Version 1.0 — in force as of 17/08/2026
English translation. In the event of any discrepancy with the French version, the French version prevails.
1. Who is responsible for your data
The data controller is The Milk Company, registered with the Paris Trade and Companies Register under SIREN 108 402 389, with its registered office at 122 rue Amelot, 75011 Paris, France.
For any question, or to exercise your rights: privacy@milkup.ai
2. What MilkUP is
MilkUP is an app that supports the decisions you make around pumping.
MilkUP is not a medical device within the meaning of Regulation (EU) 2017/745. The app makes no diagnosis, offers no treatment, and is in no way a substitute for the advice of a healthcare professional. If you have a concern about your health or your child's health, consult a healthcare professional.
This changes nothing about your rights over your data: we treat your breastfeeding and pumping data as health data within the meaning of Article 9 GDPR.
3. The data we process
3.1 Account and identity
Email address, first name, last name, the authentication provider used, region, account creation date, last update date, last sign-in date, role, and an internal pseudonym used for our usage statistics. This data is necessary to create and manage the account; without it, we cannot open an account for you.
3.2 Pumping and breastfeeding sessions — health data
For each session: timestamp, quantity, duration in minutes, and whether it was a power pump session or direct breastfeeding.
3.3 Settings and onboarding — health data
Display name, preferred unit of measurement, date format, time zone, main pumping goal, current daily quantity and number of sessions per day, main difficulty encountered, number of days or weeks postpartum, current feeding setup, language.
3.4 Free-text fields — health data
The app includes free-text fields, presented during onboarding: the "other" answer to questions about your goals, difficulties and how you are feeling.
3.5 Check-ins — health data
Answers about your comfort and how you feel over time: how you feel during and after pumping, whether you feel discomfort or tension, whether pumping feels like it brings you relief, whether you are spacing out your pumping sessions, how you are experiencing this transition, and any other question related to breastfeeding, pumping and pregnancy.
3.6 Generated analyses and messages — health data
From the data described in sections 3.2 to 3.5, the app computes indicators about variations in your output and generates personalised supportive messages. These analyses and messages are automatic, produced by the app without human intervention, and stored in your account. They are neither a diagnosis nor medical advice (section 2). MilkUP automatically compares the data you record — timestamps, volumes, how you feel — with your own earlier records and with reference points matching your postpartum stage, in order to surface your variations and offer you organisational suggestions. This processing constitutes profiling within the meaning of Article 4(4) GDPR. These suggestions are indicative. You remain free to follow them or not, and that choice has no consequence for your account, your subscription, your access to features, or the content you receive. We make no decision based solely on automated processing producing legal effects concerning you or similarly significantly affecting you, within the meaning of Article 22 GDPR.
3.7 Subscription
Your subscription is taken out exclusively through Apple In-App Purchase. Apple is the merchant of record. We do not receive, process or store any bank card data or any payment details. Through our provider RevenueCat, we receive only a technical subscription identifier, the subscription status and its expiry date.
If you request a refund from Apple, Apple may ask us for app usage data in order to review your request. This data, which includes no health data, is transmitted directly to Apple, which remains solely responsible for it.
3.8 Technical data
Your device's push notification token, technical logs from our servers (IP address, timestamp, errors), and crash reports transmitted by Apple.
We also collect data about your device and your use of the app — device model, operating system version, app version, and usage events such as which screens are viewed or which features are used — linked to the internal pseudonym mentioned in section 3.1 and used for statistics and product improvement.
3.9 Audience measurement and forms
On our marketing website: audience measurement via Google Analytics, subject to your prior consent.
In the app, on our marketing website, on our blog and in our newsletter, we also use forms (Tally) to collect your support requests and complaints, as well as your feedback, recommendations and content preferences, used to design and improve our editorial content. Depending on the form, we collect your email, your name and the content of your message. No health data is collected through this channel.
3.10 Feedback and user research — health data
If you consent to it, we may contact you, in the app or on our website, to collect your feedback about MilkUP (survey or one-to-one interview). We use your email and your first name to invite you and, where applicable, to schedule an interview. Surveys are hosted on our own infrastructure; your answers are stored in the European Union. One-to-one interviews take place over video call via DigitalSamba, hosted in the European Union and end-to-end encrypted; the call is neither recorded nor retained. Notes taken during these interviews are stored end-to-end encrypted on Proton Drive. Your answers, which may relate to your experience of pumping and breastfeeding, are never shared in identifiable form with third parties.
3.11 Editorial newsletter
Our editorial newsletter is hosted on the Substack platform, which directly manages your subscription, under your consent, along with the associated readership statistics. This subscription is independent of your MilkUP account and of the consent described in section 3.12. These emails contain an open- and click-tracking pixel, set and used by Substack on its own behalf. Substack is the controller for that processing and for the consent attached to it: we determine neither its purposes nor its means. To object to it or to obtain information, contact Substack via its privacy policy.
3.12 Marketing communications by email
If you consent to it, we may send you, through our provider Brevo, emails of a commercial or promotional nature concerning MilkUP — for example to tell you about a new feature, a referral programme, a promotional offer, or to invite you to move to a paid subscription. These emails may be sent:
- to the people who use MilkUP, at the email address associated with their account (section 3.1);
- to people who do not use MilkUP but who have given us their email by voluntarily signing up to a waitlist, a form or another collection point provided for that purpose.
Depending on the case, we process your email, your first name (where applicable) and your subscription status for these communications.
No health data is transmitted to Brevo.
You can withdraw this consent at any time via the unsubscribe link in every email, or in the app's settings. This withdrawal is independent of your consent to the editorial newsletter (section 3.11), and affects neither your MilkUP account nor the communications we are required or otherwise legitimately entitled to send (for example a notification of a substantial change to this policy, provided for in section 13, or a communication relating to the security of your account).
These emails contain a tracking pixel that tells us whether you opened them and which links you clicked. We measure opens and clicks only if you have accepted it. You can change that choice at any time.
4. On what legal basis
| Processing | Interest | Legal basis | Nature |
|---|---|---|---|
| Pumping and breastfeeding log and tracker | Recording and retaining your sessions, check-ins, free-text fields and account settings, and analysing that data to show you your variations and send you personalised messages and programmes | Art. 6(1)(b) — performance of the contract, and Art. 9(2)(a) — explicit consent | Recording this data is the very purpose of the app; this consent covers only what is necessary to provide you with MilkUP. Without this consent, the app cannot be used. All other uses of your health data are optional, off by default, and can be refused without losing access to the app. |
| Improving MilkUP | Pooling, under a pseudonym, your pumping and breastfeeding sessions (timestamp, quantity, duration, session type) with those of other users, in order to improve our models | Art. 6(1)(a) — consent, and Art. 9(2)(a) — explicit consent | Optional, off by default. Revocable at any time. |
| Feedback and user research | Invitation to surveys or interviews about your experience of MilkUP | Art. 6(1)(a) — consent, and Art. 9(2)(a) — explicit consent | Optional. Revocable at any time, without deleting your account. |
| Account creation and management, provision of the subscription | Account creation and management, provision of the subscription | Art. 6(1)(b) — performance of the contract | — |
| Service security | Access control, protection against intrusion and abusive use | Art. 6(1)(f) — legitimate interest | Right to object (section 9) |
| Fraud prevention | Detection of fraudulent accounts and subscriptions | Art. 6(1)(f) — legitimate interest | Right to object (section 9) |
| Technical logs and crash reports | Recording errors and incidents on our servers and in the app, in order to diagnose and fix malfunctions | Art. 6(1)(f) — legitimate interest | Right to object (section 9) |
| Pseudonymised usage statistics | Screens viewed, features used, device model, operating system and app version | Art. 6(1)(a) — consent, and Article 82 of the French Data Protection Act | Optional, off by default. Revocable at any time in the settings. |
| Push notifications | Sending notifications about your pumping routine or programme | Art. 6(1)(a) — consent, and Art. 9(2)(a) — explicit consent (their content is produced from your health data — section 12) | Revocable at any time |
| Website audience measurement | Website traffic statistics | Art. 6(1)(a) — consent, and Article 82 of the French Data Protection Act | Revocable at any time via "Cookies" |
| Accounting obligations | Accounting obligations, responses to legal requests | Art. 6(1)(c) — legal obligation | Accounting records and billing supporting documents — 10 years from the close of the financial year (Article L123-22 of the French Commercial Code). No health data. |
| Responses to requests from authorities | Responding to a judicial or administrative order; establishing, exercising or defending a legal claim | Art. 6(1)(c) — legal obligation, and Art. 6(1)(f) — legitimate interest. For your health data: Art. 9(2)(f) — establishment, exercise or defence of legal claims | Limited to what the request requires. |
| Newsletter | Sending editorial content by email | Art. 6(1)(a) — consent | Optional. Revocable at any time (unsubscribe link in every email), without deleting your account. |
| Marketing email | Sending content by email | Art. 6(1)(a) — consent | Optional. Revocable at any time (unsubscribe link in every email), without deleting your account. |
| Support | Handling your requests and keeping a record of the exchanges | Art. 6(1)(f) — legitimate interest | Right to object (section 9) |
| Content recommendations and preferences | Used to design and improve our editorial content | Art. 6(1)(f) — legitimate interest | Right to object (section 9) |
| Refund handling (transmission of information to Apple) | Refund handling (transmission of information to Apple) | Art. 6(1)(b) — performance of the contract | — |
| Email open and click measurement | Email open and click measurement | Art. 6(1)(a) — consent, and Article 82 of the French Data Protection Act | Optional. Revocable at any time. |
| Suppression list | Retaining your email address after you unsubscribe, for the sole purpose of not writing to you again | Art. 6(1)(f) — legitimate interest | Right to object (section 9). This list serves only to honour your choice: your address is not used for any sending. |
| Business transfer | Transmitting your data to the entity concerned in the event of a merger, a sale or insolvency proceedings, to ensure continuity of the service | Art. 6(1)(f) — legitimate interest. For your health data: Art. 9(2)(a) — explicit consent | Right to object (section 9). You are informed beforehand (section 13) and can delete your account before the transfer. Your health data is transferred only if you explicitly consent to it at that time; failing that, it is deleted. |
Some of the data described in section 3 is processed, and flagged, as health data (Article 9 GDPR) from the moment it is collected. Each of these processing activities rests both on a basis under Article 6 GDPR (performance of the contract or consent, as the case may be) and on your explicit consent under Article 9(2)(a), required specifically for health data: separate consents, which you give and withdraw separately.
Each consent has its own dedicated screen or setting. Withdrawing a consent does not affect the lawfulness of processing carried out before that withdrawal.
5. Who else has access to your data
Neither we nor our providers access your data beyond what is strictly necessary for our roles. The following providers and partners access your data. The "Capacity" column indicates whether they act on our behalf (processor) or on their own (separate controller):
| Processor | Role | Data concerned | Place of processing | Capacity |
|---|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | Hosting: database, API, analytics warehouse, logs, secrets | All | European Union for EU users' data | Processor |
| Apple (Apple Distribution International Ltd.) | Push notifications, Sign in with Apple, App Store, crash reports, review of refund requests | Device token and notification content, Apple identifier, subscription data, usage data transmitted for the review of refund requests (where applicable — see section 3.7) | International | Separate controller |
| Google (authentication) | Sign in with Google and token verification | Google account identifier | International | Separate controller |
| RevenueCat, Inc. | Subscription management | Subscription identifier, status, expiry | United States | Processor |
| Google Analytics | Audience measurement for the marketing website, subject to consent | Browsing and usage data (website) | United States | Processor (under the contract) |
| Tally (Tally BV) | Support, feedback and suggestion forms (app, marketing website, blog, newsletter) | Email, name, message content | European Union (Belgium) | Processor |
| DigitalSamba | Hosting of video calls for user research interviews (3.10) | Audio/video streams (end-to-end encrypted, not stored); connection metadata (IP, timestamp, session ID) | European Union | Processor |
| Brevo (Sendinblue SAS) | Sending marketing emails | Email, first name (where applicable), subscription status, engagement data (opens, clicks) | France / EU | Processor |
| Substack (Substack Inc.) | Hosting of the editorial newsletter and measurement of opens and clicks | Email address, readership statistics | United States | Separate controller: newsletter platform. Substack is the controller for the reader account and for its platform's features; MilkUP is the controller for sending its newsletter. |
| Proton (Proton AG) | End-to-end encrypted storage of user research interview notes (section 3.10) | Content of the interview notes (may contain health data) | Switzerland | Processor |
We may also have to disclose data to a judicial or administrative authority where the law requires it, and to legal or accounting advisers bound by professional secrecy.
Business transfer. In the event of a merger, a sale of all or part of our business, or insolvency proceedings, your data could be transferred to the entity concerned, which would remain bound by this policy. You would be informed beforehand (section 13) and could delete your account before the transfer.
6. Transfers outside the European Union
Your health data relating to your pumping and breastfeeding sessions, your check-ins and your free-text fields is stored on servers located in the European Union. In certain technical support situations, our host's staff may access it from another country. Such access is governed by the European Commission's standard contractual clauses, logged, and limited to what is necessary to restore the service. User research interview notes (section 3.10) are subject to separate processing, where hosting of the end-to-end encrypted data takes place in Switzerland, described at point 6 of the list below.
Certain other personal data — excluding health data — leaves our Google Cloud infrastructure, in the following cases:
- Apple push notifications — your device token, and the content of the notification, pass through Apple's infrastructure (see section 12).
- Identity verification at sign-in — each sign-in calls Apple's or Google's global endpoints, which receive your Apple or Google account identifier.
- Google Analytics — processing in the United States, on our marketing website, subject to your prior consent in each case.
- RevenueCat — your subscription's technical identifier, its status and its expiry date are processed in the United States by our subscription management provider.
- Substack — if you sign up to our editorial newsletter, your email address is processed by Substack, a US company, which acts as a controller on its own behalf. The transfer of your data to the United States is governed by its privacy policy and the mechanisms it puts in place.
- Proton — notes taken during user research interviews (section 3.10) are stored, end-to-end encrypted, on Proton Drive, hosted in Switzerland. Switzerland benefits from an adequacy decision of the European Commission under Article 45 GDPR: this transfer therefore takes place without standard contractual clauses.
Each of these transfers is governed as follows:
- RevenueCat (point 4) — standard contractual clauses adopted by the European Commission on 4 June 2021, supplemented where appropriate by additional measures.
- Google Analytics (point 3) — certification of Google LLC under the EU–US Data Privacy Framework, recognised as adequate by the European Commission's adequacy decision of 10 July 2023.
- Proton (point 6) — European Commission adequacy decision applicable to Switzerland (Article 45 GDPR), which removes the need for standard contractual clauses.
- Apple and Google (points 1 and 2) — Apple and Google act as separate controllers. They govern these transfers themselves, under their own privacy policies.
- Substack (point 5) — Substack acts as a separate controller and governs this transfer itself, under its own privacy policy.
For the transfers we govern ourselves, you can obtain a copy of the safeguards by writing to privacy@milkup.ai.
We do not sell your personal data, including your health data, and we do not transfer it to any third party for its own use.
7. How long we keep your data
For the purposes of this policy, the "lifetime of the account" means the period during which your account is open. It ends when the account is closed. An account is closed in two cases:
- at your request, at any time, from the app's settings or by writing to us (section 9);
- after 24 consecutive months without a sign-in. We then send you a warning email; if you do not sign in within the following 30 days, the account is closed.
In both cases, your data is deleted within 30 days of closure, except for the data for which the table below indicates a different period.
| Data | Retention period |
|---|---|
| Account and identity | Lifetime of the account, then deletion within 30 days |
| Sessions, check-ins, free-text fields, settings | Lifetime of the account, then deletion within 30 days |
| Generated supportive messages | Lifetime of the account, then deletion within 30 days |
| Data pooled to improve MilkUP | Same periods as the original data: lifetime of the account, then deletion within 30 days. If consent is withdrawn, the pooling stops and your data is removed from the training set within 30 days. Models already trained contain no data that could identify you; their deletion is therefore not covered by these periods. |
| Inactive account | After 24 months without a sign-in, we send you a warning email; if you do not sign in within 30 days, the account and all associated data are deleted |
| Proof of your consents | 5 years from withdrawal or from deletion of the account (Article 2224 of the French Civil Code) |
| Subscription data (RevenueCat) | Duration of the subscription + 12 months |
| Push notification token | Until sign-out, uninstallation or invalidation; 12 months of inactivity at most |
| Server technical logs and crash reports | 12 months |
| Google Analytics (website) | 14 months |
| Waitlist form | 18 months from collection |
| Correspondence with support | 25 months |
| Pseudonymised usage statistics (section 3.8) | Lifetime of the account, then deletion within 30 days. Models trained on this data contain no data that could identify you; their deletion is therefore not covered by the periods above. |
| Backups | Rolling 30-day window: a deletion propagates to backups as they expire |
| Answers to UX surveys and interviews (3.10) | 25 months from the last contact |
| Newsletter | Until you unsubscribe |
| Marketing email | Until you withdraw your consent. Your address is then kept on a suppression list for 3 years, for the sole purpose of not writing to you again, and then deleted. |
| Editorial content recommendations and preferences | 25 months |
| DigitalSamba (IP, timestamp, ID) | 25 months |
8. Security and hosting
Your health data from the app is hosted on Google Cloud, HDS-certified, in the EU. User research interview notes are stored end-to-end encrypted on Proton Drive, in Switzerland (section 3.10).
Technical measures in place: encryption of all traffic in transit (TLS), encryption at rest of data stored on Google Cloud (AES-256), additional application-level encryption of identifying data in our analytics warehouse using a regional AES-256 key, authentication delegated to Apple and Google (we store no passwords), access segregation and logging.
We notify the CNIL within 72 hours of any breach likely to result in a risk to your rights, and we inform you as soon as possible where the risk is high.
9. Your rights
You have the following rights over your data:
- Access (Art. 15) — obtain a copy of your data.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (Art. 17) — obtain the deletion of your data and your account.
- Restriction (Art. 18) — freeze a processing activity while a dispute is resolved.
- Portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on our legitimate interest.
- Withdrawal of consent (Art. 7(3)) — at any time, for each consent, without having to give a reason.
- Post-mortem instructions (Article 85 of the French Data Protection Act) — decide what happens to your data after your death.
How to exercise them. Write to privacy@milkup.ai. We reply within one month. We may ask you for proof of identity in the event of reasonable doubt.
Withdrawing consent for "Pumping and breastfeeding log and tracker" results in the deletion of your account; it is done in the app's settings.
Withdrawing consent for "Improving MilkUP" or "Feedback and user research" is done directly in the app's settings, without writing to us and without deleting your account.
Complaint. If you believe your rights are not being respected, you can lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or www.cnil.fr, or with the data protection authority of your country of residence in the European Union.
10. Cookies and trackers
The pseudonymised usage statistics relating to the MilkUP app, described in section 3.8, are collected directly by our servers, with no third-party tracker.
The marketing website uses Google Analytics for audience measurement events. In accordance with Article 82 of the French Data Protection Act, these trackers are only set after your consent, collected via a banner that makes refusing as easy as accepting. Trackers strictly necessary for the site to work are exempt from consent. We do not respond to "Do Not Track" signals sent by browsers. Google Analytics may collect information about your browsing over time and on third-party sites other than ours. You can change this choice at any time via the "Manage cookies" link at the bottom of every page of the site. Google Analytics trackers are kept on your device for 13 months at most.
11. Minimum age
MilkUP is reserved for adults. If we learn that an account has been created by a minor, we delete it along with the associated data.
12. Notifications
Push notifications require your permission, given at the level of your operating system.
The content of your notifications is encrypted between our servers and your device: Apple's infrastructure (see section 6) relays only encrypted content and cannot read it. Once received by your device, the notification is decrypted by the MilkUP app, which can then display information about your pumping routine or programme in the visible content of the notification.
As with any app, this content may appear on your device's lock screen, depending on iOS's own notification settings. You can limit what is displayed via your device's settings (Settings > Notifications > MilkUP > Previews), for example by choosing to show previews only when the device is unlocked, or never.
The content displayed in your notifications is produced from your health data, on the basis of your explicit consent. It is encrypted between our servers and your device: Apple relays only content it cannot read.
13. Changes
This policy may evolve with the product. Any substantial change — a new purpose, a new processor, a new category of data — is notified to you in the app and by email before it takes effect. Where the change concerns processing based on your consent, a new consent is requested from you.