Privacy Policy

This Privacy Policy explains how Nuup Ltd (“Nuup”, “Maam”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you use the Maam mobile application, Maam websites, MarIA, chats, community features and related services (together, the “Services”).

Nuup Ltd is the controller or “responsable” of the personal information described in this Privacy Policy where we determine why and how that information is processed.

This Privacy Policy is intended to provide the information required by the UK GDPR and the Data Protection Act 2018 and, for users in Mexico, to operate as an integral privacy notice (aviso de privacidad integral) under the Mexican Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP).

This Privacy Policy does not replace any additional just-in-time notice or consent request that we may show when a particular feature requires additional information or consent.

Eligibility — Maam is for Adults Only

Maam is intended solely for people aged 18 or over. By creating an account, you confirm that you are at least 18 years old.

We do not knowingly permit people under 18 to create or use a Maam account. If we reasonably believe that an account belongs to a person under 18, we may suspend or close the account and delete or otherwise handle the associated personal information as required or permitted by law.

Users may choose to discuss or upload information about their children or other minors. That does not make the child or minor a Maam user, and users should avoid sharing unnecessary identifying or sensitive information about children.

How We Present Privacy Information and Obtain Acknowledgements

During registration, Maam informs you that by registering you accept the Terms and Conditions and acknowledge the Privacy Policy. After signup, Maam also displays a blocking first-use notice that requires an affirmative acknowledgement before you proceed. Before you first interact with MarIA, Maam displays a separate MarIA notice that also requires an affirmative acknowledgement.

These notices supplement this Privacy Policy. An acknowledgement of a disclaimer is not treated as a substitute for a separate consent where applicable law requires explicit consent for a particular processing activity. Where explicit consent is required, including for certain processing of sensitive or special-category information, we will use an appropriate affirmative mechanism and will respect withdrawal of that consent as required by law.

1. Personal Information We Collect

The information we collect depends on how you use Maam.

1.1 Account and profile information

When you create or maintain an account, we may collect:

• your name or display name;
• username;
• email address;
• profile photo and biography;
• authentication identifiers and account status;
• language or locale;
• interests and other profile information you choose to provide;
• followers, following relationships, blocks, reports and similar community-management information; and
• account creation, login and activity information.

If you sign in using Apple, Google or another supported identity provider, we receive the account information that provider makes available to us in accordance with your settings and its terms.

1.2 Community content and social interactions

We process information you create or share in Maam, such as:

• threads, posts, comments, reactions and replies;
• photographs, images and other files you upload;
• information about content you like, react to, follow, report, block or share;
• anonymous-posting indicators and the alias used for an anonymous post;
• moderation reports, the identifiers of reporting users, moderation decisions and related audit information; and
• other information you intentionally make available to the Maam community.

Content you publish in community areas is intended to be seen by other users subject to the product’s visibility controls. Posting “anonymously” means that Maam displays an alias to other ordinary users; it does not mean that Nuup cannot associate the content with your account for security, moderation, legal and operational purposes.

1.3 Chats and messages

When you use Maam chat features, we process:

• chat-room and participant information;
• message text and message metadata;
• typing, delivery, read-state and similar realtime information;
• images or files sent in chats; and
• report information if a chat message is reported.

Realtime chat messaging is provided using Ably and Maam’s related backend services. Uploaded chat media may be stored using Google/Firebase infrastructure.

1.4 MarIA and AI interactions

When you use MarIA, we process the messages, prompts, attachments and other information you submit, together with relevant conversation history or context needed to generate and improve the response.

MarIA is an AI assistant and is not a doctor, therapist, emergency service or substitute for professional medical advice. Do not use MarIA for emergencies.

MarIA processing may involve specialist technology providers, including AI model routing, model providers, embedding providers and vector/database providers. Depending on the configuration in use, these may include Requesty, Cohere, Turbopuffer and the underlying AI model provider selected to respond to a request.

1.5 Sensitive or special-category information

Because Maam is a community for mothers and includes MarIA, information you voluntarily provide may reveal matters that receive additional legal protection, including:

• pregnancy, fertility, reproductive, physical or mental health information;
• racial or ethnic origin;
• religious or philosophical beliefs;
• sexual life or sexual orientation; or
• other information that qualifies as sensitive personal data under Mexican law or special-category data under UK law.

We do not require this information merely to create a basic Maam account. Where processing sensitive information requires explicit consent or another specific legal condition, we will rely on the applicable condition and obtain explicit consent where required.

Please share only information that is reasonably necessary. In particular, avoid unnecessarily posting sensitive information about another person.

1.6 Information about children and other people

Although Maam users must be 18 or over, you may choose to discuss or upload information relating to your children, relatives or other people. This may be personal information about those people.

You must have an appropriate basis or authority to share another person’s information and should avoid publishing unnecessary identifying details about children, such as full names, home addresses, school details or precise locations. Where information about a child is sensitive — for example, health information — please take particular care and share only what is reasonably necessary.

1.7 Device, technical and usage information

We and our service providers may automatically process technical information such as:

• device type, operating system and app version;
• device language, locale and time zone;
• screen characteristics;
• app installation and session information;
• IP address and network/security information where generated in ordinary service operation;
• crash, diagnostic and performance information;
• push-notification token and delivery/open information;
• security logs and fraud/abuse signals; and
• events describing how features are used.

We use Google Firebase services for core app infrastructure, authentication, databases, storage, push notifications, diagnostics and analytics.

We do not collect precise GPS location unless a feature specifically requires it and we request the relevant device permission. We may infer a coarse location from information such as IP address, locale or time zone when necessary for security, localisation or analytics.

1.8 Analytics and attribution

We use analytics and attribution information to understand acquisition, app performance and feature use. This may include Firebase Analytics events and Branch attribution/deep-link information, such as campaign, source, referrer and related attribution parameters.

We do not use this information to make decisions that produce legal or similarly significant effects about you.

1.9 Meta/Facebook App Events for advertising attribution

Maam uses a limited implementation of the Meta/Facebook SDK App Events functionality to measure whether advertising on Meta services results in an installation or activation of Maam.

For this purpose, Maam sends Meta:

• an app install identifier (anon_id);
• a Facebook attribution identifier;
• an install or app-activation event; and
• coarse device information such as operating system, device model, locale, time zone and screen size.

Our current implementation does not collect, store or send the device advertising identifier as part of this attribution flow, and it does not send your email address, phone number or Firebase/Maam account identifier to Meta for this purpose. Automatic Advanced Matching is disabled. Maam does not currently present Apple’s App Tracking Transparency (ATT) permission prompt for this limited integration.

This integration is used for advertising measurement and attribution. It does not mean that Maam displays Meta advertisements inside the App. Meta processes information it receives under its own applicable terms and privacy policy and may act as an independent controller for its own processing.

Where applicable law or platform rules require consent or another permission for a particular form of advertising measurement, we will apply the required mechanism before carrying out that processing.

1.10 Information you provide to support or through our website

If you contact us, join a mailing list, submit a form or request assistance, we may process your name, email address, message, correspondence and any information you choose to provide.

Our websites may use cookies or similar technologies. Where consent is legally required for non-essential cookies or similar technologies, we will request it before using them.

2. Why We Use Personal Information

We process personal information for the following purposes:

2.1 Provide the Services

To create and authenticate accounts; maintain profiles; publish and display community content; operate follows, reactions, notifications and sharing; provide chats and MarIA; store media; and provide the features you request.

2.2 Personalise and improve Maam

To remember preferences, localise the experience, understand feature use, diagnose problems, improve reliability and develop new features.

2.3 Safety, moderation and integrity

To prevent spam, fraud, harassment, abuse and misuse; enforce our Terms and community standards; investigate reports; moderate content; protect users and children; and maintain records needed to demonstrate or review moderation actions.

2.4 Communications

To send service messages, account notices, security alerts, push notifications and replies to support requests. We send promotional communications only where permitted by law and provide applicable opt-out controls.

2.5 Analytics, advertising measurement and acquisition

To understand how people discover Maam, measure campaigns, assess aggregate engagement and app performance, and measure installations or activations attributable to advertising, including through Branch, Firebase Analytics and the limited Meta App Events integration described above.

2.6 Legal and compliance purposes

To comply with law, lawful requests and regulatory obligations; establish, exercise or defend legal claims; protect the rights and safety of users and third parties; and maintain records required for accountability.

3. Legal Bases Under UK Data Protection Law

Where UK data protection law applies, we rely on one or more of the following legal bases:

• Contract: processing necessary to provide the Services you request and administer your account.
• Legitimate interests: operating, securing, moderating, improving and measuring Maam, preventing abuse, maintaining service integrity and understanding how the Services perform, where those interests are not overridden by your rights.
• Consent: where we give you a genuine choice and applicable law requires or makes consent appropriate, including certain marketing, device-access, advertising-measurement or sensitive-data processing.
• Legal obligation: where processing is necessary to comply with law.
• Vital interests: in exceptional circumstances where processing is necessary to protect someone’s life or physical safety.

For special-category information, we also identify an additional condition under Article 9 UK GDPR. Depending on the circumstances, this may include your explicit consent, information you have manifestly made public, legal claims, vital interests, or another condition permitted by law.

You may withdraw consent at any time where consent is our basis. Withdrawal does not affect processing already lawfully carried out before withdrawal.

4. Mexican Privacy Notice: Consent, Primary Purposes and Secondary Purposes

For the purposes of the LFPDPPP, Nuup Ltd is the responsable for the personal data described in this notice.

Primary purposes

The following purposes are necessary to provide, secure and administer Maam:

• account registration, authentication and account management;
• provision of community, messaging, media, notification and MarIA features;
• safety, fraud prevention, reporting and moderation;
• customer support and essential service communications;
• technical operation, security, diagnostics and service reliability; and
• compliance with legal obligations and protection of rights.

Under Article 7 of the LFPDPPP, consent for non-sensitive personal data may generally be express or tacit. Where Mexican law permits tacit consent after this privacy notice is made available, your continued provision of the relevant non-sensitive data without objecting may constitute consent to the applicable processing. This does not apply where the law requires express consent.

Secondary purposes

The following purposes are not strictly necessary for the core service:

• non-essential analytics;
• campaign and acquisition measurement;
• advertising attribution, including Meta App Events; and
• optional promotional communications.

Where consent is legally required for a secondary purpose, you may refuse or later withdraw that consent without losing access to unrelated core features. Contact info@maam.ai to exercise this choice where an in-app control is not available.

Sensitive personal data

When Mexican law treats information as datos personales sensibles, Maam will apply the stricter protections required by the LFPDPPP and obtain express consent in the form required by law when no exception applies.

5. When We Share Personal Information

We do not sell your personal information for money.

We may disclose or make information available in the following circumstances.

5.1 Other Maam users

Information you intentionally publish, send or share may be visible to the users or participants for whom the feature is designed. Profile and community information may be visible according to the product’s settings.

5.2 Service providers and processors

We use companies that provide infrastructure and services needed to operate Maam. Depending on the feature and configuration, these include:

• Google/Firebase — authentication, Firestore databases, file storage, Cloud Functions, push notifications, diagnostics and analytics;
• Ably — realtime chat and message infrastructure;
• Branch — deep links, deferred deep links and acquisition attribution;
• Requesty and underlying AI model providers — AI request routing and generation for MarIA;
• Cohere — embeddings and related AI retrieval functions;
• Turbopuffer — MarIA conversation/vector storage and retrieval;
• Meta Platforms — the limited App Events advertising-attribution processing described in section 1.9; and
• hosting, logging, security, communications and professional-service providers used to operate and protect the Services.

We require providers acting on our behalf to process personal information subject to appropriate contractual, confidentiality and security obligations.

5.3 Independent third-party recipients

Some third parties, such as Meta for its own processing, may act as independent controllers rather than solely as our processors. Their handling of information is also governed by their own privacy notices.

5.4 Authorities, safety and legal claims

We may preserve or disclose information when reasonably necessary to comply with law or a valid legal process, respond to a competent authority, investigate unlawful conduct, protect a person from serious harm, enforce our agreements or establish, exercise or defend legal claims.

5.5 Corporate transactions

If Nuup is involved in a merger, investment, financing, reorganisation, acquisition, sale of assets or similar corporate transaction, personal information may be disclosed subject to appropriate confidentiality and data-protection safeguards.

6. Mexican Transfers of Personal Data

For users in Mexico, a transfer to an independent third party is handled in accordance with the LFPDPPP.

When consent is legally required for a transfer, we will inform you and obtain the applicable consent. Where an exception under Mexican law applies — for example, a transfer necessary to maintain or perform the legal relationship with you, comply with law or protect legal rights — separate consent may not be required.

Recipients are informed of the purposes and applicable privacy conditions as required by law.

In particular, non-essential advertising attribution information may be transferred to Meta Platforms as described in section 1.9. Where Mexican law requires consent for that transfer, we will provide a mechanism to accept or refuse it.

Service providers that process information strictly on Nuup’s instructions may act as encargados rather than independent third-party recipients, subject to applicable contractual duties.

7. International Data Transfers

Maam is operated by a UK company, serves users in Mexico and elsewhere, and uses international cloud and technology providers. Your personal information may therefore be stored in, accessed from or processed in countries different from the country where you live.

Our core Firebase databases and several backend services currently use United States cloud regions, including us-east1 and us-central1. Other providers may process information in the United States, the United Kingdom, the European Economic Area or other countries in which they or their subprocessors operate.

Where UK GDPR restricted-transfer rules apply, we use an available lawful transfer mechanism, such as:

• UK adequacy regulations;
• an International Data Transfer Agreement (IDTA);
• the UK Addendum to approved standard contractual clauses;
• another legally recognised safeguard; and
• where required, a transfer risk assessment/data protection test and supplementary safeguards.

For transfers governed by Mexican law, we apply the transfer requirements of the LFPDPPP, including communicating the applicable privacy conditions and obtaining consent where required.

You may contact us for further information about the safeguards relevant to your personal information.

8. Data Retention and Account Deletion

We keep personal information only for as long as reasonably necessary for the purposes described above, taking account of the nature of the information, legal obligations, security needs, disputes and applicable limitation periods.

In general:

• active account and service data is retained while your account remains active and as needed to provide the Services;
• when you delete content, it is removed from ordinary user-facing surfaces, subject to backups, quoted/re-shared copies, moderation records and legal retention;
• the in-app account-deletion process may first disable or soft-delete the account so that it is removed from ordinary use of the service;
• you may request complete deletion of your personal information from our active backend systems by contacting us at info@maam.ai. This complete deletion may require a manual process by our team. We will delete or anonymise the information that is no longer necessary, subject to lawful retention requirements and the technical operation of backups;
• encrypted backups containing deleted information are intended to age out within the applicable backup cycle and are not used for ordinary service operation;
• security, fraud and audit records are retained only for as long as reasonably necessary for security, investigation, dispute, legal-claim or compliance purposes;
• records needed to demonstrate consent, privacy requests, moderation actions or compliance may be retained for the applicable legal limitation period; and
• information that must be preserved for child-safety, abuse-prevention, fraud, legal claims or a lawful authority request may be retained for longer where necessary and proportionate.

Deletion may not remove information already independently copied or re-shared by another user. Where possible and required by law, we will notify relevant recipients of a valid rectification or deletion request.

9. Your Rights

Your rights depend on the law that applies to you.

9.1 Mexico — ARCO rights and other choices

If the LFPDPPP applies, you may exercise your rights of:

• Access — know what personal data we hold and the conditions of its processing;
• Rectification — correct inaccurate or incomplete data;
• Cancellation — request cancellation of personal data when legally available; and
• Opposition — object to processing in the circumstances recognised by law.

You may also ask to withdraw consent or limit the use or disclosure of your personal data.

To submit a request, email info@maam.ai and describe the right you wish to exercise and the relevant data. We may request information reasonably necessary to verify your identity or authority to act for another person.

We will respond within the periods required by Mexican law. Under the LFPDPPP, the controller generally communicates its determination on an ARCO request within 20 working days and, where the request is granted, makes it effective within the following 15 working days, subject to lawful extensions and exceptions.

If you believe your rights have not been respected, you may seek protection from the competent Mexican data-protection authority, currently the Secretaría Anticorrupción y Buen Gobierno, or its successor authority.

9.2 United Kingdom

Where UK GDPR applies, you may have the right to:

• access your personal information;
• correct inaccurate information;
• request erasure;
• restrict processing;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time where processing is based on consent; and
• complain to the UK Information Commissioner’s Office (ICO).

These rights are not absolute and may be subject to legal exceptions.

9.3 In-app controls

Certain profile information can be corrected through the App. You may also be able to manage notifications, marketing or other preferences through device or in-app settings. Account deletion may be initiated through the App. A request for complete deletion from active backend systems can also be made at info@maam.ai and may be completed manually by our team.

10. Automated Processing and AI

MarIA uses automated AI systems to generate responses. Automated systems may also be used for spam, safety, content classification, analytics or moderation assistance.

We do not use MarIA or the Meta attribution integration to make solely automated decisions that produce legal or similarly significant effects about you.

Human moderators may review content or reports where needed to enforce rules, protect users or assess moderation decisions. Information posted anonymously to other users may still be accessible to authorised moderators where necessary for those purposes.

11. Security

We maintain administrative, technical and organisational safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures may include access controls, authentication, encrypted transport, provider security controls, environment separation, logging, restricted administrative access and incident-response procedures.

No online service can guarantee absolute security. You are responsible for protecting your account credentials and should notify us promptly if you believe your account or personal information has been compromised.

Where Mexican law requires notification of a security breach that significantly affects your rights, or where UK law requires notification to you or the ICO, we will provide the required notice.

12. Marketing, Advertising and Push Notifications

We may send service and safety notifications that are necessary for the operation of your account.

Promotional messages are sent only as permitted by law. You can unsubscribe using the method in the communication or an available account setting.

Mobile push notifications can be controlled in your device settings.

Meta App Events is used for advertising attribution and measurement, not to deliver advertising inside Maam. Where consent is required for this measurement, you may refuse or withdraw that consent without affecting unrelated core Maam functionality.

13. Third-Party Links and Services

Maam may link to websites, app stores or services that we do not control. Their privacy practices are governed by their own policies. We encourage you to review those policies before providing information directly to them.

14. Changes to This Privacy Policy

We may update this Privacy Policy when our Services, providers or legal obligations change.

If a change is material, we will provide an appropriate notice through the App, website, email or another reasonable channel before or when the change takes effect, as required by law. Where a new purpose requires new consent, we will request that consent rather than treating continued use alone as consent.

The “Last Updated” date at the top identifies the current version.

15. Contact Us and Privacy Requests

Questions, complaints and privacy-rights requests may be sent to:

Please use the subject line “Privacy Request” where possible.

16. Governing Law and Exclusive Jurisdiction

Maam is operated by Nuup Ltd, a company incorporated in England and Wales. To the fullest extent permitted by applicable law, this Privacy Policy, your use of Maam and any contractual or civil dispute, claim or proceeding arising out of or relating to Maam, the Services, this Privacy Policy or your relationship with Nuup Ltd are governed by the laws of England and Wales and are subject to the exclusive jurisdiction of the courts of England and Wales.

By creating an account or using Maam, you agree to this choice of law and exclusive jurisdiction. If you do not agree to disputes with Nuup Ltd being handled in England and Wales, you should not create an account or use Maam.

This choice of law and jurisdiction does not exclude a statutory right, regulatory complaint procedure or jurisdiction that applicable law expressly makes non-waivable. In particular, where Mexican data-protection law gives a person a non-waivable right to bring a privacy complaint or rights-protection procedure before the competent Mexican authority, that statutory procedure remains available. This exception does not change the parties’ agreement that contractual and civil disputes with Nuup Ltd are, to the fullest extent legally permitted, to be resolved exclusively in England and Wales.