Privacy Policy

1. Introduction

HappyCactus, Inc. (“HappyCactus,” “we,” “us,” or “our”) operates ParentWise, an AI-powered parenting guidance service (the “Service”). We are committed to protecting the privacy of the parents, guardians, and families who use ParentWise. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service.

By using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

a. Account Information

When you create a ParentWise account, we collect your email address and an invite code. We use magic-link email authentication — we never store passwords.

b. Child Profile Information

To personalize AI guidance, you may voluntarily provide information about your child or children, including name or nickname, date of birth or age, developmental notes, temperament, interests, and health-related context you choose to share in conversations. This information is used solely to tailor parenting guidance to your family. You are not required to provide a child’s full legal name.

c. Conversation Data

We store the messages you exchange with ParentWise AI specialists to provide context-aware responses and to allow you to review your conversation history.

d. Usage and Technical Data

We automatically collect certain technical information when you use the Service, including IP address, browser type, operating system, referring URLs, and pages visited. This data is used for security monitoring, debugging, and improving the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service;
• Personalize AI-generated parenting guidance based on the child profiles you create;
• Send transactional emails, including magic-link authentication emails;
• Detect and prevent fraud, abuse, and security incidents;
• Comply with legal obligations; and
• Analyze aggregate, anonymized usage trends to improve Service quality (no individual-level data is sold or shared with advertisers).

We do not use your data or your child’s data to train our AI models without your explicit consent.

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information or your child’s information to third parties. We may share information in the following limited circumstances:

a. Service Providers

We share information with trusted third-party service providers who assist us in operating the Service, including:

• Anthropic— AI model provider that processes conversation content to generate responses. Anthropic’s API does not retain submitted data for training purposes beyond the immediate inference call, per their API data policies.
• Resend — transactional email provider used to send magic-link authentication emails.
• Google Cloud — cloud infrastructure provider that hosts our database and application servers. Data is stored in Google Cloud SQL (PostgreSQL) with encryption at rest.

All service providers are contractually required to use your information only as needed to provide services to us and to maintain appropriate security standards.

b. Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process (such as a court order or subpoena), to protect the rights, property, or safety of HappyCactus, our users, or others, or to detect and prevent fraud or security incidents.

c. Business Transfers

If HappyCactus is involved in a merger, acquisition, or sale of all or substantially all of its assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice within the Service before your information is transferred and becomes subject to a different privacy policy.

6. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information, including:

• Encryption of sensitive data at rest using AES-256;
• Encryption of all data in transit using TLS;
• Magic-link authentication — no passwords stored;
• Least-privilege access controls on production systems; and
• Regular security reviews of our codebase and infrastructure.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security. If you believe your account has been compromised, please contact us immediately.

7. Data Retention

We retain your account information and child profiles for as long as your account is active or as needed to provide you with the Service. Conversation history is retained to provide context across sessions and may be retained for up to 2 years after your last login.

You may request deletion of your account and all associated data at any time. Upon deletion, we will remove your personal information from our active systems within 30 days, except where retention is required by law or legitimate business purposes (such as fraud prevention or legal compliance), in which case data is securely isolated and deleted as soon as legally permissible.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — request that we correct inaccurate or incomplete information;
• Deletion — request that we delete your personal information and child profiles;
• Portability — request a machine-readable export of your data; and
• Objection — object to certain processing of your information.

To exercise any of these rights, contact us at hello@happycactus.ai. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

California residents may have additional rights under the California Consumer Privacy Act (CCPA). If you are a California resident and wish to exercise your CCPA rights, please contact us at the email address above.

9. Cookies and Similar Technologies

We use cookies and similar session-based technologies to maintain your authentication state and provide the Service. We do not use advertising cookies or third-party tracking technologies. Essential cookies include:

• Session cookies — to keep you logged in between page loads (required for the Service to function);
• Security cookies — to protect against cross-site request forgery (CSRF) attacks.

You can configure your browser to refuse cookies, but doing so may prevent you from logging in or using the Service.

10. Third-Party Links

The Service may contain links to third-party websites or resources. These links are provided for informational purposes only. We have no control over the content, privacy policies, or practices of third-party sites and assume no responsibility for them.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the “Last updated” date above and, where required by law, by sending an email to the address associated with your account or by providing a prominent notice within the Service.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: