Privacy Policy - HiBabyHi

1. Introduction

Deep Innovation Labs, LLC ("Company," "we," "us," or "our") operates HiBabyHi.com (the "Site"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit or use the Site and all associated services, features, content, and applications (collectively, the "Service").

By accessing, browsing, or using the Service, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein. If you do not agree with this Privacy Policy, you must not access or use the Service.

The Site is intended for users who are 18 years of age or older. This Privacy Policy applies to all users worldwide, regardless of location.

This Privacy Policy should be read in conjunction with our Terms and Conditions, which govern your use of the Service and are incorporated herein by reference.

Deep Innovation Labs, LLC
100 N Howard St, Ste R
Spokane, WA 99201, USA
Email: hello@hibabyhi.com

2. Information We Collect

2a. Information You Provide

We collect information that you voluntarily provide to us when you use the Service, including:

Account Registration: When you create an account, we collect your name, email address, and password. Your password is stored as a cryptographic hash using industry-standard algorithms; we never store passwords in plaintext.
Social Login: If you choose to register or log in via Google or Facebook, we receive your profile name, email address, and profile photo URL, as authorized by you through those platforms.
Profile Preferences: Name style preferences, gender preferences, and cultural preferences that you set within your account.
Couple Collaboration Data: Partner links, swipe choices, shared shortlists, votes, deal-breakers, and discussion messages created through our couple collaboration features.
User-Generated Content: Name reviews, forum posts, naming stories, and comments that you submit to the Service.
Search Queries and Name Interactions: Your search queries and interactions with names on the platform, including likes, saves, dismissals, and list additions.
Communications: Information you provide when you contact us for support, submit feedback, or otherwise communicate with us.
Payment Information (Future): When we introduce premium subscriptions, payment information will be processed entirely by Stripe, a PCI DSS Level 1 certified payment processor. We will never receive or store your full credit card numbers.

2b. Information Collected Automatically

When you access or use the Service, we automatically collect certain information, including:

IP Address and Geolocation: Your IP address and approximate geolocation at the city or region level. We do not collect precise geolocation data.
Device Information: Browser type, operating system, screen resolution, and device type.
Usage Data: Pages visited, features used, time spent on the site, click patterns, and referral URL.
Cookies and Similar Technologies: We use cookies and similar tracking technologies as described in detail in Section 6 of this Privacy Policy.
Search and Interaction Patterns: Your search history and name interaction patterns, which are used to improve recommendations and the overall Service.

2c. Information from Third Parties

We may receive information about you from third-party sources, including:

Google and Facebook: Social login profile data, limited to the information you authorize these platforms to share with us.
Google Analytics: Aggregated usage insights about how users interact with the Service.
Google AdSense: Ad interaction data related to advertisements displayed on the Service.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide, maintain, and improve the Service, including its features, functionality, and performance.
To personalize your name search results and recommendations based on your preferences and interactions.
To power our AI recommendation engine using your preference signals, interaction history, and style profiles to generate personalized name suggestions.
To enable couple collaboration features, including name matching, shared lists, and voting sessions.
To process future premium subscription payments via Stripe.
To send transactional emails, including account confirmation, password reset, and security alert notifications, through our email service provider.
To send marketing communications only with your explicit opt-in consent, including newsletters, name recommendations, and product updates. You can unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us.
To display relevant advertisements via Google AdSense on the free tier of the Service.
To analyze usage patterns via Google Analytics to improve features, user experience, and overall Service quality.
To detect and prevent fraud, abuse, scraping, and security threats to the Service.
To enforce our Terms and Conditions.
To comply with legal obligations and respond to lawful requests from governmental authorities.

4. AI and Automated Decision-Making

Our AI features analyze your search history, name interactions, stated preferences, and style profiles to generate personalized name recommendations tailored to your interests.

AI-generated recommendations are suggestions only and should not be considered definitive advice. No fully automated decisions with legal or similarly significant effects are made about you without human review.

You may opt out of AI-based profiling at any time by contacting us at hello@hibabyhi.com or by adjusting your account preferences within the Service.

AI models are processed on our servers. Your personal data is not shared with third-party AI providers for the purpose of training their models.

5. How We Share Your Information

We may share your information in the following circumstances:

Service Providers

We engage trusted third-party service providers to perform functions on our behalf. These providers process your data under contractual obligations to protect it and use it only for the purposes we specify:

Cloud infrastructure providers: Hosting, content delivery, DDoS protection, and managed database services.
Stripe (Future): Payment processing for premium subscriptions.
Email service providers: Transactional email delivery (account confirmations, password resets, security alerts).

Advertising Partners

Google AdSense is used to display advertisements on the free tier of the Service. AdSense may use cookies and similar technologies to serve personalized ads based on your browsing activity. You may opt out of personalized advertising as described in Section 6.

Analytics

Google Analytics receives aggregated and pseudonymized usage data to help us understand site performance and user behavior. We use IP anonymization where available.

Couple Collaboration Partners

Data is shared between linked partner accounts only as explicitly initiated by both users. This includes swipe results, shortlists, and votes. Both partners must consent to linking their accounts before any data is shared between them.

Legal Requirements

We may disclose your information if required to do so by law, subpoena, court order, or government request; to protect our rights, property, or safety, or the rights, property, or safety of others; to investigate fraud or security issues; or to enforce our Terms and Conditions.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify affected users before their data becomes subject to a different privacy policy.

No Sale of Personal Information

We do not sell your personal information. We have not sold personal information in the preceding 12 months. Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), sharing data with advertising networks for cross-context behavioral advertising may constitute "sharing." You may opt out of such sharing as described in Section 9 and Section 13 of this Privacy Policy.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information when you visit or interact with the Service. Cookies are small data files placed on your device by your web browser.

Types of Cookies We Use

Essential / Strictly Necessary Cookies: These cookies are required for the basic operation of the Service, including session management, authentication, and security. These cookies cannot be disabled.
Functional Cookies: These cookies remember your preferences, language settings, and recently viewed names to enhance your experience. They are not strictly required for the Service to function.
Analytics Cookies (Google Analytics): These cookies track page views, user flows, and feature usage to help us understand how the Service is used and how we can improve it. Google Analytics uses cookies such as _ga and _gid.
Advertising Cookies (Google AdSense): These cookies are used to serve and measure advertisements. They may track your browsing activity across websites for the purpose of delivering personalized advertising. These cookies are set by Google's advertising network.

Cookie Management

We will implement a cookie consent banner that allows you to accept or reject non-essential cookies before they are placed on your device.
You can manage cookies at any time through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the Service.
We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we treat it as an opt-out of data sharing for targeted advertising.
We honor Do Not Track (DNT) browser signals.

Third-Party Cookies

Google Analytics and Google AdSense set their own cookies on your device. Their data collection and use practices are governed by Google's Privacy Policy.

7. Data Retention

Account Data: Your account data is retained for as long as your account remains active.
Account Deletion: Upon account deletion, we retain your data for 30 days as a grace period in case of accidental deletion. After this 30-day period, all personal data associated with your account is permanently and irreversibly deleted from our active systems.
Anonymized and Aggregated Data: Data that has been anonymized or aggregated so that it can no longer be linked to you may be retained indefinitely for analytics and service improvement purposes.
Search History: Your search history is retained for up to 24 months, after which it is automatically deleted.
Couple Collaboration Data: If one partner deletes their account, shared data such as shortlists and votes remains visible to the remaining partner, but the deleted user's identity is anonymized.
User-Generated Content: Reviews, forum posts, and other user-generated content remains on the platform after account deletion unless you specifically request its removal, in which case it is deleted within the 30-day grace period.
Backup Systems: Backups containing your data are purged within 90 days of your account deletion.
Legal Holds: Data may be retained beyond these periods if required by law, regulation, or active legal proceedings.

8. Data Security

We implement a variety of security measures to protect your personal information:

All data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
Passwords are cryptographically hashed using industry-standard algorithms. We never store passwords in plaintext.
Database access is restricted to authorized personnel and services only.
Our infrastructure is hosted on enterprise-grade cloud platforms with industry-standard security certifications.
We conduct regular security reviews of our codebase and infrastructure.
We maintain access logging and monitoring for suspicious activity.
Payment data (future) will be handled entirely by Stripe, a PCI DSS Level 1 certified payment processor. We will never receive, process, or store full credit card numbers.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

In the event of a data breach affecting your personal information, we will notify affected users without unreasonable delay and notify relevant authorities as required by applicable law.

9. Your Privacy Rights

9a. Rights for All Users

Regardless of your location, you have the following rights with respect to your personal data:

Access: You may request a copy of the personal data we hold about you.
Correction: You may request correction of any inaccurate or incomplete personal data.
Deletion: You may delete your account and request deletion of your personal data.
Data Portability: You may export your personal data (including your favorites, lists, and preferences) in a machine-readable format. This right does not include the right to export or download bulk name database content, editorial content, or other users' data.
Opt-out of Marketing: You may unsubscribe from marketing emails at any time via the unsubscribe link in any marketing email or by contacting us.
Opt-out of AI Profiling: You may request that your data not be used for AI-based recommendations.

To exercise any of these rights, contact us at hello@hibabyhi.com. We will respond to your request within 30 days.

9b. Additional Rights Under GDPR (EU/EEA/UK Users)

If you are located in the European Union, European Economic Area, or the United Kingdom, you have the following additional rights under the General Data Protection Regulation (GDPR):

Right to Object: You may object to the processing of your personal data based on our legitimate interests.
Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances.
Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

Legal Bases for Processing: We process your personal data on the following legal bases:

Consent: For marketing communications and non-essential cookies.
Contract Performance: For providing the Service to you as described in our Terms and Conditions.
Legitimate Interest: For analytics, security, fraud prevention, and service improvement.

International Data Transfers: Your data is transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) as approved by the European Commission to safeguard your data during international transfers. Our content delivery network may process requests at edge nodes worldwide.

9c. Additional Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know: You have the right to know what personal information is collected, used, and disclosed about you.
Right to Delete: You have the right to request deletion of your personal information.
Right to Opt Out: You have the right to opt out of the sale or sharing of your personal information.
Right to Non-Discrimination: You have the right not to be discriminated against for exercising your privacy rights.
Right to Correct: You have the right to correct inaccurate personal information.
Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by the CPRA.

Categories of Personal Information Collected in the Past 12 Months:

Identifiers (name, email address, IP address)
Internet or other electronic network activity information (browsing history, search history, interactions with the Service)
Geolocation data (approximate, city/region level)
Inferences drawn from the above (preferences, characteristics, behavior patterns)

Categories of Personal Information Disclosed for Business Purposes:

Identifiers and internet activity to service providers (cloud infrastructure, email delivery, managed database services)
Internet activity to analytics providers (Google Analytics) and advertising partners (Google AdSense)

We do not sell personal information. Sharing data with Google AdSense for personalized advertising may constitute "sharing" under the CPRA. You may opt out of such sharing.

To Opt Out: Email hello@hibabyhi.com with the subject line "Do Not Sell or Share My Personal Information," or use the Global Privacy Control (GPC) signal in your browser.

Authorized agents may submit requests on your behalf with proper verification.

9d. Additional US State Privacy Laws

We comply with applicable state privacy laws, including those enacted in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with enacted privacy legislation. Residents of these states may exercise their rights by contacting us at hello@hibabyhi.com.

10. Children's Privacy

HiBabyHi.com is not directed at children under the age of 18. It is a service designed for adults who are choosing baby names.

We do not knowingly collect personal information from anyone under the age of 18. The baby name data on our platform is informational content about names and is not data collected from children.

If we learn that we have inadvertently collected personal information from a person under the age of 18, we will delete that information promptly.

Parents or guardians who believe their child has provided personal information to us may contact us at hello@hibabyhi.com, and we will delete it immediately.

We comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect, use, or disclose personal information from children under the age of 13.

11. International Data Transfers

All personal data is stored in the United States on managed cloud infrastructure.

Our content delivery network processes web requests at edge nodes worldwide for performance and security purposes. This means your request may be processed at a data center outside your country of residence before reaching our US-based servers.

For EU/EEA/UK users, we rely on Standard Contractual Clauses (SCCs) to provide adequate safeguards for international data transfers as required by the GDPR.

By using HiBabyHi.com, you acknowledge and consent to the transfer of your data to the United States.

12. Third-Party Services and Links

Our site may contain links to third-party websites and services that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services.

Social login providers (Google, Facebook) are governed by their respective privacy policies.
Google Analytics and Google AdSense are governed by Google's Privacy Policy.
Stripe (future payment processing) is governed by Stripe's Privacy Policy.
Our email service provider is governed by its own privacy policy.

We encourage you to review the privacy policies of any third-party services you interact with through or in connection with the Service.

13. "Do Not Sell or Share My Personal Information"

This section is provided as required by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

We do not sell your personal information.

Sharing data with Google AdSense for cross-context behavioral advertising may constitute "sharing" under California law.

To opt out of sharing:

Email hello@hibabyhi.com with the subject line "Do Not Sell or Share My Personal Information."
Use the Global Privacy Control (GPC) signal in your browser.
When implemented, use our cookie consent preferences to disable advertising cookies.

We will process opt-out requests within 15 business days.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

For material changes, we will notify users via email and/or a prominent notice on the Site at least 30 days before the changes take effect.

For minor changes such as corrections of typographical errors or formatting updates, we will update the effective date at the top of this page without separate notice.

Previous versions of this Privacy Policy are available upon request by emailing hello@hibabyhi.com.

Your continued use of the Service after changes take effect constitutes your acceptance of the revised Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: