Privacy Policy

The short version

We collect one thing directly: your email address, and only if you hand it over.

Beyond that, the site uses analytics and advertising cookies — the ordinary machinery that tells us which page brought you here and whether an ad was worth paying for. None of it runs until you say yes. Decline and you get the entire site anyway: every essay, every story, the audio sample, the newsletter. Nothing is withheld and nothing is degraded. We think that's the only version of consent that means anything.

We don't sell your data for money. California law counts advertising cookies as "sharing" even so, and you can switch that off in one click.

If you want out entirely, write to info@getlullable.com and we'll delete what we hold. You don't need a reason and we won't ask for one.

Everything below is the same promise, said carefully, because some of it has to be.

Who we are

Tecnologías Stellar, S.A. de C.V. ("Lullable", "we", "us") is the responsable — the data controller — for the personal data described here.

• Address: Agrarismo 38, Col. Escandón, Ciudad de México, C.P. 11800, México
• Email: info@getlullable.com
• Website: getlullable.com

This policy covers the getlullable.com website, the Lullable newsletter, and the Lullable app. It is written to satisfy Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), the EU and UK GDPR, and the California Consumer Privacy Act as amended. A Spanish-language aviso de privacidad is at the bottom of this page.

What we collect

If you join the waitlist or the newsletter. Your email address, and the date you gave it to us. That's the whole record. It is stored with Buttondown, our newsletter provider. Every email we send has a one-click unsubscribe link that works without contacting anybody.

When you visit the site. Our host, Vercel, keeps standard server logs — IP address, browser and device type, the page requested, the time — for security and to keep the site up. Those logs are necessary to serve you a page at all, so they aren't optional, and we don't read them for marketing.

Fonts. The site loads its typeface from Google Fonts, which means Google receives your IP address when a page loads.

If you accept cookies. Analytics and advertising tools then collect usage and device data — pages viewed, time on page, approximate location from your IP, referring site, device and browser type, and advertising identifiers assigned by the ad platforms. The next section names every one of them.

What we never collect. No health data — we do not ask how you slept, and Lullable is not a sleep tracker. No precise location. No contacts, photos, or microphone access. No sensitive data of any kind as Mexican and European law define it.

In the app. A separate section below describes the app in full, because it collects different things than the website does.

Cookies, and how to refuse them

A banner asks you on your first visit. Until you answer it, nothing in the optional categories loads — no script is fetched, no identifier is set, nothing is sent anywhere. The single exception is the record of your answer itself, which we store on your device so we don't have to ask again; that one is unavoidable and carries no identifier.

Strictly necessary — always on. Your cookie choice, and the security and load-balancing that our host applies to every request. Without these the site cannot be delivered, so there is nothing to consent to.

Analytics — only with your consent. Google Analytics 4, and a cookieless analytics tool that counts visits without storing anything on your device. These tell us which essays people read and where readers arrive from.

Advertising — only with your consent. Meta (Facebook and Instagram), TikTok, and Google Ads measurement tags. These tell an ad platform that a visit or a signup followed one of its ads, and allow it to show Lullable to you again elsewhere.

How to change your mind, at any time:

• Reopen the banner from the link in the site footer and choose again — a refusal takes effect immediately and removes what was set.
• Turn on Global Privacy Control in your browser or extension. We treat a GPC signal as a valid refusal of analytics and advertising cookies, and as a California opt-out of sharing, automatically and without you doing anything else.
• Clear cookies in your browser settings, or block them there entirely.
• Or email info@getlullable.com and we'll handle it.

Refusing costs you nothing. There is no paywall, no nag, no reduced version of the site.

The Lullable app

Signing in. The app uses Sign in with Apple. Apple gives us an identifier for your account and an email address — which is Apple's private relay address if you chose to hide yours, and we're glad when you do. We never see your Apple password, and there is no separate Lullable password for anyone to lose.

What we store on our servers. Your listening progress: which story you were in and how far you got. That is what resumes playback where you drifted off, and what makes "the last fact you heard" possible — it is the entire reason the app exists instead of a podcast feed.

What stays on your device. Downloaded audio and your playback preferences — volume, fade length, timers. Those never reach us.

What the app does not contain. No third-party SDKs of any kind: no analytics SDK, no crash-reporting SDK, no advertising or attribution SDK. Nothing in the app follows you across other apps or websites, which is why you will never see an App Tracking Transparency prompt from us — there is nothing for us to ask permission for. The analytics and advertising cookies described above are on the website only, and never in the app.

Payments. Subscriptions are sold and processed by Apple. We never see your card number and never receive your billing address. Apple tells us whether an account is entitled to premium content, and nothing else.

Health data. None. The app does not read HealthKit, does not track your sleep, and never asks how you slept.

Deleting your account

You can delete your account from inside the app, in its settings. No email, no form, no support conversation, and no waiting for us to approve it.

Deleting removes your account record, the email or relay address attached to it, and your entire listening history from our servers straight away. Copies sitting in encrypted backups are overwritten within 30 days. It cannot be undone.

Two things worth knowing before you tap it:

• Deleting your account does not cancel your subscription. Only Apple can do that — Settings, your name, Subscriptions, on your device. Cancel there first, or you will go on being charged for an account that no longer exists.
• Records we are legally required to keep, such as an invoice Apple issued, survive deletion for as long as Mexican tax law demands and are used for nothing else.

If you'd rather we did it for you, write to info@getlullable.com.

Why we use it, and what's optional

Necessary purposes — without these there is no service to speak of:

• To send you the newsletter and the launch announcement you asked for.
• To keep the site running, fast, and free of abuse.
• To answer you when you write to us.
• To meet legal, tax, and accounting obligations.

Optional purposes — you can refuse these and lose nothing:

• To measure which pages and episodes people actually finish.
• To measure whether our advertising works, and to show Lullable again to people who visited.
• To ask you for feedback, or to invite you to test something early.

Refuse the optional ones through the cookie banner, by unsubscribing, or by writing to info@getlullable.com. Saying no does not affect anything in the first list.

Legal bases (GDPR). Consent for the newsletter, for analytics and advertising cookies, and for the optional purposes — withdrawable at any moment, with no effect on what was lawful before you withdrew. Legitimate interest for site security and basic operation. Legal obligation for records we're required to keep.

Who else touches it

We use a small number of providers, each doing one job, each bound to process data only as agreed:

• Vercel — website hosting and server logs (United States).
• Buttondown — newsletter delivery and subscriber list (United States).
• Google — Fonts on every page; Analytics 4 and Google Ads measurement only with your consent (United States and elsewhere).
• Meta and TikTok — advertising measurement and retargeting, only with your consent (United States and elsewhere).
• Our cookieless analytics provider — aggregate visit counts, with no cookie and no personal identifier.
• Apple — app distribution, Sign in with Apple, and subscription payments.

That is the complete list. We do not sell personal data for money, and we have no interest in doing so. We disclose data to authorities only where a valid legal order requires it.

A word about the advertising platforms. When you consent to advertising cookies, Meta, TikTok, and Google receive data about your visit and use it for their own purposes too, under their own policies, which we don't control. That is the honest trade of running ads at all, and it is exactly what the banner is asking you about.

International transfers. We are a Mexican company and our providers are largely in the United States, so your data is stored and processed outside Mexico and outside the European Economic Area. Transfers rely on your consent and on the standard contractual protections our providers offer. If you'd rather your data not be transferred this way, decline the banner and don't subscribe — and if something is already there, write to us and we'll remove it.

How long we keep it

Your email stays on the list until you unsubscribe or ask us to delete it, and it is removed within 30 days of either. Your app account and listening history are kept while the account exists and are erased the moment you delete it, with backup copies overwritten within 30 days. Server logs roll off within 30 days at our host's default. Analytics data is kept for no more than 14 months. Data held by the advertising platforms follows their own retention periods, which are described in their policies and are typically shorter. Records we're legally required to retain — invoices, tax documents — are kept for the period Mexican law demands and no longer.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, delete it, or stop using it. One email does all of it: info@getlullable.com. We answer within 20 business days, which is the Mexican legal deadline and the tightest one that applies to us. There is no charge, and we never make you create an account to exercise a right.

In Mexico (LFPDPPP). You hold ARCO rights — Acceso, Rectificación, Cancelación, Oposición — plus the right to revoke consent and to limit the use or disclosure of your data; the cookie banner is one of the means we offer for that. To exercise them, email us with your name, a way to reach you, proof of identity, and a clear description of what you want. If you're unhappy with our answer, you may go to the competent Mexican data protection authority.

In the EU or UK (GDPR). Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. You may also complain to your national supervisory authority.

In California (CCPA/CPRA). You have the right to know, delete, and correct, and the right to opt out of the sale or sharing of personal information. To be precise about a word that gets misused: we do not sell personal information for money, but running Meta, TikTok, and Google advertising tags counts as "sharing for cross-context behavioural advertising" under California law. You can opt out of it by declining or withdrawing consent in the cookie banner, or by sending a Global Privacy Control signal, which we honour automatically. We do not knowingly share the personal information of anyone under 16. We will never discriminate against you for exercising a right, and we extend these controls to every visitor regardless of whether California's thresholds apply to us.

Children

Lullable is made for adults and is not directed to children under 13 — or under 16 in the European Economic Area and the United Kingdom. We do not knowingly collect data from them, and we do not target advertising at them. If a child's data reached us, write to info@getlullable.com and we'll delete it promptly. Parents are of course welcome to play a Lullable story to a child; that requires no account and gives us nothing.

Security

Everything travels over HTTPS. Access to the subscriber list is limited to the people who need it, protected by strong authentication. We keep very little ourselves, which is the most reliable security measure available to us. No system is perfect, and if a breach ever affected your data we would tell you and the relevant authority without delay.

A note on health

Lullable is audio, not medicine. It is not a medical device and is not intended to diagnose, treat, cure, or prevent any condition. We do not collect health data of any kind, and we never build advertising audiences around anything health-related. If you're struggling with sleep, please talk to a doctor — see the Terms for the fuller version of this.

Changes to this policy

If we change something that matters — a new tool, a new purpose — we'll update the date at the top of this page, ask for consent again where consent is what makes it lawful, and say so in the newsletter before it takes effect. The current version always lives at getlullable.com/privacy/.

Aviso de Privacidad (México)

Tecnologías Stellar, S.A. de C.V., con domicilio en Agrarismo 38, Col. Escandón, Ciudad de México, C.P. 11800, México, es responsable del tratamiento de sus datos personales conforme a la Ley Federal de Protección de Datos Personales en Posesión de los Particulares.

Datos que tratamos. Su correo electrónico, cuando usted lo proporciona voluntariamente; los datos de navegación que registran nuestros servidores (dirección IP, tipo de navegador y dispositivo, páginas visitadas, fecha y hora); en la aplicación, el identificador y correo electrónico que nos entrega Sign in with Apple —que puede ser una dirección privada de retransmisión— y su avance de escucha; y, únicamente si usted lo autoriza mediante el aviso de cookies en el sitio web, datos de uso e identificadores publicitarios. No tratamos datos personales sensibles, ni datos de salud, ni datos financieros: los pagos los procesa Apple y nunca vemos su tarjeta.

Eliminación de su cuenta. Puede eliminar su cuenta desde la propia aplicación, en sus ajustes; ello borra de inmediato su cuenta, su correo electrónico y todo su historial de escucha. La cancelación de su suscripción se realiza por separado, en los ajustes de suscripciones de Apple.

Finalidades necesarias. Enviarle el boletín y el aviso de lanzamiento que solicitó; operar y proteger el sitio; atender sus mensajes; cumplir obligaciones legales y fiscales.

Finalidades no necesarias. Medir el uso del sitio, medir la efectividad de nuestra publicidad y mostrarle nuestros anuncios nuevamente, y solicitarle retroalimentación o invitarle a probar el producto de forma anticipada. Usted puede negarse a estas finalidades sin que ello afecte el servicio ni el acceso a ningún contenido.

Medios para limitar el uso o divulgación. Rechace las cookies opcionales en el aviso que aparece en su primera visita, o cámbielo después desde el enlace en el pie de página; active la señal Global Privacy Control en su navegador; o escríbanos a info@getlullable.com.

Transferencias. Sus datos se almacenan y procesan en Estados Unidos por nuestros proveedores de hosting, correo, analítica y publicidad (Vercel, Buttondown, Google, Meta, TikTok). Al proporcionarnos su correo electrónico y al aceptar las cookies opcionales usted acepta estas transferencias; si no las acepta, por favor rechace las cookies, no se suscriba, y escríbanos para eliminar cualquier dato existente.

Derechos ARCO y revocación del consentimiento. Usted puede acceder, rectificar, cancelar u oponerse al tratamiento de sus datos, así como revocar su consentimiento, enviando su solicitud a info@getlullable.com con su nombre, medio de contacto, acreditación de identidad y la descripción clara de lo que solicita. Responderemos en un plazo máximo de 20 días hábiles, sin costo alguno.

Cambios al aviso. Cualquier modificación se publicará en getlullable.com/privacy/, con la fecha de actualización al inicio de esta página.