Protecting your personal data and that of your child is important to us. In this privacy policy, we inform you about which personal data we process in the Paul & Lori app, why we do so, and what rights you have.
The entity responsible for data processing in this app is:
Paul & Lori GmbH
Bussardstr. 16, 71032 Böblingen, Germany
hallo@paulandlori.com
Data Protection Officer: Max Buchwald
This privacy policy applies to the Paul & Lori mobile app as well as the associated online services at app.paulandlori.app.
Paul & Lori is intended for parents and other adult legal guardians. The app is not designed for children to create their own accounts or enter personal information.
Depending on how you use the app, we process the following data:
When you create an account or log in, we process in particular:
Your password is not stored in plain text. Authentication is performed via a secure login service.
To display age-appropriate content, you may voluntarily provide information about your child, in particular:
This information is used to show you relevant milestones, play ideas, audio contributions, and content. We do not use this data for third-party advertising.
Please avoid using your child's full name if it is not necessary for your use of the app.
When you use the community features, we process the content you voluntarily publish, in particular:
Community posts may be visible to other registered users. Please do not publish sensitive personal data, health information, addresses, full names of children, or images for which you do not hold the rights in the community.
You can delete your own content within the scope of the available functions. Content may also be reported and moderated if it violates our community guidelines.
When you use the friend feature, we process:
Friend requests are account-based and work regardless of whether the individuals involved use iOS or Android.
If you save photos in the app or use them for a photo album, we process the image files you upload as well as the associated information, insofar as this is technically necessary.
Photos are processed only for the function you have chosen. Please upload only photos for which you are authorized to use and share.
If you enable push notifications, we process a technical device token to be able to send you notifications. This may include, for example, reminders about new topics, daily play ideas, or development-related reminders.
You can disable push notifications at any time in the app settings or in your device's system settings.
To provide, secure, and troubleshoot the app, we may process technically necessary data, in particular:
We use this data primarily to improve the stability, security, and usability of the app.
We process your data only as permitted by law. Processing is carried out on the following bases:
Performance of a contract, Art. 6(1)(b) GDPR:
for the provision of your account, personalized content, friend and community features, and a booked PLUS access.
Consent, Art. 6(1)(a) GDPR:
especially for enabled push notifications or where consent is required for individual optional features.
Legitimate interests, Art. 6(1)(f) GDPR:
to ensure technical security, prevent misuse, analyze errors, and improve the app.
Legal obligation, Art. 6(1)(c) GDPR:
to the extent that we must store or disclose data based on legal requirements.
If you purchase a paid PLUS subscription within the app, payment processing is handled by the respective app store provider, particularly the Apple App Store or Google Play Store.
We generally do not receive full payment details such as credit card numbers. We only process the information required to provide your subscription status and access rights within the app, such as purchase status, product identifier, and duration.
A specialized service provider may be used for subscription management. This provider processes the necessary technical purchase and device information solely for the purpose of managing your access authorization.
We use technical service providers to support us in operating the app. These providers process personal data only on our behalf and based on appropriate contractual agreements.
These may include, in particular:
Disclosure to other third parties occurs only if legally permitted, if you have consented, or if there is a legal obligation.
Insofar as service providers process data outside the European Union or the European Economic Area, we ensure an adequate level of data protection. This can be achieved, in particular, by an adequacy decision of the European Commission or by concluding standard contractual clauses.
We store personal data only as long as necessary for the respective purposes or as required by legal retention obligations.
You can request the deletion of your account in the app via the "Delete Account" function.
Following deletion, we will remove your personal data, provided there are no legal retention obligations or overriding legitimate interests. Content published in the community will be removed or anonymized according to the available deletion function, to the extent technically and legally possible.
We take technical and organizational measures to protect your data against loss, misuse, unauthorized access, alteration, and disclosure.
This includes, in particular, access restrictions, encrypted data transmissions, secure authentication procedures, and technical security measures for stored data.
Please note that no data transmission over the Internet and no electronic storage can be completely secure.
You have the following rights, subject to legal requirements:
For Germany, this is the data protection supervisory authority of your federal state. You can also contact the supervisory authority at your place of residence or at the registered office of our company.
To exercise your rights, please contact us at:
hallo@paulandlori.com
We may update this privacy policy if legal requirements change, or if our app or the features we offer change. The current version will be published in the app and on our website.
Data protection is very important to us! The protection of your personal data is taken very seriously when using www.paulandlori.com. To ensure full compliance with current regulations, we have sought external assistance. All personal data of our customers is processed in accordance with current data protection regulations and, unless users have subscribed to the newsletter, is used exclusively for the purpose of order processing. Of course, we comply with the statutory provisions of the Federal Data Protection Act (BDSG), the Telemedia Act (TMG), and other data protection regulations (GDPR).
Name and address of the controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection provisions, is:
Paul & Lori GmbH
Bussardstr. 16, 71032 Böblingen
Germany
Email: hallo@paulandlori.com
Tel: +49 0711 – 121 905 89
VAT ID: DE346946947
Name and address of the Data Protection Officer
The controller's data protection officer is:
Paul & Lori GmbH, Max Buchwald, Bussardstr. 16, 71032 Böblingen, Germany
Email: hallo@paulundlori.de
Tel: +49 (0) 17684326983
General information on data processing
– We process personal data of our users only as far as necessary to provide a functional website as well as our content and services. The processing of our users' personal data regularly takes place only after the user's consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by statutory regulations.
– Personal data is only disclosed to third parties if our users have given their express consent pursuant to Art. 6(1) sentence 1(a) GDPR; if the disclosure is necessary for the performance of contractual obligations pursuant to Art. 6(1) sentence 1(b) GDPR; if we are legally obligated to disclose the data within the meaning of Art. 6(1) sentence 1(c) GDPR; if the disclosure is in the public interest within the meaning of Art. 6(1)(e) GDPR; or if the disclosure is necessary to safeguard our legitimate interests or the legitimate interests of a third party pursuant to Art. 6(1) sentence 1(f) GDPR, provided that the interests of our users in the protection of their own data do not prevail.
– Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6(1)(a) EU General Data Protection Regulation (GDPR) serves as the legal basis. For the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required for the performance of pre-contractual measures. Insofar as processing of personal data is required to fulfill a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis. If the processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and freedoms of the data subject do not outweigh the former interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
– The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also occur if provided for by the European or national legislator in Union regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the mentioned standards expires, unless there is a necessity for further storage of the data for the conclusion or performance of a contract.
Provision of the website and creation of log files
– Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer. The following data is collected:
The data is also stored in the log files of our system. A storage of this data together with other personal data of the user does not take place. Legal basis for data processing: The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR.
– The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this, the user's IP address must remain stored for the duration of the session. Storage in log files is done to ensure the functionality of the website. In addition, the data serves us to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. Our legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR also lies in these purposes.
– The data is deleted as soon as it is no longer required for the purpose of its collection. In the case of data collection for the provision of the website, this occurs when the respective session has ended. In the case of storing data in log files, this occurs after a maximum of seven days. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or masked, so that an assignment of the calling client is no longer possible.
– The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Consequently, there is no possibility of objection on the part of the user. SSL encryption To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g., SSL) via HTTPS.
– When users leave comments or reviews on our website, the time of their creation and the username previously chosen by the website visitor are stored in addition to these details. This is for our security, as we can be held liable for illegal content on our website, even if it was created by users.
– This website uses Google Analytics, a web analytics service provided by Google Inc. (hereinafter: Google). Google Analytics uses so-called "cookies," which are text files stored on your computer that allow an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. Due to the activation of IP anonymization on these websites, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser within the scope of Google Analytics will not be merged with other data by Google. The purposes of data processing lie in the evaluation of the use of the website and the compilation of reports on website activities. Based on the use of the website and the internet, other related services are then to be provided. The processing is based on the legitimate interest of the website operator. You can prevent the storage of cookies by adjusting your browser software accordingly; however, we point out that in this case, you may not be able to use all functions of this website to their full extent. Furthermore, you can prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google as well as the processing of this data by Google by downloading and installing the browser plugin available at the following link: Browser add-on for deactivating Google Analytics. In addition to or as an alternative to the browser add-on, you can prevent tracking by Google Analytics on our pages by clicking this link. This will install an opt-out cookie on your device. This will prevent collection by Google Analytics for this website and for this browser in the future as long as the cookie remains installed in your browser.
– In order to display our content correctly and graphically appealingly across browsers, we may use script libraries and font libraries such as Google Webfonts on this website. Google Webfonts are transferred to your browser's cache to avoid multiple loading. If the browser does not support Google Webfonts or prevents access, content is displayed in a standard font. Calling up script libraries or font libraries automatically triggers a connection to the operator of the library. It is theoretically possible – though currently unclear whether and for what purposes – that the operators of such libraries collect data. You can find the privacy policy of the library operator Google here. Use of Google Maps This website uses the Google Maps API to visually display geographic information. When using Google Maps, Google also collects, processes, and uses data about the use of map functions by visitors. For more information about data processing by Google, please refer to the Google Privacy Policy. You can also change your personal privacy settings in the Privacy Center there. Detailed instructions on managing your own data in connection with Google products can be found here: Embedded YouTube videos We embed YouTube videos on some of our web pages. The operator of the corresponding plugins is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit a page with the YouTube plugin, a connection to YouTube servers is established. This informs YouTube about which pages you are visiting. If you are logged into your YouTube account, YouTube can associate your browsing behavior directly with you. You can prevent this by logging out of your YouTube account beforehand. When a YouTube video is started, the provider uses cookies that collect information about user behavior. If you have deactivated the saving of cookies for the Google Ad program, you will not have to expect any such cookies even when watching YouTube videos. However, YouTube also stores non-personal usage information in other cookies. If you wish to prevent this, you must block the storage of cookies in your browser. Further information on data protection at "YouTube" can be found in the provider's privacy policy here. Google AdWords Our website uses Google Conversion Tracking. If you arrived at our website via an ad placed by Google, Google AdWords will set a cookie on your computer. The cookie for conversion tracking is set when a user clicks on an ad placed by Google. These cookies expire after 30 days and are not used for personal identification. If the user visits certain pages of our website and the cookie has not yet expired, we and Google can recognize that the user clicked on the ad and was redirected to this page. Each Google AdWords customer receives a different cookie. Cookies can therefore not be tracked across the websites of AdWords customers. The information obtained using the conversion cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. The customers find out the total number of users who clicked on their ad and were redirected to a page provided with a conversion tracking tag. However, they do not receive information that can personally identify users. If you do not wish to participate in tracking, you can refuse the necessary setting of a cookie – for example, via a browser setting that generally deactivates the automatic setting of cookies or by setting your browser to block cookies from the domain "googleleadservices.com". Please note that you must not delete the opt-out cookies as long as you do not wish for measurement data to be recorded. If you have deleted all your cookies in your browser, you must set the respective opt-out cookie again. Use of Google Remarketing This website uses the remarketing function of Google Inc. The function serves to present interest-based advertisements to website visitors within the Google advertising network. A so-called "cookie" is stored in the website visitor's browser, which makes it possible to recognize the visitor when they visit websites that belong to Google's advertising network. On these pages, the visitor can be presented with advertisements that relate to content that the visitor has previously accessed on websites using Google's remarketing function. According to its own information, Google does not collect any personal data during this process. If you still do not wish for the Google remarketing function, you can generally deactivate it by making the appropriate settings here. Alternatively, you can deactivate the use of cookies for interest-based advertising via the Network Advertising Initiative by following the instructions at Networkadvertising.
Use of Cookies
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. If a user calls up a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string of characters that enables a unique identification of the browser when the website is called up again.
We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.
The following data is stored and transmitted in the cookies:
Furthermore, we use cookies on our website that allow an analysis of the users' browsing behavior.
In this way, the following data can be transmitted:
The legal basis for the processing of personal data using cookies is Art. 6 (1) lit. f GDPR.
The purpose of using technically necessary cookies is to simplify the use of websites for the users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.
We require cookies for the following applications:
The user data collected through technically necessary cookies is not used to create user profiles.
The use of analysis cookies is for the purpose of improving the quality of our website and its content. Through analysis cookies, we learn how the website is used and can thus constantly optimize our offer.
These purposes also constitute our legitimate interest in the processing of personal data according to Art. 6 (1) lit. f GDPR.
Cookies are stored on the user's computer and transmitted by them to our site. Therefore, as a user, you also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.
Rights of the data subject
If personal data relating to you is processed, you are a data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis the controller: Right of access You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you may request information from the controller regarding the following: (1) the purposes for which the personal data is being processed; (2) the categories of personal data being processed; (3) the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed; (4) the planned duration of the storage of the personal data concerning you or, if specific information is not possible, criteria for determining the storage period; (5) the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing; (6) the existence of a right to lodge a complaint with a supervisory authority; (7) any available information as to the source of the data if the personal data is not collected from the data subject; (8) the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. You have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer. This right of access may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of research or statistical purposes and the restriction is necessary for the fulfillment of the research or statistical purposes. Right to rectification You have a right to rectification and/or completion vis-à-vis the controller if the personal data processed concerning you is inaccurate or incomplete. The controller shall perform the rectification without undue delay. Your right to rectification may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of research or statistical purposes and the restriction is necessary for the fulfillment of the research or statistical purposes. Right to restriction of processing Under the following conditions, you may request the restriction of the processing of personal data concerning you: (1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data; (2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead; (3) the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims, or (4) if you have objected to the processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds. Where the processing of personal data concerning you has been restricted, such data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been restricted according to the aforementioned requirements, you will be informed by the controller before the restriction is lifted. Your right to restriction of processing may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of research or statistical purposes and the restriction is necessary for the fulfillment of the research or statistical purposes. 4. Right to erasure a) Obligation to erase You may request the controller to erase personal data concerning you without undue delay, and the controller is obliged to erase this data without undue delay if one of the following grounds applies: (1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed. (2) You withdraw your consent on which the processing is based according to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing. (3) You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR. (4) The personal data concerning you has been unlawfully processed. (5) The erasure of the personal data concerning you is necessary for compliance with a legal obligation in Union or Member State law to which the controller is subject. (6) The personal data concerning you has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR. b) Information to third parties If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17(1) GDPR, the controller, taking into account available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure of any links to, or copy or replication of, those personal data. c) Exceptions The right to erasure does not exist to the extent that processing is necessary (1) for exercising the right of freedom of expression and information; (2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (3) for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR; (4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right mentioned under section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or (5) for the establishment, exercise, or defense of legal claims. Right to be informed If you have asserted the right to rectification, erasure, or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification or erasure of data or restriction of processing to each recipient to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients. Right to data portability You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format. Furthermore, you have the right to transmit those data to another controller without hindrance from the controller to which the personal data has been provided, provided that (1) the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and (2) the processing is carried out by automated means. In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another controller, where technically feasible. The freedoms and rights of other persons must not be adversely affected by this. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Right to object You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes. You have the option, in the context of the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by automated means using technical specifications. You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you for scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR. Your right to object may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the research or statistical purposes and the restriction is necessary for the fulfillment of the research or statistical purposes. Right to withdraw the declaration of consent under data protection law You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Automated individual decision-making, including profiling You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision (1) is necessary for entering into, or the performance of, a contract between you and the controller, (2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or (3) is based on your explicit consent. However, these decisions shall not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place. In the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision. Right to lodge a complaint with a supervisory authority Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
Up-to-dateness
This privacy policy is dated July 2025. It is the current and valid version of our privacy policy. However, we would like to point out that from time to time, due to factual or legal changes, a revision of this privacy policy may become necessary.
© 2026 Paul & Lori GmbH: Play starts here ❤️️
