Last updated 26 October 2026.
This policy explains what Medlito Baby collects, why, who processes it, how long we keep it and how you control it. We follow India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
What we collect
- Account: your name, email address and profile picture from Google sign-in.
- Your baby: name, optional birth date, and the photos you upload for an order.
- Order inputs: family names, ideas, lyrics or story text you type, and which options you choose.
- Your voice: only if you choose “your own voice”, a short recording to make songs or narration in your voice.
- Orders and payments: what you bought, amounts and payment references. Card and UPI details go straight to Razorpay; we never see or store them.
- Messages: what you send us through the contact or refund forms.
- Usage: pages visited, the referring site, device type and app language, counted with our own cookie. See the cookie policy.
Why we use it
Only to make and deliver your orders, check uploaded photos and results for safety and quality, take payments, answer you, prevent misuse, improve the service from aggregate usage, and meet legal duties. We don't sell personal data, show advertising, or build profiles of children. We don't use your baby's photos to train AI models.
Children's data and consent
Only a parent or legal guardian may provide a child's photos or details, and we ask for that consent before using them. You can withdraw consent at any time by deleting the data; we then stop using it.
Who processes it for us
- Google (Gemini) and Anthropic (Claude): AI models that create and check pictures, songs, stories and captions. Their paid services don't use our data to train their models.
- Razorpay: payments.
- Cloudflare (private file storage), Vercel (hosting), Neon (database, Singapore) and Resend (email).
Some processing happens outside India, under contracts that require these providers to protect the data and use it only for us.
Security
Photos and creations are stored privately and are only reachable through short-lived links, unless you create a share link yourself. Data is encrypted in transit and at rest, and access is limited to what's needed to run the service.
How long we keep it
Until you delete it or your account. Payment and invoice records are kept as long as tax law requires, without your baby's photos. Support messages are kept for up to two years.
Your rights
You can see and correct your data in the app, and delete it any time from Profile → Delete my data, or delete one baby from that baby's page. To get a copy of your data, raise a concern or make a complaint, contact us, choosing “My data and privacy” or “Complaint”. We acknowledge within 48 hours and resolve requests within 30 days. You may also approach the Data Protection Board of India.
Changes
If we change this policy we'll update the date above, and tell you in the app before any change that affects how your baby's data is used.