal Data Protection Act, 2023 — DPDP Act), the European Union/United Kingdom (under the GDPR / UK GDPR), and the United States (under COPPA and state privacy regulations).

Please read this Privacy Policy carefully to understand how your data is processed, how our Bring-Your-Own-Key (BYOK) architecture safeguards your privacy, and how you can exercise your statutory rights.

1. INFORMATION WE DO NOT COLLECT (OUR PRIVACY-FIRST PROMISE)

Your privacy is our top priority. We have engineered WonderBaby AI with a strict privacy-by-design, zero-server-retention architecture:

Zero Server Photo Storage: We do not upload, store, or sell your uploaded parent photos, facial images, or generated baby portraits on any proprietary servers owned by Creative Apps Lab.
No Account Registration Required: You do not need to create an account, log in, or provide personal credentials (such as name, phone number, or social media handles) to use the core features of the application.
No Facial Recognition or Biometric Databases: We do not construct facial templates, biometric recognition profiles, or cross-identity tracking databases from user photos.
No AI Model Training on User Photos: Your photos are never used by Creative Apps Lab to train, fine-tune, or develop artificial intelligence models.

2. INFORMATION WE PROCESS ON YOUR DEVICE

To provide the features of WonderBaby AI, the application processes data locally on your device:

Photos Selected by You: Photos chosen from your device gallery or captured with your camera are held temporarily in local session memory solely to synthesize AI predictions.
Generated AI Portraits & Magic Gallery: All generated baby pictures, growth milestones, and style renders are saved exclusively to your local device storage (Android Room DB / iOS Local Storage).
API Keys (BYOK Model): If you provide your own API key (e.g., Google Gemini API, OpenAI, Claude, OpenRouter), the key is stored securely in encrypted local device storage (EncryptedSharedPreferences / KeyStore). It is used exclusively to authenticate direct HTTPS requests from your device to your selected AI provider and is never transmitted to Creative Apps Lab servers.
Saved Baby Names & Preferences: Favorite baby names, cultural filters, and search history are saved 100% locally on your smartphone.

3. THIRD-PARTY AI PROVIDERS & DIRECT TRANSMISSION

When you initiate an AI generation request, your selected photos and style prompts are transmitted over secure, end-to-end encrypted HTTPS directly from your client application to your selected third-party AI provider (e.g., Google Gemini API, OpenAI API, Anthropic Claude API):

Third-party AI providers process input data strictly as Data Processors to generate the requested output image in real-time.
We recommend reviewing the data privacy policies of your selected AI provider:
Google Privacy Policy & DPA•OpenAI Privacy Policy•Anthropic Privacy Policy

4. NON-PERSONAL ANALYTICS & ADVERTISING

To keep the application accessible and diagnose technical issues, WonderBaby AI may use third-party SDKs (such as Google AdMob and Firebase Crashlytics) to display non-intrusive ads and collect aggregate, pseudonymized diagnostic reports:

Device hardware model, operating system version, and screen resolution.
Anonymous mobile advertising identifiers (e.g., Google Advertising ID).
Coarse regional location (country or state-level, never precise GPS).
Crash logs, stack traces, and app stability diagnostics.

⚙️ You can reset or opt out of personalized advertising at any time through your Android device settings under Settings ➔ Privacy ➔ Ads.

5. DATA INVENTORY, RETENTION & DELETION SCHEDULE

In accordance with the data minimization mandates of the DPDP Act 2023 and GDPR, we maintain a strict Data Inventory and automated retention schedule:

Data Field	Processing Purpose	Retention Period	Storage Location
Parent Photos	AI Baby Face Synthesis	0 Days (Session memory only)	Local Device RAM only
Generated Portraits	Personal Magic Gallery	Until user deletes or uninstalls	Local SQLite / Room DB on device
BYOK API Keys	Direct AI authentication	Until cleared by user	Encrypted on-device hardware Keystore
Server Route Logs	DDoS & Rate-Limiting Defense	Max 90 days (Auto-purged)	Edge Proxy (Vercel/Cloudflare)

Self-Service Erasure: You can delete any saved portrait, name favorite, or API key at any time in the app settings or gallery.
Permanent Deletion: Uninstalling WonderBaby AI permanently and instantly purges all local databases, cached images, and cryptographic keys from your device.

6. INDIA: DPDP ACT 2023 COMPLIANCE & DATA PRINCIPAL RIGHTS

If you are located in India, your personal data is protected under the Digital Personal Data Protection Act, 2023 (DPDP Act 2023). Creative Apps Lab acts as a Data Fiduciary, and you hold enforceable statutory rights as a Data Principal.

A. Lawful Basis & Explicit Granular Consent (Sec. 6)

All data processing is conducted solely on the basis of your freely given, specific, informed, and unconditional consent. We do not rely on implicit consent or pre-ticked opt-ins. You may withdraw consent at any time with a single tap in app settings.

B. Enforceable Statutory Rights (Sec. 11, 12, 13 & 14)

Right to Access & Information (Sec. 11): Right to obtain a plain-language summary of data processed, storage durations, and third-party processors.
Right to Correction & Erasure (Sec. 12): Right to rectify inaccurate data or request complete erasure across all systems within 30 days.
Right to Grievance Redressal (Sec. 13): Right to have grievances redressed by our designated Grievance Officer within 30 days.
Right to Nominate (Sec. 14 — India Specific): Under Section 14 of the DPDP Act 2023, every Data Principal has the legal right to designate a nominee to exercise data rights on their behalf in the event of death or incapacity. You or your authorized nominee may register or submit a claim by contacting our Grievance Officer with the subject line "[DPDP Right to Nominate]".

C. Children's Data Safeguards (Sec. 9 DPDP Act)

Under Section 9 of the DPDP Act 2023, any individual under 18 years of age is recognized as a child. WonderBaby AI enforces strict compliance:

The service is intended for adult parents, expecting couples, and legal guardians (18+).
If a parent uploads a photograph of a minor child for family milestone generation, the parent represents that they possess full verifiable parental/guardian consent.
We enforce ZERO behavioral tracking, ZERO profiling, and ZERO targeted advertising directed at children or child-related sessions.

D. Cross-Border Data Transfers (Sec. 16)

Transfers of data to global AI endpoints (such as Google LLC in the USA) comply with Section 16 of the DPDP Act 2023 and occur exclusively to non-blacklisted jurisdictions under active Data Processing Agreements (DPAs).

7. EUROPE: GDPR & UK GDPR COMPLIANCE

For users residing in the European Union (EU), European Economic Area (EEA), or United Kingdom (UK), personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and the UK Data Protection Act 2018:

Lawful Basis: Processing of photos and prompts is based on your explicit consent (Art. 6(1)(a) & Art. 9(2)(a) GDPR).
Data Subject Rights: You possess the right to access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object (Art. 21).
International Transfers: Trans-border transfers to third-party AI APIs in the United States are governed by Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework.
Right to Lodge Complaint: You have the right to lodge a complaint with your local EU/EEA Data Protection Supervisory Authority.

8. UNITED STATES: COPPA & STATE PRIVACY RIGHTS (CCPA/CPRA)

A. Children's Online Privacy Protection Act (COPPA)

WonderBaby AI is designed for adult parents and expecting families. We do not knowingly collect personal identifiable information from children under the age of 13. If you believe an unaccompanied child under 13 has provided personal data, contact us immediately for prompt deletion.

B. California Consumer Privacy Act (CCPA / CPRA)

No Sale of Personal Data: We do not sell or share your personal data or facial photos for monetary or other commercial consideration.
Right to Know & Delete: California residents have the right to request disclosure of categories of personal information collected and to request deletion without discriminatory treatment.

9. DATA BREACH NOTIFICATION PROTOCOL (72-HOUR SLA)

We implement robust technical and cryptographic safeguards to protect against unauthorized access. In the unlikely event of a confirmed personal data breach affecting our systems:

We will notify the Data Protection Board of India within 72 hours of confirmation, in compliance with Section 8(6) of the DPDP Act 2023.
We will promptly notify relevant European Supervisory Authorities under Article 33 GDPR.
Affected Data Principals will be notified directly with clear descriptions of the nature of the breach, potential impact, and mitigation steps taken.

10. DESIGNATED GRIEVANCE OFFICER & STATUTORY CONTACT

In compliance with Section 8(10) of the DPDP Act 2023 and applicable IT Rules, Creative Apps Lab has appointed a designated Grievance Officer to handle user inquiries, DPDP Data Principal rights requests, nomination claims, and privacy complaints:

Designated Grievance Officer: Mitesh Viras (Privacy & Regulatory Compliance)

Entity: Creative Apps Lab

Direct Grievance Email: creativeappslab29@gmail.com

Subject Format for Priority Handling: [DPDP Grievance] / [DPDP Nominate] / [GDPR Request]

Statutory Resolution SLA: All grievances are formally acknowledged within 48 hours and fully resolved within 30 calendar days.

Official Privacy Policy

Table of Contents