DreamLadder is a parenting operating system for Indian families, available at dreamladder.in. It is operated by Kiran G R as a personal technology project. For all privacy matters, contact: support@dreamladder.in.
Under India's Digital Personal Data Protection Act 2023 (DPDP Act), DreamLadder is the Data Fiduciary — the party that decides what personal data is collected and why. You (the account holder) are the Data Principal.
When you upload a document, we send it to Anthropic's AI API for processing. The AI extracts:
This extracted data is stored on our servers and displayed in your workspace.
Under the DPDP Act 2023 and IT Act 2000 SPDI Rules 2011, we process your data on the basis of your explicit consent given during onboarding. All health-related data is Sensitive Personal Data or Information (SPDI) under the SPDI Rules and receives the highest protection available under Indian law.
By creating a workspace and ticking the consent box, you confirm you have the authority to upload records for yourself and the family members you add (including as a parent or lawful guardian for any minor children in the workspace), and that you consent to DreamLadder processing this data for the purposes described in this policy.
| Purpose | Data used |
|---|---|
| Display your family's records in your workspace | Extracted metrics, findings, profiles |
| Answer parenting questions via Ask DreamLadder chat | Extracted metrics and findings for the queried member |
| Generate immunisation schedules, growth alerts, and antenatal reminders | Date of birth (or estimated due date), immunisation history, growth measurements |
| Send in-app and push reminders | Reminder text, notification tokens |
| Attribute uploaded documents to the right family member | Name on document, age, sex, family member profiles |
| Maintain your session and keep you logged in | Google account email, session token |
| Detect and fix processing errors | Server logs (no health values) |
We do not use your data for advertising, profiling for commercial purposes, research, or any purpose not listed above.
We share data only with the following processors, solely to provide the service:
| Processor | Role | What they receive | Their privacy terms |
|---|---|---|---|
| Anthropic, PBC | AI document extraction | The document you upload (image or PDF bytes) is sent to Anthropic's API for text and data extraction. No extracted data is sent back to Anthropic beyond the API response. | anthropic.com/privacy |
| Google LLC | Authentication (OAuth) and file storage (Drive) | Your Google identity is used to sign in. Uploaded documents are stored in a dedicated "DreamLadder" folder in your own Google Drive — DreamLadder can only access files it created (drive.file scope). | policies.google.com/privacy |
| Fly.io, Inc. | Server hosting | Our application server and database run on Fly.io infrastructure in the Singapore (sin) region. Fly.io does not access your data. | fly.io/legal/privacy-policy |
We do not sell, rent, or disclose your data to any other third party. We do not use data brokers or advertising networks.
Note on data location: DreamLadder is hosted in Singapore (Fly.io's `sin` region). Under the DPDP Act 2023, cross-border transfer of personal data is permitted except to countries specifically restricted by the Government of India (no such restrictions currently apply to Singapore). We will update our practices if the Government of India issues specific localisation requirements for health data under the DPDP Rules.
Note on backup: Automated database backups are in place using Litestream continuous replication to Tigris S3 storage. Your original documents are also safe in Google Drive independently of DreamLadder's servers.
| Data type | Retention period |
|---|---|
| Records and extracted data for an active member | Retained while your account is active |
| Data for a deleted family member | Deleted within 30 days of member deletion |
| All data on account closure | Deleted within 30 days of account closure request |
| Server access logs | 30 days, then automatically purged |
| Audit events (no health data) | 12 months |
DreamLadder is a parenting product — children's records are the primary use case. When you add a child to your workspace (any minor under 18), you are required to confirm that you are their parent or lawful guardian and that you consent to DreamLadder processing their records on their behalf.
We do not knowingly allow minors to create their own DreamLadder accounts. We do not track minors' behaviour, serve them advertising, or use their data for any purpose beyond organising their records for their parent or guardian's reference. When a minor in the system turns 18, we will prompt the account admin to invite them to manage their own records.
This is consistent with the DPDP Act 2023 Section 9, which requires verifiable parental consent for the processing of personal data of children and prohibits behavioural monitoring of minors.
Under the DPDP Act 2023 and SPDI Rules 2011, you have the following rights:
| Right | How to exercise it |
|---|---|
| Access — view the data we hold about you | Your workspace shows all extracted data. Email support for a full data export. |
| Correction — fix inaccurate data | Edit member profiles via the web workspace. For extracted metric corrections, contact support. |
| Erasure — delete your data | Delete individual members from the workspace (data erased within 30 days). To close your account and delete all data, email support. |
| Withdrawal of consent — stop processing | Email support. We will close your account and delete all data within 30 days. |
| Grievance — complain about how we handle your data | Contact our Grievance Officer (details below). We will respond within 30 days. |
As required under the IT Act 2000 SPDI Rules 2011 (Rule 5(9)) and the DPDP Act 2023 (Section 13), we have designated a Grievance Officer to receive and resolve complaints about our data practices.
DreamLadder uses Anthropic's Claude AI to extract structured data from uploaded documents. This means the content of your uploaded document is sent to Anthropic's servers for processing.
Anthropic's API Terms of Service state that data submitted via the API is not used to train their models by default. We have reviewed Anthropic's data processing terms and rely on them as our Data Processor. You can review Anthropic's privacy policy at anthropic.com/privacy.
Note: Document processing by Anthropic occurs on servers outside India. We have assessed this as consistent with the DPDP Act's cross-border transfer provisions for processor relationships.
DreamLadder uses a single session authentication cookie to keep you signed in. This cookie is HttpOnly, Secure, and expires after 30 days. We do not use advertising cookies, analytics tracking, or third-party tracking scripts of any kind.
We will update this policy when our data practices change in a material way. We will notify you of significant changes by showing a notice in the app and, where possible, via email. The version number and effective date at the top of this page will be updated with each change. Continued use of DreamLadder after a policy update constitutes acceptance of the updated terms.
This policy is governed by the laws of India, including the Information Technology Act 2000, the IT (Reasonable Security Practices and Procedures and SPDI) Rules 2011, and the Digital Personal Data Protection Act 2023.