Privacy policy
Last updated: 2026-11-09. Draft for counsel review.
1. Controller
Birucura ("we", "us", "our") is the data controller for the Biru app and this website. Contact: privacy@birucura.com. EU representative (if applicable): to be designated.
2. What we collect
- Account data: email, Supabase user id, session tokens.
- Care circle: names and phone numbers you add for family alerts.
- Health-adjacent data: medicine schedule, check-in answers, heart reading (Android Health Connect only, on-device).
- Location: coarse or precise, only when shared during an alert.
- User content: chat messages, voice-derived turns, memory facts.
- Device data: push token, device heartbeat for the fall-watch service.
- Usage data: anonymized product analytics (cookieless, no personal identifiers).
3. Legal bases (GDPR Art. 6)
- Contract: providing the service you signed up for (account, medicines, check-ins).
- Consent: location sharing, health data reads, push notifications.
- Legitimate interest: safety alerts to your care circle, fraud prevention, service security.
- Legal obligation: where required by law.
4. Where your data lives (processors)
| Processor | Purpose | Region |
|---|---|---|
| Supabase | Database, auth, storage | Frankfurt (eu-central-1) |
| Scaleway | AI inference (Mistral) | Paris |
| Fly.io | Alert worker | Frankfurt |
| Twilio | SMS/voice alerts | IE1 (EU) |
| LiveKit | Voice path | EU region |
| Opper | Memory gate (optional) | EU |
| Apple (APNs) / Google (FCM) | Push delivery | Global |
| Cloudflare | Web analytics (cookieless) | Edge |
We do not train models on your data. We do not sell or share data with advertisers. Processors are bound by DPAs and act only on our instructions.
5. Retention
For as long as your account is active, plus the periods in our data map. Account deletion removes your Auth user and all owned rows. Backups expire within 30 days.
6. Your rights (GDPR Arts. 15-22)
Access, rectification, erasure, portability, restriction, objection, and withdrawal of consent. Exercise them in-app (Settings → Privacy) or by email. We respond within 30 days. You may lodge a complaint with your supervisory authority (in Italy: Garante per la protezione dei dati personali).
7. Account deletion
See how to delete your account. Deletion is irreversible.
8. Cookies
We do not use tracking cookies. We use browser local storage for your theme preference (light/dark) only. No third-party advertising or analytics cookies.
9. Children
Biru is not intended for children under 16. We do not knowingly collect data from children.
10. International transfers
All primary processing is in the EU. Where a processor is global (Apple/Google push), transfers rely on adequacy decisions and standard contractual clauses.
11. Automated decision-making
We do not make solely automated decisions with legal or similarly significant effects. Safety alerts are rule-based and involve human caregivers.
12. Changes
We will post changes here and update the "Last updated" date. Material changes are notified in-app.