Privacy policy

At Startcat App Development, S.L. (hereafter, «Startcat») we treat your personal data as what it is: the foundation of our product's trust. This policy explains what information we collect when you visit niu.lyn.cat or sign up for the Lyncat Niu pre-launch, what we do with it and how you can exercise your rights at any time.

1. Data controller

Contact email and rights requests: hola@lyn.cat.

Startcat is not legally required to appoint a Data Protection Officer (DPO) given the nature and volume of current processing activities. Even so, the controller will personally respond to any inquiry through the address above.

2. Data we collect

2.1 Newsletter

• Email address.
• Website language (ca, es, en).
• Version of the consent text you accepted.
• UTM parameters, referrer and signup timestamp (campaign analytics).

2.2 Early access waitlist or demo request

Same as the newsletter, plus:

• Name.
• Centre or nursery name.
• Optional message.

2.3 Technical logs

When you visit the website we record strictly necessary technical data: IP address, user agent, requested URL and timestamp. We use it to detect abuse, prevent fraud and keep the service secure. These security logs are independent of our analytics (Umami), which does not store IP addresses.

2.4 B2B commercial contact

If you are a contact person at a nursery or early-years centre, we may process your professional data (name, email, phone, centre), obtained from public sources or from our interaction with you, to present the service to you (legitimate interest, Art. 6.1.f GDPR). Our commercial emails include open and click metrics, and an unsubscribe link in every message; we also use Cal.com to schedule demos. You can object at any time at hola@lyn.cat or via the unsubscribe link.

3. Purposes and legal basis

• Sending the newsletter — explicit consent (Art. 6.1.a GDPR).
• Managing your pre-launch signup and any commercial follow-up — explicit consent (Art. 6.1.a) and pre-contract measures at your request (Art. 6.1.b).
• Abuse prevention and service security — legitimate interest (Art. 6.1.f).
• Compliance with legal obligations (LSSI, tax, accounting) — legal obligation (Art. 6.1.c).

4. Retention period

• Newsletter: until you withdraw consent. Then, 1 additional year blocked for defence against possible claims.
• Waitlist / demo: until you withdraw consent or 24 months of inactivity without becoming a customer.
• Technical logs: 12 months.
• If you become a Lyncat Niu customer, data will be kept according to the service agreement.

5. Who we share your data with

We process your data ourselves. To run the service we rely on the following data processors, with whom we have signed the corresponding agreements:

• Clouding S.L. — Infrastructure hosting and self-hosted database. Location: Spain (EU). https://clouding.io
• Resend, Inc. — Transactional email and newsletter delivery. Location: United States (transfer under EU-US Data Privacy Framework). https://resend.com

6. International transfers

Resend, Inc. is based in the United States. The transfer is covered by the EU-US Data Privacy Framework and, as an additional safeguard, by Standard Contractual Clauses approved by the European Commission.

7. Your rights

GDPR and LOPDGDD grant you the following rights:

• Access: know what data of yours we process.
• Rectification: correct inaccurate data.
• Erasure (right to be forgotten): delete your data when no longer necessary.
• Restriction: temporarily halt processing.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent at any time, without retroactive effect.

To exercise them, write to hola@lyn.cat with the details of your request. We may ask for a copy of an identification document only when there is reasonable doubt about your identity.

8. Lodging a complaint

If you believe we have not handled your data correctly, you may file a complaint with the Spanish Data Protection Agency (AEPD): C/ Jorge Juan, 6, 28001 Madrid, or at www.aepd.es.

9. Lyncat Niu app and service (families and centres)

Beyond the website, Startcat offers Lyncat Niu, a communication service between nurseries / early-years centres and families, available as a web portal and as a mobile app (iOS and Android). This section describes how data is processed within that service.

9.1 Roles: controller and processor

The pupil and family data within the service is determined by and is the responsibility of the educational centre (data controller). Startcat acts as a data processor: it processes this data only on the centre's instructions and under the corresponding data-processing agreement (Art. 28 GDPR), and does not use it for its own purposes. To exercise your rights over your child's data, you can contact the centre or write to us at hola@lyn.cat and we will channel the request.

9.2 Data the app processes

• Account: email address, password (stored encrypted, never in plain text) and internal user identifier.
• Family profile: name, contact phone and, optionally, a profile photo you choose to upload.
• Push notifications: a device identifier (token) to send you alerts, delivered through Expo and the notification services of Apple (APNs) and Google (FCM).
• Service content: the information the centre publishes about your child (daily reports, activities, photos, authorisations, absences, etc.). This data is provided by the centre; the app displays it to you.
• Messaging with the centre: the content of messages, attachments, read receipts and Yes/No replies to the centre's questions.
• Handwritten signature on authorisations: the signature image together with the IP address, device and version of the accepted text, as proof of consent.
• Attendance and absences: your child's attendance record and reported absences, with any supporting documents the family provides.
• Technical session data: session tokens stored encrypted on your device. If you enable biometrics (Face ID / fingerprint), it is processed only on your device and is not sent to our servers.

9.3 Purposes and legal basis

• Providing the family–centre communication service — performance of the contract between the centre and families and the centre's legitimate interest (Art. 6.1.b and 6.1.f GDPR).
• Sending push notifications — consent granted on the device, revocable at any time from the settings.
• Authentication, security and abuse prevention — legitimate interest (Art. 6.1.f).

9.4 Service processors and sub-processors

To run the service, Startcat relies on the following processors and sub-processors, under the corresponding Art. 28 GDPR agreements:

• Clouding S.L. — Infrastructure and database hosting. Location: Spain (EU).
• Resend, Inc. — Transactional email delivery for the service. Location: United States (EU-US Data Privacy Framework).
• Expo (650 Industries, Inc.) — Push notification delivery and app updates. Location: United States (Standard Contractual Clauses, GDPR art. 46).
• Google LLC (Firebase Cloud Messaging) — Technical delivery of push notifications on Android. Location: United States (EU-US Data Privacy Framework).
• Apple Inc. (APNs) — Technical delivery of push notifications on iOS. Location: United States (Standard Contractual Clauses, GDPR art. 46).
• OpenRouter, Inc. — Gateway for the artificial-intelligence features. Location: United States (Standard Contractual Clauses, GDPR art. 46).
• Anthropic, PBC — AI models (content translation, text drafting). Location: United States (EU-US Data Privacy Framework).
• OpenAI, LLC — AI model (cover images). Location: United States (EU-US Data Privacy Framework).

9.5 Artificial-intelligence features

The centre may use AI features built into the platform: automatic translation of the content it publishes (news, notices), cover-image generation and assisted drafting of its legal texts. These features are provided through the providers listed in the previous section (OpenRouter, Anthropic, OpenAI); the content is sent to the provider solely to run the requested task and is not used to train their models, in accordance with those providers' commercial terms. Spell-checking and usage analytics run on our own servers, with no third parties involved.

9.6 Security measures

We apply appropriate technical and organisational measures (Art. 32 GDPR): encrypted communications (TLS), role-based access control, isolation of each centre's data through database-level access policies, encrypted sessions on the device, optional biometric unlock processed only on the device, backups and periodic security reviews. The infrastructure is hosted in Spain (EU). In the event of a security breach posing a risk, the competent authority and those affected will be notified in accordance with Arts. 33 and 34 GDPR.

9.7 Retention

Account data is kept while the family has active access to the centre through the service. On closing the account, or on request, it is deleted in line with the deletion process (next section), except for information the centre or Startcat must retain by legal obligation.

9.8 Account and data deletion

You can request deletion of your account and associated data by writing to hola@lyn.cat or from the account deletion page. Because pupil data is controlled by the centres, the request may be coordinated with the relevant centre.

9.9 Minors

The app is intended for use by adults (families). Children's data is processed by the educational centre as controller; Startcat, as processor, applies security measures and does not use it for any own or advertising purpose. In Spain, the minimum age of digital consent is 14 (Art. 7 LOPDGDD). Public sharing of images (public album site, shared links) only happens if the centre enables it and under the consents the centre manages.

10. Changes to this policy

We may update this policy to reflect legal or operational changes. When the change is substantial, we will notify subscribers by email. The date of the last update appears at the top of this document.

11. Contact

For any inquiries about this policy or your data, write to hola@lyn.cat.