01. Introduction
Fred (“Fred”, “we”, “us”) is a family coordination assistant that helps parents stay organised over WhatsApp. We also run the website fred.family. This policy explains what we collect, why we collect it, who we share it with, and your choices.
Data controller:
Product Impact Consulting BV
Terschellingstraat 33, 1025 RA Amsterdam
KVK: 90557840
Contact: mail@fred.family
02. What We Collect
We collect only what you actively share with Fred. We do not scrape, buy, or infer data about you from third-party sources.
Account information
When you sign up via fred.family, we collect the following for both parents in the household:
- Name and email address: to create and manage your account.
- Date of birth: to verify that you are 18 or older. Fred is a service for adults only.
- Home address: to provide location-based features such as finding locally provided services such as waste collection dates.
- Children’s names and dates of birth:provided by you during onboarding to personalise Fred’s coordination features. You confirm that you are the legal parent or guardian of each child whose information you provide.
Information about the other parent
When the first parent sets up Fred, they provide the name and email address of the second parent so we can send an invitation. We use this only to send the invitation and set up the shared household account. The invitation email links to this policy and explains what information has been provided. The second parent’s account only becomes active once they have accepted the Terms of Service.
Shared visibility within your household
Fred is a shared household tool. Calendar entries, messages sent to Fred in the shared group, and coordination information are visible to both parents in the household. Do not share information with Fred that you do not want the other parent to see.
Messages and content
Fred receives and processes:
- Chat messages you send to Fred via WhatsApp (text, images and voice).
- Voice messages, which are transcribed; the audio file is not retained after transcription.
- Images you share with Fred via WhatsApp, which are processed to extract relevant information. Images are not stored after processing.
- Emails you forward to your personal Fred email address (body, sender, subject line, and attachments relevant to family scheduling).
Calendar data
If you delegate your Google Calendar to Fred, we receive read access via calendar sharing; Fred schedules by creating events in its own calendar and inviting you.
Children’s information
You provide your children’s names and dates of birth during onboarding. In the course of using Fred, you may share additional information about your children — such as school name and extracurricular activities — via forwarded emails, calendar entries, or direct messages to Fred. We do not collect any of this information from children directly.
Usage data
We collect basic technical data about how Fred is used — such as message timestamps, feature interactions, and error reports — to keep the service running and improve it. This data is not used for advertising or profiling.
03. How and Why We Use Your Data
We use your data only to run Fred for you. The table below sets out each purpose and its legal basis under GDPR Article 6.
| Purpose | What we use | Legal basis |
|---|---|---|
| Create and manage your account | Name, email address | Contract (Art. 6(1)(b)) |
| Verify you are 18 or older | Date of birth | Legal obligation / legitimate interest (Art. 6(1)(c) / (f)) |
| Provide location-based features | Home address | Contract (Art. 6(1)(b)) |
| Understand your messages and reply | Chat messages, forwarded emails, calendar data | Contract (Art. 6(1)(b)) |
| Manage your calendar invites, reminders, and briefings | Calendar data, children’s information, message content | Contract (Art. 6(1)(b)) |
| Keep the service secure and monitor errors | Usage data, error logs | Legitimate interest (Art. 6(1)(f)) |
| Review AI response quality internally | Anonymised or pseudonymised logs | Legitimate interest (Art. 6(1)(f)) |
| Meet legal and accounting obligations | Billing records, account data | Legal obligation (Art. 6(1)(c)) |
| Deliver coordination features involving your children | Children’s names, dates of birth, and information you share about them | Contract with you as parents (Art. 6(1)(b)) — this data is always provided by parents, never collected from children |
| Send you product updates and onboarding emails | Name, email address | Consent (Art. 6(1)(a)) — you can unsubscribe at any time |
We do not use your data for advertising, to build profiles for third parties, or to train AI models.
04. Artificial Intelligence and Google Data
How Fred uses AI
Fred’s replies are generated by Anthropic’s Claude models, which we run through Amazon Web Services (AWS Bedrock) on infrastructure located in the EU. Your data is processed by AWS as our processor and is not sent to Anthropic. Your data does not leave the European Union for AI processing, and it is never used to train AI models. A Data Processing Agreement with AWS is in place.
Voice transcription
Voice messages you send to Fred are transcribed on our own EU servers using a self-hosted transcription model. The original audio file is deleted immediately after transcription.
Image processing
Images you forward to Fred are processed by Anthropic’s Claude API via Amazon Web Services (AWS) infrastructure located in the EU to extract relevant text and information. Images are not stored after processing.
Google Calendar
Fred works with your calendar through Google Calendar’s built-in sharing feature — you never connect your Google account to Fred or grant Fred any permissions on it. You share your calendar with your household’s Fred address with read access. Fred uses this only to check availability and detect scheduling conflicts.
Fred never creates, edits, or deletes anything in your own calendar. When Fred schedules something, it creates the event in a calendar owned by Fred and invites you — the event only appears in your calendar through Google’s normal invitation mechanism, and you can decline it like any other invite.
Fred never accesses your Gmail or any other part of your Google account. Emails you forward to your Fred address are received in a dedicated mailbox that is part of Fred’s own infrastructure — not yours.
We apply the following commitments to your calendar data:
- We access it only to perform the features you request — checking availability and detecting conflicts.
- We do not use it for advertising or to build user profiles.
- We do not allow humans to read it except where strictly necessary for security investigations or legal compliance.
- You can revoke Fred’s access at any time by removing the Fred address from your calendar’s sharing settings (Google Calendar → Settings → Share with specific people).
Storage of Google data:Emails you forward to your Fred address are received and stored in a dedicated Gmail account. Events created by Fred are stored in a Google Calendar. Both are part of Fred’s infrastructure and are subject to the retention periods in Section 06.
05. Who We Share Data With
We do not sell your personal data. We share it only with the processors listed below, and only so they can perform a specific service on our behalf. Each processor is bound by a Data Processing Agreement.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Website hosting | EU |
| Logto | Accounts, sign-in and onboarding | EU |
| Google (Calendar & Gmail) | Calendar and email integration | EU |
| Tally | Anonymous waitlist questionnaire | EU |
| AWS | Hosts Fred, its database and runs the Claude AI models | EU |
| Sentry | Error monitoring | EU |
| Brevo & SES (AWS) | Transactional and notification emails | EU |
| Langfuse (self-hosted) | Internal AI quality logs | EU |
WhatsApp itself is operated by Meta Platforms, which acts as an independent data controller for the transport of your messages — not as our processor. Your use of WhatsApp is governed by WhatsApp’s own privacy policy.
We may also disclose data where legally required by a court order or regulatory authority, or in connection with a business sale or merger — in which case we will notify you in advance.
06. Storage, Transfers, and Retention
Where your data lives
Fred stores your family’s data on AWS servers located in the EU. We carefully select processors that also store data within the EU whenever possible. Where a processor operates outside the EU — such as Meta/WhatsApp — transfers rely on Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework.
How long we keep it
We retain your personal data for as long as your account is active. When you delete your account, we delete all associated personal data within 30 days and send you written confirmation. Billing and legal records are retained for 7 years as required by Dutch law; this data is not used for any other purpose.
Voice audio and images are deleted immediately after processing and are never stored.
Logs and technical data
Usage data, error reports (Sentry), and internal AI-quality logs (Langfuse) are retained for a maximum of 12 months, after which they are deleted or fully anonymised. Pseudonymised logs are treated as personal data until anonymised.
Email attachments
Emails you forward to Fred, including attachments, are retained under the same retention rules as your other account data. Note this differs from images sent via WhatsApp, which are processed and immediately deleted.
Deleting your data
To delete your data, email mail@fred.family. We will erase your personal data within 30 days and send you written confirmation. Backups are fully purged within 90 days. We retain billing records for 7 years as required by law; this data is not used for any other purpose.
07. Security
We take the security of your family’s data seriously. Our approach is built around EU data residency, closed-by-default infrastructure, and strict isolation between households.
- Encryption of all data in transit (TLS) and at rest.
- Household isolation. Personal data is stored and accessed on a strictly per-household basis. Technical controls at the data storage layer ensure that no household can access the personal data of another household.
- Restricted infrastructure access.Fred’s servers are not directly accessible from the public internet. All external access is routed through a secure, authenticated network tunnel, limiting the attack surface and reducing the risk of unauthorised access.
- Strict internal access controls: only authorised team members with a legitimate need can access personal data.
- Error monitoring via Sentry to detect and respond to issues quickly.
No system is 100% secure. If we become aware of a security incident affecting your personal data, we will notify you and the relevant supervisory authority as required by law, without undue delay.
08. Your Rights
As a resident of the EU, you have the following rights in relation to your personal data. To exercise any of them, contact mail@fred.family. We will respond within 30 days. For complex requests we may extend this by up to two further months; if so, we will tell you within the first month and explain why.
- Access: request a copy of the personal data Fred holds about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Erasure: ask us to delete your personal data (see Section 06).
- Restriction: ask us to pause processing of your data in certain circumstances.
- Portability: receive your data in a structured, machine-readable format.
- Object: object to processing based on legitimate interest, including for direct marketing.
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
If you believe Fred has not handled your data correctly, you have the right to lodge a complaint with the Dutch data protection authority:
Autoriteit Persoonsgegevens (AP)
www.autoriteitpersoonsgegevens.nl
Tel: +31 (0)70 888 85 00
09. Children
Fred is for parents and guardians. Children do not use Fred directly and should not interact with it.
When you share information about your children — their name, school, birthday, or activities — you confirm that you are their legal parent or guardian and that you are entitled to share that information with us. We use it solely to deliver the coordination service and apply the same protections as to all personal data in Fred.
We do not knowingly collect personal data directly from children. If you believe a child has shared data with Fred without parental authorisation, please contact mail@fred.family immediately and we will delete it.
10. Changes to This Policy
We may update this policy from time to time. When we do, we will update the date at the top of this page. For material changes, we will notify you by email before the change takes effect.
Questions?
We’re parents too. Email mail@fred.family and a real person will reply.
Product Impact Consulting BV · Terschellingstraat 33, 1025 RA Amsterdam · KVK 90557840