← Back to Grami
Privacy Policy
Grami by SOS Acquisition LLC · Updated July 14, 2026
Our promise
Your baby's health information belongs to you. We will never sell it, rent it, or use it for advertising. Full stop.

Who We Are

Grami is operated by SOS Acquisition LLC, a Pennsylvania limited liability company.

  • Address: Pittsburgh, PA, USA
  • Support email: support@gramiapp.com

1. What Data We Collect

Account information

Email address, name, and password (stored as a secure hash — we never see it in plain text).

Baby health & care data

Everything you log: feeds, weights, medications, diapers, sleep, appointments, milestones, and free-text notes.

Payment information

We use Stripe to process payments. Stripe stores your card details — we never see or store your full card number. We receive only a Stripe-generated token and the last four digits for display.

Usage data

Browser type, device type, pages visited within the app, and error logs. No advertising trackers. No analytics pixels. No GPS location.

2. How We Use Your Data

PurposeLegal basis (GDPR)
Account creation and managementArt. 6(1)(b) — Contract
Storing your baby's care logs (special-category health data)Art. 9(2)(a) — Explicit consent + Art. 6(1)(b) — Contract
Processing subscription paymentsArt. 6(1)(b) — Contract
Transactional emails (receipts, password reset)Art. 6(1)(b) — Contract
Responding to support requestsArt. 6(1)(f) — Legitimate interest
Diagnosing and fixing bugsArt. 6(1)(f) — Legitimate interest
Complying with legal obligationsArt. 6(1)(c) — Legal obligation

We do NOT use your data to show ads, profile you for marketing, or train AI models.

You provide explicit consent to process your baby's special-category health data when you complete onboarding. You may withdraw this consent at any time by deleting your account (Section 6). Withdrawal does not affect the lawfulness of processing before withdrawal.

3. Third Parties Who Touch Your Data

We use a small number of carefully chosen service providers. Each acts as a data processor — they may not use your data for their own purposes.

Supabase
Database & Authentication
supabase.com/privacy · supabase.com/docs/company/dpa
Stripe
Payment Processing
stripe.com/privacy · stripe.com/legal/dpa
Vercel
Web Hosting
vercel.com/legal/privacy-policy · vercel.com/legal/dpa
Push Notification Gateways
Push Notifications
Apple APNs · Google FCM · Mozilla Push — receive your push subscription endpoint only, not your health data

We do not use Google Analytics, Facebook Pixel, Mixpanel, or any other analytics or advertising platforms.

4. Data Retention

Data typeRetention
Account informationWhile active + 30 days after deletion
Baby care logsWhile account is active
Payment records7 years (US tax law)
Support correspondence3 years
Server / error logs90 days

5. Your Rights

Regardless of where you live, you can access, correct, export, or delete your data at any time. Email support@gramiapp.com with the subject "Data Request." We respond within 30 days.

GDPR (EU/EEA residents)

You also have the right to restrict processing and lodge a complaint with your national data protection authority (find your DPA). EU/UK data transfers are covered by Standard Contractual Clauses with Supabase, Stripe, and Vercel.

GDPR legal bases: Art. 9(2)(a) explicit consent for health data; Art. 6(1)(b) contract for account and billing; Art. 6(1)(f) legitimate interest for support and security; Art. 6(1)(c) legal obligation for record-keeping.

California residents (CCPA/CPRA)

You have the right to know, delete, correct, and opt out of the sale or sharing of your personal information. We do not sell or share your personal information. To submit a California Privacy Request, email support@gramiapp.com with subject "California Privacy Request."

Washington state residents (My Health My Data Act)

You have additional rights over your consumer health data. We do not sell or share consumer health data. To request access, correction, or deletion, email support@gramiapp.com.

6. How to Delete Your Account

Go to More → Account → Delete Account inside the app, or email support@gramiapp.com from your account email. Upon deletion:

  • Access is revoked immediately
  • All baby care logs and profile data are permanently deleted within 30 days
  • Billing records are retained 7 years (US tax law)
  • Deletion is irreversible

7. Data Security

  • All data in transit is encrypted with TLS 1.2 or higher
  • All data at rest is encrypted by Supabase (AES-256)
  • Passwords are hashed — we never store them in readable form
  • In the event of a breach, we will notify you within 72 hours (GDPR requirement)

8. Children's Privacy (COPPA)

Grami is for parents, not children. We do not knowingly collect personal information from children under 13. Child health data logged in Grami is entered by parents and treated as the parent's data under their account.

9. Cookies

Grami uses one cookie only: a session cookie that keeps you logged in. It contains no personal information. We do not use advertising, tracking, or analytics cookies.

10. Health Data Disclaimer

Grami is a tracking tool only. It does not provide medical advice, diagnosis, or treatment. Always consult your baby's care team. We are not a HIPAA-covered entity and do not claim HIPAA compliance.

11. Policy Changes

We will notify you by email at least 14 days before material changes take effect. Minor corrections may be made without advance notice.

12. Contact Us

SOS Acquisition LLC
Pittsburgh, PA, USA
Email: support@gramiapp.com

We aim to respond within 5 business days.

Terms of Service →Back to app