Privacy Policy

Bite100 Food Passport ("Bite100", "we", "us") is a website and app that helps parents track their baby's first foods and the introduction of common allergens. Bite100 is operated by Paper Street Labs LLC, a limited liability company organised in Delaware, USA.

• Legal name: Paper Street Labs LLC
• Business address: 131 Continental Dr Suite 305, Newark, DE 19713, USA
• Email: hello@bite100passport.com (support and privacy requests)
• Phone: +1 302 607 90 42

Paper Street Labs LLC is the controller of the personal data described here. This policy applies to bite100passport.com, the Bite100 app, our printables and printed passports (together, the "Service").

The Service is meant for adults (18+): parents, legal guardians and caregivers. We do not knowingly collect personal data directly from children. Information about a baby is entered by their parent or guardian, who decides what is entered and who can see it (see section 4).

• Account data. Your email address, and your name if you add it. If you sign in with Google, the basic profile Google shares with us (name, email address and profile picture).
• Caregivers you invite. The email address and name of a partner, grandparent or nanny you invite to your passport. Please only invite people who have agreed to it.
• Your baby's passport. What you choose to enter: your baby's first name or nickname, birth date or age, the foods you log, reactions and symptoms you note, notes, photos you upload, allergen plan progress and feeding schedule settings.
• Purchases. Your plan and payment history. Card payments are handled by Stripe; we never see or store your full card number. For a printed passport we also receive your name, shipping address and, if you give it, a phone number for delivery.
• Consent and preference records. Which version of our terms you accepted and when, the reminders and emails you switched on, and your cookie choices.
• Technical data. Basic logs such as IP address, device and browser type, pages requested and error reports, used to keep the Service working and secure. Some settings are saved in your own browser's local storage (see our Cookie Policy).
• Messages. What you send us when you contact support.

Reaction and symptom notes can be health information about your baby. We treat them with extra care, as explained in section 4.

• To provide the Service: your account, saving logs, building suggestions and your allergen plan, creating your pediatrician PDF, sending sign-in links and the reminders you switch on, and syncing with caregivers you invite (contract).
• To handle your baby's health-related notes, such as reactions: only to show them to you and your caregivers and to include them in summaries you create. Where the law requires it, we rely on the explicit consent you give when you enter them, which you can withdraw by deleting them (consent).
• To bill you, ship printed items and keep records: payments, refunds, receipts, delivery and tax records (contract and legal obligation).
• To keep the Service safe: preventing fraud and abuse, security logs and fixing errors (legitimate interests).
• To improve Bite100: understanding which features help families, using aggregated information that does not identify you (legitimate interests).
• To send product news you opted into. Every marketing email has a one-click unsubscribe (consent).

Bite100 is made for parents and caregivers, not for children, and children should not create accounts. If we learn that a child has given us personal data directly, we will delete it.

• The passport belongs to the adult account holder. Only you and the caregivers you invite can see your baby's logs, notes and photos.
• Your logs, reaction notes and pediatrician PDF are your own records. We don't review them for medical purposes, and they are not a medical record or a diagnosis.
• You decide who receives a PDF or export you create. Once you share it outside Bite100, that copy is in your hands.
• You can edit or delete any entry, a photo, or your whole passport at any time.

• We do not sell your personal information or your baby's information.
• We do not share it for cross-context behavioural advertising, and we do not use advertising cookies.
• We do not use your baby's food, reaction or photo data for advertising or to build profiles for third parties.

We share personal data only with service providers that process it on our instructions, under contracts that require them to protect it:

• Vercel: website and app hosting.
• Stripe: payments, receipts and billing records.
• Google: sign-in, only if you choose "Continue with Google".
• Our email provider: sign-in links, receipts and the reminders you switch on.
• Our printing and shipping partners: for printed passports, your name, shipping address and order details only.
• Our database and file storage providers: storing your account, passport and photos.

Providers may keep short-term processing logs under their own policies. We may also disclose data if the law requires it, to protect the safety of a child or others, or as part of a merger or acquisition, in which case this policy continues to apply.

• Account and passport: while your account is open. When a Monthly plan or trial ends, your passport stays readable; it is never wiped because a plan expired.
• After you delete your account: removed from our live systems right away and from backups within 30 days.
• Billing and tax records: as long as the law requires, typically up to 7 years.
• Printed orders: shipping details are kept as long as needed to deliver the order and handle replacements, then with our billing records.
• Technical logs and error reports: up to 90 days.
• Support messages: as long as needed to help you, and no longer than 3 years.

You can delete individual entries and photos, a baby's passport, or your whole account in Settings. You can also email hello@bite100passport.com and we will do it for you. When you delete a passport, caregivers you invited lose access to it.

Depending on where you live (for example under the GDPR, the UK GDPR or US state laws such as the CCPA), you can ask to access, download, correct or delete your data, object to or restrict some uses, and withdraw consent at any time. Email hello@bite100passport.com; we answer within 30 days. We won't treat you differently for using these rights, and you can also complain to your local data protection authority.

We do not sell personal information or share it for cross-context behavioural advertising.

We use only the cookies and browser storage the Service needs to work, and no advertising cookies. Full details are in our Cookie Policy.

Data travels over encrypted connections (HTTPS) and is encrypted at rest by our storage providers. Sign-in uses one-time magic links or Google, so there is no Bite100 password to leak. Photos are never public. Access inside our team is limited to what is needed to run and support the Service.

No system is perfectly secure, so please keep access to your email account safe. If a breach affects your data, we will tell you and the authorities as the law requires.

We are based in the United States and our providers may process data in the US and other countries. Where the law requires it, we rely on safeguards such as the EU Standard Contractual Clauses.

We'll post any update here with a new date and version. If a change is significant, especially about your baby's information, we'll tell account holders by email or in the app before it applies, and ask for consent again where needed.