Privacy policy

Elderflower is a scheduled text-message reminder service, operated by [LEGAL ENTITY NAME], a company registered in Croatia ([REGISTRATION NUMBER], [REGISTERED ADDRESS]). Questions about anything on this page go to support@elderflower.app and a human answers them.

This policy covers our website, the subscriber account, and the SMS program “Elderflower Reminders”.

• Your name and email address, and the account identifier created when you sign in.
• Your billing details — handled by our payment provider. We never see or store your full card number.
• The date, time and IP address recorded when you confirm that your parent has personally agreed to receive these texts. This is the evidence that the consent was real.
• Basic usage events on our own site and dashboard (pages viewed, actions taken), stored by us rather than sold to an analytics network.

• The name you enter for them, and the name you choose for the contact card their phone saves.
• Their mobile number and their time zone — the two things required to send a text at the right local moment.
• The reminder text you wrote, the times of day, and the days of the week it should go out.
• For each message: when it was scheduled, when it was sent, the provider’s message identifier, and the delivery status reported back by their mobile carrier.
• Any message they text to our number, and when it arrived. In practice this is YES, STOP, START or HELP. If they text anything else, we log it and send one warm, automatic acknowledgement — nobody is alerted, and no software reads it for meaning.
• The timestamp and message identifier of their YES, and of any STOP. These are the consent records, and they are how we prove the permission was your parent’s own.

A reminder service does not need medical information, so we refuse to hold any. We ask you to keep reminders generic — “your morning vitamins”, not a diagnosis or a drug name — and we never store a medical record of any kind.

We also collect no location data, no contacts, no call logs, no audio, and nothing from any camera or sensor. There is no app on their phone, so there is nothing on their phone for us to read.

• To send the reminders you set up, at the times you chose (performing the contract you bought).
• To show you whether each message was delivered to their handset, and to warn you if several in a row were not.
• To honour STOP, START and HELP immediately, which mobile carriers require of every recurring text program.
• To keep proof of consent, which telephone consumer protection law requires us to be able to produce.
• To take payment, to answer your emails, and to keep the service secure and working.

Only the companies that make the service run, and only the data they need to do their part: our SMS provider (which must have their number to deliver a message to their carrier), our hosting and database provider, our authentication provider, and our payment provider. Each is bound to use the data only to provide their service to us.

We may also disclose information if the law genuinely requires it — a valid legal request, or to protect someone’s safety.

• Account and reminder data: while your subscription is active, and for up to 90 days after you cancel, so you can come back without setting everything up again.
• Message and delivery logs: up to 24 months, then deleted.
• Consent records — your confirmation, their YES, and any STOP: kept for at least four years after the program ends for that number, because we may have to prove their permission existed. These survive cancellation and deletion requests; it is the one exception, and it exists to protect them.

They can stop everything themselves, at any time, by replying STOP to any message. They do not need your permission, an account, or a reason.

Either of you may ask us to access, correct, export or delete the personal data we hold — including their number — by emailing support@elderflower.app. We will act within 30 days, and we will keep only the consent records described above. Depending on where you live, you may also have the right to complain to a data protection authority.

Data is encrypted in transit and at rest with our infrastructure providers, and access is limited to the people who need it to run the service. Because we operate from Europe and send messages to phones in North America, information may be processed in both the European Union and the United States.

Elderflower is for adults. We do not knowingly collect information about anyone under 18, and the service must not be used to text a minor.

If we change how we handle information, we will update this page and the date at the top, and we will email subscribers before anything material takes effect. We will not quietly start selling data we promised not to sell.