Privacy Policy

Introduction and who we are

Data Controller: Josh Thompson, trading as My Baby Steps.

Contact email: josh@eastern-web.com.

We are based in the United Kingdom and this policy is governed by UK GDPR and the Data Protection Act 2018.

Account data. Your email address and hashed authentication credentials, managed securely by Firebase Auth. We may also store your role or employment status if you choose to give it, to help calculate your entitlements.
Child and pregnancy data. Your child's first name or nickname, and their date of birth or estimated due date. We use this only to generate your milestone roadmap.
Billing data. Your customer ID, subscription status, and invoice history. This is processed securely by Stripe. Your full card number never touches our servers.
Calendar integration data. If you connect Google Calendar, we store an encrypted OAuth token and a unique calendar feed token so we can sync your deadlines.
Technical and usage data. We collect anonymous website analytics through Google Analytics 4, but only after you give consent through our cookie banner.

Performance of a contract. We use your data to generate your milestone roadmap, send the reminders you asked for, and manage your paid subscription.
Legitimate interests. We use your data to protect your account, prevent fraud, and keep the platform stable.
Consent. We only use non-essential cookies and analytics tracking with your consent, and you can withdraw this at any time.

Google Cloud Platform and Firebase, based in the EU and UK, for authentication and secure database hosting.
Stripe Payments UK Ltd, for payment processing, your customer portal, and billing management.
Resend, for transactional email such as waitlist confirmations and milestone reminders.
Google LLC, for Google Analytics 4 (only if you consent) and Google Calendar integration.

We only store your data for as long as your account stays active.

You can export all of your personal data at any time from your account settings.

You can permanently delete your account and your child's data at any time from your account settings. This is your right to erasure under UK GDPR.

You have the right to access, correct, delete, and receive a copy of your data, and to withdraw your consent at any time.

To exercise any of these rights, email us at josh@eastern-web.com.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.