Last updated: October 12, 2026
At The Sleepy Treehouse, families’ trust is the foundation of everything. When you tell us how your child sleeps, you are sharing something very personal, and we treat that information with the same care we bring to every family we support.
This policy explains, in plain language, what data we collect, the purposes we use it for, who we share it with, how long we keep it and what your rights are. It applies to the website www.thesleepytreehouse.pt and to all The Sleepy Treehouse sleep consulting services.
1. Who is responsible for your data
The controller of your personal data is:
- Name: The Sleepy Treehouse, Lda.
- Tax ID (NIF): 517621517
- Address: Rua Castilho, n.º 32, 9.º andar, 1250-070 Lisboa, Portugal
- Email: msm@thesleepytreehouse.pt
For any question about your data, or to exercise your rights, you can write to us at this address.
2. What data we collect
We only collect the data we need for each of the purposes described in this policy.
When you contact us (contact form, email, social media): name, email, phone number, if you provide it, and the content of your message.
When you book a call or a program (through Calendly): name, email, phone number, date and time of the booking, and your answers to the booking form questions.
When you pay for a service or a voucher: billing details (name, address and, if you provide it, tax number) and payment confirmation. Card details are handled directly by the payment platform and never reach us.
During a sleep program: your answers to the initial questionnaire, information about your child’s sleep, routines and development, the sleep log you fill in online, consultation notes, recordings and transcripts of consultations (only if you have given your prior and express consent), and the messages we exchange (by email, phone, video call or WhatsApp, as agreed).
When you subscribe to our communications or take the quiz on our site: name, email and your quiz answers.
When you browse the site: technical data such as your IP address, device and browser type, and the pages you visit, through cookies. See section 9 and our Cookie Policy.
3. Data about your child
To create a tailored sleep plan, we need to get to know your child: age, routines, feeding, sleep and, where relevant, information about their health and development. Part of this information is considered health data under the law, a special category of personal data that benefits from enhanced protection under the GDPR.
That is why:
- this data is always provided by you, as parent or legal guardian, and is never collected directly from the child;
- we only process it with your explicit consent, which we ask for before the program starts;
- we use it only to support your child, and never for any incompatible purpose;
- you can withdraw your consent at any time. If you do, we will stop processing this data, but without it we may not be able to continue supporting you.
Sleep consulting does not replace medical or pediatric care. We do not make diagnoses or provide health care.
Online consultations, recording and support tools
Online consultations take place by video call through Google Meet. A consultation is only recorded or transcribed if you have given your prior, express consent, and only then may we use artificial intelligence tools to take notes during the consultation. These records are used solely to prepare and follow up on your child’s sleep plan, and for nothing else.
You can refuse recording and transcription without any impact on the consultation, and you can withdraw your consent at any time by emailing msm@thesleepytreehouse.pt.
4. What we use data for and on what legal basis
The law requires every use of data to have a legal basis. These are ours:
| Purpose | Legal basis |
|---|---|
| Responding to your contact requests | Our legitimate interest in responding to people who reach out to us, or pre-contractual steps taken at your request |
| Managing bookings and providing sleep programs | Performance of our contract with you |
| Processing your child’s health and development data | Your explicit consent |
| Recording and transcribing consultations and using AI tools to take notes | Your explicit consent, which you can withdraw at any time |
| Issuing invoices and meeting tax obligations | Compliance with legal obligations |
| Sending the newsletter, quiz results and communications about our services | Your consent, which you can withdraw at any time |
| Measuring site use and improving the site | Your consent, given in the cookie banner |
We do not make any automated decisions about you or your child. The quiz on our site gives general guidance, but any individual recommendation is always made by a person.
5. Who we share data with
We do not sell or share your data for third parties’ marketing or other commercial purposes. To provide our services, we use a few companies that process data on our behalf and under our instructions (processors):
- Calendly, for bookings;
- Stripe, for payments;
- PTisp, to host the site and its forms;
- Google (Google Meet, Forms, Sheets, Drive and Analytics), for video consultations, the sleep questionnaire, the sleep log, consultation recordings and site visit statistics (the latter only if you accept analytics cookies);
- Brevo, to send emails, including automatic voucher and invoice emails and the newsletter;
- InvoiceXpress, to issue invoices;
- Artificial intelligence tools (Google Gemini, within Google Workspace), to take notes during consultations, only if you authorize it. Google does not use this data to train its models.
If we agree with you to use WhatsApp for support, messages go through the service of WhatsApp Ireland Limited, which processes that data under its own terms and privacy policy. For that reason, we ask you not to share detailed health information over WhatsApp when it can be sent by email.
We may also need to share data with public authorities, such as the Portuguese Tax Authority, when required by law.
If we use other service providers that process personal data on our behalf, this policy will be updated as needed.
6. Transfers outside the European Union
Some of these companies (for example, Calendly, Stripe and Google) are based in the United States or store data outside the European Union. In those cases, transfers only take place with the safeguards required by law, such as the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.
Where applicable, transfers are carried out under a valid transfer mechanism recognized by the GDPR.
7. How long we keep data
- Contact messages that did not lead to a service: up to 1 year.
- Family records and program data, including data about your child: during the program and up to 5 years after it ends, because we often support the same family again (the same child at a later stage, or a sibling) and the history helps us provide continuity. You can ask us to delete it sooner.
- Consultation recordings and transcripts: during the program and up to 3 months after it ends, after which they are deleted.
- Invoices and payment records: 10 years, as required by tax law.
- Newsletter and communications: until you unsubscribe.
- Cookies: according to each cookie’s duration, as set out in the Cookie Policy.
Once these periods end, data is deleted or anonymized, unless keeping it is necessary to comply with a legal obligation or to establish, exercise or defend legal claims, in or out of court.
8. Your rights
At any time, you can ask us to:
- access the data we hold about you and your child;
- correct inaccurate or outdated data;
- delete your data when there is no longer a reason for us to keep it;
- restrict how we use it;
- object to a use based on our legitimate interest;
- receive your data in a format you can take to another service (portability);
- withdraw the consent you have given, without affecting the lawfulness of processing carried out before you withdrew it.
Just email msm@thesleepytreehouse.pt. We will reply within one month of receiving your request, subject to the extensions allowed by law.
If you believe your data is not being handled properly, you also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
9. Cookies
The site uses cookies: small files stored on your device. We use two types of cookies.
Necessary cookies, which store, for example, your chosen language and your cookie choices, are always used because without them the site does not work properly or cannot offer certain features.
Google Analytics cookies help us understand how many people visit the site and which pages they read most, so we can improve it. They are only used if you accept them in the banner, and you can change your choice at any time.
We do not use advertising cookies.
You will find all the details in our Cookie Policy.
10. Security
We use appropriate technical and organizational measures to protect your data against loss, unauthorized access or disclosure, including a secure connection (HTTPS) on the site, restricted access to the accounts of the tools we use, and working only with providers that meet the applicable data protection requirements.
11. Changes to this policy
We may update this policy, for example when we start using a new tool. The date of the last update is always shown at the top.
When changes are significant, we will make reasonable efforts to let our clients and subscribers know.
12. Contact
For any question about this policy or your data, you can reach us at: msm@thesleepytreehouse.pt.
