Privacy Policy
The Infant Sleep Lab
Last updated: 15 September 2026
1. Who is responsible for your data
The controller of your personal data is:
Stark Network GmbH, trading as The Infant Sleep Lab Schaarsteinweg 22 20459 Hamburg, Germany
Commercial register: Amtsgericht Hamburg, HRB 189428 Managing Director: Thore Brügmann VAT ID: DE319919428 Email: support@infantsleeplab.com
We are based in Germany, so the EU General Data Protection Regulation (GDPR) applies to how we handle your data — wherever in the world you are.
2. What we collect
When you buy something Your name, email address, the products you bought, the amount paid, and the time of purchase.
Payment details Your card details go directly to Stripe and are processed by them. We never receive or store your full card number. We see only the last four digits, the card type, and whether the payment succeeded.
When you visit the site Your IP address, browser and device type, the pages you view, the site or ad that sent you, and how you move through the funnel. Where you arrive from an advertisement, this includes the campaign identifiers in the link.
When you contact us Whatever you write to us, and your email address, so we can reply.
We do not ask for and do not want your baby's health information. Please don't send it to us.
3. Why we use it, and on what legal basis
| What we do | Why | Legal basis (GDPR) |
|---|---|---|
| Take payment and deliver your product | To perform the contract you entered into | Art. 6(1)(b) |
| Send order confirmation and delivery emails | To perform the contract | Art. 6(1)(b) |
| Answer your support emails and handle refunds | To perform the contract | Art. 6(1)(b) |
| Keep records of sales | German commercial and tax law requires it | Art. 6(1)(c) |
| Send you further emails about sleep and our products | Your consent, or our legitimate interest in contacting existing customers about similar products | Art. 6(1)(a) or (f) |
| Measure our advertising and improve the site | Our legitimate interest in running a viable business, or your consent where required | Art. 6(1)(f) or (a) |
| Prevent fraud and abuse of our payment system | Our legitimate interest, and Stripe's | Art. 6(1)(f) |
- What we do
- Take payment and deliver your product
- Why
- To perform the contract you entered into
- Legal basis (GDPR)
- Art. 6(1)(b)
- What we do
- Send order confirmation and delivery emails
- Why
- To perform the contract
- Legal basis (GDPR)
- Art. 6(1)(b)
- What we do
- Answer your support emails and handle refunds
- Why
- To perform the contract
- Legal basis (GDPR)
- Art. 6(1)(b)
- What we do
- Keep records of sales
- Why
- German commercial and tax law requires it
- Legal basis (GDPR)
- Art. 6(1)(c)
- What we do
- Send you further emails about sleep and our products
- Why
- Your consent, or our legitimate interest in contacting existing customers about similar products
- Legal basis (GDPR)
- Art. 6(1)(a) or (f)
- What we do
- Measure our advertising and improve the site
- Why
- Our legitimate interest in running a viable business, or your consent where required
- Legal basis (GDPR)
- Art. 6(1)(f) or (a)
- What we do
- Prevent fraud and abuse of our payment system
- Why
- Our legitimate interest, and Stripe's
- Legal basis (GDPR)
- Art. 6(1)(f)
4. Advertising and measurement
We advertise on Meta platforms (Facebook and Instagram) and we measure which of those adverts lead to sales. We do this in two ways:
In your browser — the Meta Pixel, a small piece of code that records page views and purchases and stores identifiers in cookies (_fbp, _fbc).
From our server — when a purchase completes, we send Meta a record of it through their Conversions API. This includes your email address in hashed form (an irreversible one-way transformation, not readable as an email address), your IP address, your browser type, and the value of the purchase.
We do this so we know which adverts actually work rather than guessing. Meta acts as an independent controller for this data; their handling of it is described at https://www.facebook.com/privacy/policy.
If you'd rather not be measured this way, you can adjust your ad settings with Meta directly, or block tracking in your browser. Blocking it won't affect your purchase or your access to anything you've bought.
5. Cookies and similar technology
We use:
- Essential storage — needed to process your order and remember where you are in the checkout. Without it, buying wouldn't work.
- Measurement cookies — the Meta Pixel identifiers described above.
We don't use advertising cookies from any other network, and we don't sell your data to anyone.
6. Who we share your data with
We use a small number of service providers, each handling only what they need:
| Who | What they do | Where |
|---|---|---|
| Stripe | Processes payments | USA / Ireland |
| GoHighLevel (LeadConnector) | Stores your contact record and sends your delivery emails | USA |
| Mailgun | Technical delivery of those emails | USA |
| Lovable / Supabase | Hosts the website and the order database | EU / USA |
| Meta | Advertising measurement (see section 4) | USA / Ireland |
- Who
- Stripe
- What they do
- Processes payments
- Where
- USA / Ireland
- Who
- GoHighLevel (LeadConnector)
- What they do
- Stores your contact record and sends your delivery emails
- Where
- USA
- Who
- Mailgun
- What they do
- Technical delivery of those emails
- Where
- USA
- Who
- Lovable / Supabase
- What they do
- Hosts the website and the order database
- Where
- EU / USA
- Who
- Meta
- What they do
- Advertising measurement (see section 4)
- Where
- USA / Ireland
We may also disclose data where the law requires it, or to our accountants and advisers where necessary.
We don't sell your personal data, and we never will.
7. Transfers outside the EU
Some of the providers above are based in the United States. Where data is transferred there, it's protected by the European Commission's Standard Contractual Clauses, or by the provider's certification under the EU–US Data Privacy Framework.
You can ask us for details of the safeguards that apply.
8. How long we keep things
| Data | Kept for |
|---|---|
| Order and invoice records | 10 years — required by German tax and commercial law |
| Your contact record and email history | Until you unsubscribe or ask us to delete it |
| Website and advertising measurement data | Up to 24 months |
| Support emails | 3 years |
- Data
- Order and invoice records
- Kept for
- 10 years — required by German tax and commercial law
- Data
- Your contact record and email history
- Kept for
- Until you unsubscribe or ask us to delete it
- Data
- Website and advertising measurement data
- Kept for
- Up to 24 months
- Data
- Support emails
- Kept for
- 3 years
9. Your rights
Under the GDPR you have the right to:
- access the data we hold about you
- correct anything inaccurate
- erase your data, where we're not legally required to keep it
- restrict or object to how we use it, including direct marketing
- portability — receive your data in a machine-readable form
- withdraw consent at any time, without affecting anything done beforehand
To exercise any of these, email support@infantsleeplab.com. We'll respond within one month.
Every marketing email we send has an unsubscribe link. One click and we stop.
You also have the right to complain to a data protection authority. Ours is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
10. If you live in the United States
The rights in section 9 are available to you too — just email us and we'll honour them, regardless of whether your state's law requires it.
We do not sell personal information, and we do not share it for cross-context behavioural advertising beyond the advertising measurement described in section 4.
11. Children
Our products are for parents and caregivers. The site is not directed at children and we don't knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we'll delete it.
12. Security
Payments are handled entirely by Stripe and never touch our systems. Our site runs over HTTPS, our databases are access-controlled, and our email service uses authenticated sending. No system is perfectly secure, but we take this seriously — particularly because you're trusting us at a vulnerable moment.
13. Changes to this policy
If we change how we handle your data, we'll update this page and the date at the top. Material changes affecting existing customers will be communicated by email.
14. Contact
Real inbox, real person.