Privacy Policy

Baby Notte is a brand operated by Cortese Digital, an Ontario sole proprietorship based in Canada. This page explains what personal information we collect when you visit our site (babynotte.com, and our preview address at babynotte.pages.dev), how we use it, who we share it with, and the choices and rights you have. We have written it in plain English because you should be able to read it without a law degree.

If you have any questions after reading, email us at babynotte.co@gmail.com. We answer everything ourselves.

What information we collect

We try to collect as little as possible. Here is the full list.

When you take the quiz on our site:

• Your email address (so we can send you the routine we promised)
• Your baby's approximate age, selected from a fixed set of options
• The sleep issue you picked from a fixed set of options

We store these in our database (Cloudflare KV) under a key that includes the timestamp and your email.

When you buy one of our guides:

• Your name, email address, and billing address, collected by Stripe at checkout
• Your payment method information, handled and stored entirely by Stripe (we never see or store your full card details)
• The order ID, the product you bought, the amount, and the time of purchase, which we store in our database so we can deliver your file and process refunds

When you visit any page:

• Standard server log information through Cloudflare (your IP address, browser, country, and the time of your visit), used for security, fraud prevention, and basic uptime monitoring

We do not run Google Analytics, Meta Pixel, advertising networks, retargeting, or any third-party behavior tracking. We do not build profiles on you.

How we use your information

We use the information above to:

• Send you the bedtime routine after you complete the quiz
• Process your purchase and deliver the PDF you bought
• Send transactional emails (download links, refund confirmations, replies to your questions)
• Respond when you contact us
• Improve the site and our products based on aggregated patterns (for example, which quiz answer is most common)
• Comply with our legal and tax obligations

We do not use your information for ad targeting, and we do not sell it to anyone.

Legal basis for processing

In Canada under PIPEDA, we collect your information based on your consent, which you give when you submit the quiz, complete a purchase, or send us an email.

For visitors in the European Economic Area and the United Kingdom, our lawful bases under the GDPR (and UK GDPR) are:

• Consent (Article 6(1)(a)), for the quiz and the welcome email it triggers
• Performance of a contract (Article 6(1)(b)), for delivering products you purchased
• Legitimate interests (Article 6(1)(f)), for basic security logging and fraud prevention

How we share your information

We do not sell, rent, or trade your personal information. We share it only with the small set of service providers we need to run the site:

• Stripe (United States) processes payments. Stripe handles all card data and shares with us only what we need to fulfill your order (your email, order ID, product, and amount).
• Cloudflare (United States) hosts the site, stores our database (KV) and our paid-product files (R2), and provides security and DDoS protection. Cloudflare sees your IP address and standard request information.
• Resend (United States) sends the emails we send you (the welcome email after the quiz, the delivery email after a purchase). Resend processes your email address and the content of the messages.
• Amazon Associates (United States) is our affiliate program for product recommendations. If you click an affiliate link on our resources page and then buy something on Amazon, Amazon shares anonymized commission data with us. They do not share your personal information with us.

We may also disclose information if required by law, court order, or to protect our legal rights, our customers, or the public.

How long we keep your information

• Quiz responses and email addresses: for as long as you remain a subscriber, or until you ask us to delete them.
• Order records: at least seven years, because the Canada Revenue Agency requires us to retain transaction records for tax purposes.
• Email delivery records held by Resend: per Resend's own retention policy, typically a matter of months.
• Server log information held by Cloudflare: per Cloudflare's defaults, typically a matter of days to weeks.

If you ask us to delete your information and we are legally required to retain some of it (for example, financial records for tax), we will delete what we can and keep only what we must.

How we protect your information

We protect your information with measures that include:

• HTTPS encryption on every page of the site
• Encrypted-at-rest storage for our database and file delivery (Cloudflare KV and R2)
• Payment data handled entirely by Stripe, a PCI DSS Level 1 service provider
• Strong authentication on every internal account that can access subscriber data
• No personal data stored in our code repository or anywhere outside the processors named above

No system is perfectly secure, but we take this seriously, and we will notify you promptly if we ever learn that your information has been compromised.

Your rights

You have rights over your personal information. The exact set depends on where you live, but the most common ones are listed below. To exercise any of them, email us at babynotte.co@gmail.com. We respond within 30 days, usually much faster.

If you are in Canada (PIPEDA):

• The right to know what personal information we hold about you
• The right to ask us to correct anything that is wrong
• The right to withdraw your consent at any time, which may end our ability to send you certain things, like product updates
• The right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

If you are a California resident (CCPA):

• The right to know what personal information we collect, use, and share
• The right to request deletion of your personal information
• The right to opt out of the sale of your personal information. We do not sell personal information, so there is nothing to opt out of, but we are required to tell you the right exists.
• The right not to be discriminated against for exercising any of these rights

If you are in the European Economic Area or the United Kingdom (GDPR / UK GDPR):

• Access to your data
• Rectification (correction) of inaccurate data
• Erasure (the "right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing
• The right to lodge a complaint with your local data protection authority

Children's privacy

Baby Notte is designed for adult parents and caregivers. We do not knowingly collect personal information from children under 13. The products discuss children's sleep but are purchased and used by adults. If you believe a child has provided us with personal information, please contact us and we will delete it.

Cookies and tracking

We use only the small set of cookies that Cloudflare sets automatically for site security and basic functioning (for example, a bot management cookie). We do not use Google Analytics, Meta Pixel, advertising cookies, retargeting cookies, or any other tracking technology. We do not show ads.

International data transfers

Cortese Digital is based in Canada. Our service providers (Stripe, Cloudflare, Resend) are based in the United States and may process data in any of their global facilities. By using the site or purchasing a product, you understand that your information may be transferred to and stored in countries other than your own, including the United States. We rely on the standard data transfer mechanisms our processors provide.

Changes to this policy

We may update this policy from time to time. If we do, we will change the effective date at the top of the page. If the changes are significant and we have your email address, we will let you know by email so you can decide whether to continue using the service.

Contact us

For any privacy question, request, or complaint, email us at babynotte.co@gmail.com. We respond within 30 days, usually much faster.