Who we are
Cradld is a Canadian company. We built this app to support parents through every chapter of the family-building journey, from planning and fertility to pregnancy, postpartum, and loss. Your trust matters more than anything else to us.
How we are regulated
Cradld is a wellness service, not a medical service. We are not a hospital, clinic, or regulated health professional, and we do not deliver clinical care.
Cradld is not a Health Information Custodian under Ontario's Personal Health Information Protection Act (PHIPA) or any equivalent provincial health-sector legislation. The information you share with us is treated as personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy laws such as Quebec's Law 25.
If you work with a midwife, doctor, therapist, or other regulated provider who asks you to use Cradld as part of their practice, that provider remains responsible for any clinical record they keep. Cradld is your companion, not your chart.
What we collect
- Account info - your email address, name, and profile details you provide during onboarding (parent type, baby name, challenges, journey stage, cultural background).
- Chat messages - what you share with the AI companion so it can support you in context.
- Mood entries - mood scores, sleep hours, tags, and optional notes you log.
- Usage data - basic analytics like which features you use, so we can improve the app.
- Payment info - processed securely through Stripe. We never see or store your card number.
Sensitive health and wellness data
Some of what you share with us is deeply personal. We treat it that way.
- Encrypted profile fields - sensitive details like your journey stage, loss history, and wellness notes are encrypted before being stored. They are decrypted only when you access your own account.
- Loss data sensitivity - if you have experienced pregnancy or infant loss, any information you share about that experience is treated with the highest level of care. It is never used for marketing or analytics.
- Consent-based collection - we only collect sensitive health and wellness details when you choose to share them. You can skip or update any field at any time from your profile.
How we protect your data
We take data protection seriously, especially given the sensitive nature of what you share with us.
- Encryption at rest - all chat messages, mood notes, and crisis logs are encrypted with AES-256-GCM before being stored. Even with direct database access, your content is unreadable.
- PII filtering - personal details like names, emails, and phone numbers are stripped from your messages before they reach our AI provider. The AI responds using only your profile, not your raw messages.
- Row-level security - every database query is scoped to your user account. You can only access your own data.
- Audit logging - we log access to sensitive data for compliance and security monitoring.
- Secure connections - all data is transmitted over HTTPS/TLS.
Partner data sharing
Cradld has features that let you optionally share parts of your experience with a partner or support person. Here is how that works.
- Opt-in only - partner sharing is never on by default. You choose to enable it, and you choose what is shared.
- Mood trends only - partners can see aggregated mood trends (like weekly averages), not your individual entries, notes, or chat messages.
- Revocable at any time - you can turn off partner sharing from your profile settings at any time, and any shared access is immediately removed.
Voice features
Cradld includes voice-based support features. Voice processing happens in real time to generate responses. We do not record, store, or retain your voice audio. Once your session ends, no audio data is kept.
AI and your data
Our AI companion is powered by Anthropic's Claude. When you chat, your messages are filtered to remove personal identifiers before being sent to the AI. Anthropic does not use your conversations to train their models. The AI does not have access to your raw message history between sessions.
Third parties and cross-border transfers
- Supabase - database, file storage, and authentication. Your data is hosted in a North American region under a data processing agreement with Supabase Inc.
- Anthropic - AI processing (PII-filtered data only). Anthropic processes API requests in the United States and has committed in writing not to train its models on API traffic.
- Cartesia - real-time voice synthesis and transcription (no audio is stored).
- Resend - transactional email delivery (US-based).
- Stripe - payment processing. See Stripe's privacy policy.
- Vercel - hosting and deployment.
Some of our service providers are based in the United States. By using Cradld, you consent to your data being processed in the US as described in this policy. We take reasonable steps to ensure these providers protect your data under standards consistent with Canadian privacy law.
We do not sell your data. We do not share your data with advertisers. We do not use your data for any purpose other than providing and improving the service.
Your rights (PIPEDA)
As a Canadian company, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to:
- Access - download a copy directly from profile settings, or request a full copy of all data we hold about you.
- Correction - update or correct your personal information at any time through your profile.
- Deletion - permanently delete your account and all associated data from your profile settings. This is immediate and irreversible.
- Withdraw consent - unsubscribe or stop using the service at any time.
To exercise any of these rights, email support@cradld.com.
For Quebec residents
If you live in Quebec, Law 25 (the Act to modernize legislative provisions as regards the protection of personal information) gives you additional rights on top of PIPEDA.
- Cross-border transfers - we have assessed the risks of transferring personal information to our US-based service providers (Anthropic, Resend, Stripe, Vercel, Cartesia) and concluded that they provide protection equivalent to what Law 25 requires. By using Cradld, you consent to these transfers.
- Data protection officer - our privacy officer can be reached at support@cradld.com.
- Right to data portability - you can export your data in a common, structured format from privacy settings.
- Right to de-indexing - you can ask us to stop disseminating or de-index any personal information we hold.
- Automated decisions - our AI companion does not make decisions about you that have legal or similarly significant effects. It offers emotional support only.
For US residents
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you additional rights.
- Right to know - you can request details about the categories of personal information we collect and how we use it.
- Right to delete - you can request that we delete your personal information, subject to certain exceptions.
- Right to opt out - we do not sell your personal information. There is nothing to opt out of.
- Non-discrimination - we will not treat you differently for exercising your privacy rights.
To exercise any CCPA rights, email support@cradld.com.
Data retention and conversation memory
We keep your conversations as long as you have an account so Cradld can remember you. Older messages are automatically summarized to keep your AI companion feeling continuous without loading your entire history every time.
- Recent conversations (0 to 30 days) - raw messages are loaded directly so Mira has full context for your current conversations.
- Older conversations (30 to 180 days) - summarized into concise notes so Mira remembers what mattered without the full transcript.
- Long-term memory (180+ days) - rolled up into monthly digests capturing themes, mood patterns, and breakthroughs.
- Export anytime - download a full copy of everything from your privacy settings.
- Delete anytime - you can delete all your conversations from privacy settings at any time. This is immediate and irreversible.
If you delete your account, all data is permanently removed. Audit logs may be retained for up to 12 months for compliance purposes.
Breach notification
If a breach of security safeguards puts your personal information at real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada (and the Commission d'accès à l'information du Québec, where Law 25 applies) as soon as feasible. Notifications include what happened, what information was affected, the steps we have taken, and what you can do to protect yourself. We keep internal records of every breach for at least 24 months, as PIPEDA requires.
Provider directory data
The Cradld directory aggregates publicly available information about perinatal providers from provincial regulatory colleges and professional associations, including organizations such as the College of Midwives of Ontario, the Midwives Association of BC, Postpartum Support International, and others.
- Public information. Provider directory data is treated as public information per the original sources' public registers. We do not use this data for any purpose beyond operating the directory.
- We do not sell directory data. We may share aggregate analytics about directory usage (for example, which provider types are searched most often) but we never share or sell personal data of listed providers.
- Refresh cadence. Data is re-synced periodically from source organizations, typically monthly or when triggered manually. The last full refresh date appears on each listing card.
- Right to be forgotten (PIPEDA). Providers who wish to be removed from the directory may submit a request using the “Report a problem” link on their listing page or by emailing directory@cradld.com. We review and act on valid requests within 14 days.
Children
Cradld is designed for adults (parents and caregivers). We do not knowingly collect data from anyone under 18.
Data export
You can request a copy of your data at any time from your privacy settings. We offer two formats: summaries and insights only, or a full export that includes raw conversation transcripts. Exports are delivered as a secure, time-limited link sent to your verified account email. The link expires after 24 hours. To protect against unauthorized access, you must re-enter your password before submitting a request, and you will receive a separate notification email so you know an export happened. You can request once every 30 days.
Changes to this policy
We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice.
Contact
Questions about privacy? Reach us at support@cradld.com.