Privacy Policy

1. Who We Are

Materna by Ibiza ("Materna", "we", "us", or "our") is the data controller for personal data collected through the Materna platform at maternabyibiza.com ("the Platform"). Contact for data protection matters: hello@maternabyibiza.com.

[TO CONFIRM] A Data Protection Officer (Encarregado) for Brazilian data subjects will be designated if required at the Platform's scale; until then, data protection enquiries should be directed to the email above.

2. Data We Collect

2.1 Standard Personal Data

• Name and email address — provided when you subscribe or join the waitlist.
• Payment information — processed by our payment provider; Materna does not store card details. (Payment processing is not yet active — see Section 3.1.)
• Language preference — English, Portuguese, or Arabic.
• Platform usage data — pages visited, features used, session duration.
• Device and browser information — collected via Google Analytics (GA4), only with your consent (see Section 6).
• Anti-abuse identifier — to enforce free-question limits on the AI Concierge, we derive a one-way hash from a randomly generated cookie (materna_vid) combined with the network portion of your IP address only. We do not store your full IP address.

2.2 Sensitive / Special Category Health Data

The following constitutes sensitive personal data under GDPR Article 9, Brazil's Lei Geral de Proteção de Dados (LGPD) Article 11, and UAE Federal Decree Law 45 of 2021. We apply heightened protections to this category of data.

• Pregnancy stage or baby age — provided during onboarding or within the AI Concierge.
• AI Concierge conversation content — questions and responses relating to pregnancy, birth, postnatal health, infant feeding, and related topics.
• Any other health information you voluntarily share with the AI Concierge.

You are never required to share health information to use the Platform. If you do, you do so voluntarily and consent to its processing as described in this Policy.

2.3 How AI Concierge Conversations Are Logged

When you use the AI Concierge, the questions you send and the answers you receive are stored in our database (hosted by Supabase). To generate a response, your question is sent to OpenAI to create a text embedding (used to retrieve relevant guidance from our knowledge base) and to Anthropic, which generates the reply. These providers process the conversation content solely to deliver the service. Because messages may contain health information, please share only what you are comfortable storing. You can request deletion of your conversation history at any time by emailing hello@maternabyibiza.com.

2.4 "Work with Ibiza directly" Enquiries

When you submit an enquiry through our 'Work with Ibiza directly' form, we collect the details you provide — which may include your name, email address, phone number, estimated due date, location, and your message — so that we can respond to your enquiry. This information is processed through our email platform, Klaviyo.

3. How and Why We Use Your Data

3.1 Providing the Platform Service

Lawful basis: Contract (GDPR Art. 6(1)(b); LGPD Art. 7(V); UAE DPL). We use your data to create and maintain your account, provide access to the AI Concierge and Platform content, and send account-related emails. Note: paid subscriptions and payment processing are not yet active and will commence once the company is incorporated.

3.2 Health Data Processing

Lawful basis: Explicit consent (GDPR Art. 9(2)(a); LGPD Art. 11(I); UAE DPL). We process your health data — including AI conversation content — to personalise educational content and AI responses to your stage of pregnancy or parenthood. You may withdraw this consent at any time by contacting hello@maternabyibiza.com, though this may limit personalisation.

3.3 Platform Improvement

Lawful basis: Legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7(IX); UAE DPL). We may analyse anonymised, aggregated data — including anonymised AI conversation feedback — to improve the Platform. No individual user is identifiable from this analysis.

3.4 Email Marketing

Lawful basis: Consent (GDPR Art. 6(1)(a); LGPD Art. 7(I); UAE DPL). With your consent, we may send educational content, Platform updates, and promotional communications via Klaviyo. You may unsubscribe at any time via the link in any email or by contacting hello@maternabyibiza.com.

4. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law. Automated time-based deletion is not yet in place. Data we currently hold is retained until it is no longer needed and is deleted on request — email hello@maternabyibiza.com. The periods below describe our target retention policy, which will be enforced automatically as the relevant features (accounts, payments, scheduled deletion) go live.

5. Third-Party Data Processors

We use the following third-party services which may process your personal data on our behalf. Each is subject to appropriate data protection obligations.

6. Cookies

We use cookies and similar technologies on the Platform. Analytics cookies require your prior consent, which is collected via the cookie consent banner when you first visit the Platform. You can change your choice at any time using the "Cookie Preferences" link in the footer.

7. Your Rights

Depending on your location, you have the following rights regarding your personal data. To exercise any right, contact hello@maternabyibiza.com. We will respond within 30 days.

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your data (subject to legal retention obligations).
• Right to object — object to processing based on legitimate interests.
• Right to data portability — receive your data in a machine-readable format.
• Right to withdraw consent — withdraw consent to health data processing or email marketing at any time, without affecting the lawfulness of prior processing.
• Brazilian users (LGPD) — additional right to information about entities with whom your data has been shared, and to petition the ANPD.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including row-level security on our database, encrypted transfer via HTTPS, access controls limiting who can access production data, and regular review of processor security standards. In the event of a data breach likely to result in risk to your rights, we will notify affected users and relevant authorities within the timeframes required by applicable law.

9. Changes to This Policy

We may update this Policy from time to time. For material changes — particularly changes affecting how we process health data — we will notify you by email at least 30 days before the change takes effect and require your active re-acceptance before continuing to process your health data under the new terms. Non-material changes take effect upon posting.

10. Contact and Complaints

For any privacy-related questions or to exercise your rights, contact us at hello@maternabyibiza.com. If you are dissatisfied with our response, you may complain to your local data protection authority: UAE — UAE Data Office (uaedataoffice.ae); Brazil — ANPD (gov.br/anpd); EU/UK — your national data protection authority.