top of page

PRIVACY POLICY

Cubbi App Ltd

​

Cubbi App Limited (company, we, us and our) respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website and tell you about your privacy rights.

 

1.   Controller

Cubbi App Limited is the data controller and responsible for your personal data. "Controller" and "personal data" shall have the meanings given to them in the UK GDPR.

​

If you have any questions about this privacy notice or our data protection practices, please contact us at: hello@cubbi.uk.

​

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

​

2.   Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us by contacting us using the details provided under section 1 above.

​

3.   Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

​

4.   The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

​

We may collect, use, share and/or store different types of personal data about you from the following categories:

  • Identity Data includes name, title, supporting evidence of status as a new or expecting parent (which may include MATB1/SC3 forms, birth certificates, maternity exemption certificates, letters from adoption or surrogacy agencies, foster carer ID cards, or baby loss certificates);

  • Contact Data includes delivery address, email address, telephone number;

  • Technical Data includes IP address, login data, browser type and/or version;

  • Profile Data includes username, password, purchase or order details, preferences, customer feedback; and

  • Usage Data includes information about website usage, and/or information about usage of other services.

​

5.   Special Categories of Personal Data

Apart from the health-related information contained in evidence documents submitted for membership verification (as described below), we do not anticipate collecting other special categories of personal data from you (such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, or genetic and biometric data). As part of our membership verification process, we collect and process special categories of personal data contained in evidence documents you submit to verify your eligibility. This may include health-related information (such as pregnancy details on MATB1/SC3 forms or maternity exemption certificates), information about children (such as birth certificates or baby loss certificates), and information relating to adoption or fostering arrangements.

​

6.   How is your personal data collected?

We use different methods to collect data from and about you including through:

  • Direct interactions: you may give us your identity and contact data by filling in forms or by corresponding with us by post, phone, email or otherwise. When applying for membership, you will submit evidence documents to verify your eligibility as a new or expecting parent;

  • Automated technologies or interactions: as you interact with our website, we will automatically collect Technical Data and Usage Data, as described above, about your equipment, browsing actions and patterns. We may collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies.

  • Third parties or publicly available sources: we may receive personal data about you from various third parties who collect data on our behalf.

​

7.   Lawful bases

We will only use your personal data in accordance with relevant data protection laws, namely the UK GDPR and Data Protection Act 2018. Most commonly, we will use your personal data in the following circumstances:

  • Legitimate interests: where it is necessary for our provision of services and we have genuine and legitimate reasons to collect your personal data (for instance, to operate our website and manage our relationship with you). These reasons are set out in section 8 below.

  • Performance of a contract: where we require your information to comply with contract obligations.

  • Consent: where we have your explicit consent to collect your personal data. We rely on your explicit consent to process the special category personal data contained in evidence documents you submit for membership verification.

 

8.   Purposes for which we will use your personal data

We may use your personal data for the following legitimate purposes:

  • to register you as a new customer and verify your eligibility for membership using a two-stage process: (i) automated review of your submitted evidence documents using AI software, and (ii) where the AI cannot verify eligibility, human review by our staff members. This processing is based on your explicit consent for special category data and our legitimate interest in operating the membership scheme;

  • to manage our relationship with you, for instance, to rely to requests for information, complaints and queries;

  • to carry out data analysis and internal website testing, system maintenance and monitoring, and to share technical data with system software / app developers (we do not share your evidence documents for these purposes, and evidence is deleted after verification as explained below);

  • to share information with our various discount providers, brands and partnerships to enable your membership benefits (we do not share evidence documents with brand partners. Evidence is used solely for verification and is deleted once the review is complete);

  • to make suggestions and recommendations to you about brands, goods or services that may be of interest to you.

​

9.   Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

​

Evidence documents submitted for membership verification: We use your evidence documents solely to verify your eligibility for membership. Once verification is complete (whether your application is approved or rejected, either by the AI system or following human review), your evidence documents are permanently deleted from our systems. We retain only your name, email address, and date of birth as part of your user account. This deletion policy applies to all evidence types, including MATB1/SC3 forms, birth certificates, maternity exemption certificates, letters from adoption or surrogacy agencies, foster carer ID cards, and baby loss certificates. We understand these documents contain deeply personal information, and we are committed to retaining them only for as long as necessary to verify your eligibility.

10.   Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to:

  • Request access to your personal data: this enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

  • Request erasure of your personal data: this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.

  • Object to processing of your personal data: where we are relying on a legitimate interest which you feel impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. You also have specific rights regarding automated decision-making, as explained in section 11 below.

  • Request restriction of processing of your personal data: this enables you to ask us to suspend the processing of your personal data in certain circumstances, for example if you want us to establish the accuracy of the data or the reason for processing it.

  • Withdraw consent at any time: where we are relying on consent to process your personal data. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

​

11.   AI-assisted membership verification

11.1 When you apply for membership, we use a two-stage process to verify your eligibility:

11.1.1 Stage 1 - AI Review: We use AI software to automatically review the evidence document you submit. The AI system analyses the document to verify that you are a new or expecting parent and therefore eligible for membership. If the AI successfully verifies your eligibility, your application is approved.

11.1.2 Stage 2 - Human Review: The AI system cannot reject applications automatically. If the AI cannot verify your eligibility (for example, if the document image is unclear or the AI requires further assessment), your application is automatically referred to a member of our staff for manual review. A human reviewer will examine your evidence document and make the final decision on whether to approve or reject your application.

​

11.2 This two-stage approach is a safeguard to protect your rights - it enables efficient verification while ensuring that no application is rejected without human consideration, and applications requiring additional assessment receive human review.

​

11.3 The AI system analyses information from your evidence document, including dates (such as expected due dates or birth dates), names, and official markings, to verify your eligibility against our membership criteria.

​

11.4 Where your application is approved solely by the AI system without human review, this constitutes automated decision-making under Article 22 of the UK GDPR. This automated decision-making is necessary for entering into the membership contract with you - we must verify your eligibility as a new or expecting parent before we can provide you with membership benefits. You have the following rights in respect of AI assisted decision making:

11.4.1  The right to obtain human intervention: You can contact us at any time to request that a member of staff reviews your application or decision, even if it was approved by the AI.

11.4.2 The right to express your point of view: You can contact us to explain your circumstances or provide additional information about your application or evidence.

11.4.3  The right to contest the decision: If you believe the AI decision was incorrect or if you have concerns about how your evidence was assessed, you can ask us to reconsider the decision. We will conduct a human review of your application.

​

11.5  If you have any questions or concerns about how your evidence will be processed, or if you would prefer to discuss your application before submitting evidence, please contact us at hello@cubbi.uk. We are here to support you.

​

12.   International transfers

We do not currently transfer your personal data to countries outside the UK. If we do transfer your personal data outside the UK, we will ensure a similar degree of protection is afforded to it by implementing additional safeguards as required by the UK GDPR and in accordance with ICO guidance.

 

This version was last updated on [27] January 2026.

bottom of page