Privacy Policy

Our promises

Fourth exists to support mothers through one of the most personal times of their lives. We treat your information that way.

• We never sell your personal information. We do not rent or trade it either.
• Your recovery tracker is for you alone. Only you can see your entries and photos. We do not analyze them, advertise with them, share them, or use them to train AI.
• No advertising trackers. We do not use advertising pixels, such as those from Meta or TikTok, on Fourth.
• Stored in Canada, encrypted. Our main database, including your tracker, is hosted in Canada and encrypted in transit and at rest.
• You are in control. You can see, export, correct or delete your information at any time.
• Fourth stays separate. We do not share your Fourth information with our sister platform, The Mother Network, unless you ask us to.

1. Who we are and what this policy covers

1.1 Fourth (also "Fourth Registry") is operated by The Mother Network Inc., an Ontario corporation at 212 King Street West, 6th Floor, Toronto, Ontario, Canada M5H 1K5 ("Fourth," "we," "us"). We are responsible for your personal information. Under the EU and UK GDPR, we are the "controller."

1.2 Privacy Officer. Madison Schumann is accountable for Fourth's compliance with this policy and privacy law. You can reach her at legal@fourthregistry.com or at the address above, marked "Attention: Privacy Officer."

1.3 Who this covers. This policy applies to everyone who uses fourthregistry.com, our apps and our emails (the "Services"). That includes registrants, guests, Club Fourth members and visitors.

1.4 What it does not cover. Retailers, Stripe, Google, affiliate networks and partner brands have their own privacy policies. When you leave Fourth to buy from a retailer, or pay through Stripe, their policies apply to what they collect. Stripe handles some payment information as an independent controller, for example to prevent fraud.

1.5 Health information. Some information you give us, including your recovery tracker, is health information. Our Consumer Health Data Policy gives more detail and applies alongside this policy. It includes rights for residents of Washington, Nevada, Connecticut and other states with consumer health data laws.

1.6 Laws we follow. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). Where they apply to you, we also comply with U.S. state privacy and consumer health data laws, the EU General Data Protection Regulation (GDPR), and the UK GDPR and Data Protection Act 2018.

2. Information we collect

We collect only what we need to run Fourth. Fields marked optional in the Services are optional.

2.1 Health and sensitive information. Your recovery tracker, due date, birth date and baby details can reveal information about your health and pregnancy. We treat all of it as sensitive. We do not collect precise geolocation, government ID numbers or biometric data. Stripe may collect government ID to verify cash fund recipients, under its own privacy policy.

2.2 Information about other people. If you add information about your baby, your guests or anyone else, please share only what is needed and make sure you are allowed to share it.

3. How we use your information

We use your information only for the purposes below. If you are in the UK or the EU, the last column shows the legal basis we rely on.

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details, or object, using Section 8.

3.1 Special rules for your recovery tracker. Your tracker is the most sensitive part of Fourth, so stricter rules apply.

• Consent first. We ask for your express consent before you first use the tracker. You can withdraw consent at any time by deleting your entries or your account. Withdrawing stops collection. Deleting removes the data as set out in Section 5.
• One purpose. We use tracker data only to store it, show it to you, personalize your view, and let you export it.
• Personalization stays with you. Personalization means showing you content that matches your recovery day and your own entries. It happens within Fourth and is shown only to you.
• Never used for anything else. We do not use tracker data for advertising, marketing, product recommendations, analytics, research, aggregated statistics or AI training. We do not share it with brands, partners, retailers, employers, insurers or The Mother Network.
• Photos stay private. Tracker photos are stored in private, access-controlled storage. They are never shown to guests or other users.
• Kept out of analytics. Analytics tools do not run on tracker pages, and no information about your entries is sent to any analytics provider.
• Limited staff access. Our team does not look at tracker data. Access is only possible if you ask us for help and give permission, to fix a technical problem that affects the data, or if the law requires it. Access is limited to the minimum needed and is logged.

3.2 Automated decisions. We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

3.3 Artificial intelligence. We do not use your content to train AI models. If we introduce AI-powered features, we will tell you first. We will not use your health information in them without your express consent.

3.4 New purposes. If we want to use your information for a new purpose, we will tell you first. Where the law requires, we will ask for your consent.

4. Who we share information with

4.1 We do not sell your personal information. We do not share it for cross-context behavioural or targeted advertising, and we do not give it to data brokers. This has been true in the past 12 months and will stay true.

4.2 Service providers. We use trusted companies to run Fourth. Our contracts require them to use your information only to provide services to us, to protect it, and to delete or return it when the work ends.

4.3 People you choose. Your registry is visible to the people you share it with, based on your settings. Registrants see the names, messages and gifts of guests who give. If you export your tracker, you choose who sees the export.

4.4 Retailers and affiliate networks. When you or a guest click a product link, you go to the retailer's site. The retailer and affiliate network may set cookies and collect information under their own policies. We do not send them your name, email, registry details or health information.

4.5 Partner perks. Partners do not receive your information unless you choose to redeem a perk that requires it. We will tell you what will be shared before you do.

4.6 Legal requests. We disclose information when the law requires it, such as a valid court order. We review each request, push back on requests that are overbroad, and tell you about the request unless the law prohibits us. We will not voluntarily give health information, including anything relating to pregnancy or reproductive health, to law enforcement. We require a valid warrant or court order, and we will challenge it where we have grounds to.

4.7 Safety and rights. We may share limited information where needed to prevent fraud, protect someone's safety, or protect our rights and property.

4.8 Business transfers. If Fourth is involved in a merger, acquisition, financing or sale of assets, information may be transferred to the other party, subject to confidentiality. The successor must honour the promises in this policy for information collected under it. We will tell you before your information becomes subject to a different policy. We will ask for your consent where the law requires it, including for health information.

4.9 The Mother Network. Fourth and The Mother Network are operated by the same company, but we keep Fourth information separate. We will not share it with The Mother Network platform unless you ask us to.

5. How long we keep information

We keep information only as long as we need it for the purposes in this policy, or as long as the law requires.

We may keep information longer if we need it to resolve a dispute, enforce our Terms, or meet a legal obligation. When we no longer need information, we delete it or de-identify it so that it cannot reasonably be linked back to you. We never de-identify tracker data to reuse it; we delete it.

6. How we protect information

6.1 We use administrative, technical and physical safeguards suited to how sensitive your information is. These include:

• encryption in transit (TLS) and at rest;
• database rules that allow each account to reach only its own data;
• private, access-controlled storage for photos;
• staff access limited to those who need it, protected by multi-factor authentication and logged;
• reviewing the security practices of our service providers;
• a written plan for responding to security incidents.

6.2 No system is perfectly secure, so we cannot guarantee security. You can help by using a strong, unique password and sharing registry passwords only with people you trust.

7. Where information is stored and transferred

7.1 Our main database, including your recovery tracker, is stored in Canada. Some service providers process information in the United States or other countries, as shown in Section 4.2. Information held in another country may be accessed by that country's courts and authorities under its laws.

7.2 For users in the UK and the EU. Canada is recognized by the European Commission and the UK government as providing adequate protection for personal information handled by businesses such as ours. For transfers to the United States, we rely on the EU–U.S. Data Privacy Framework and its UK Extension where the recipient is certified. Otherwise, we use the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of these safeguards.

8. Your rights and choices

8.1 For everyone. Wherever you live, you can:

• see the personal information we hold about you and get a copy;
• correct information that is wrong or incomplete;
• delete your information or your account;
• export your tracker entries and registry in a portable format;
• withdraw consent you have given, including for the tracker and marketing emails;
• object to how we use your information.

You can export and delete directly in your account settings. For anything else, email legal@fourthregistry.com. Using your rights is free, and we will never treat you differently for doing so.

8.2 Canada. You can challenge our compliance with this policy by contacting our Privacy Officer. We respond to requests within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

8.3 United States. Depending on your state, you may have the right to know, access, correct, delete and port your personal information. These states include California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. We offer these rights to all U.S. users.

• Opt-outs. You may have the right to opt out of the sale of personal information, targeted advertising, and profiling that produces significant effects. We do none of these. We also honour Global Privacy Control signals as an opt-out.
• Sensitive information. We use sensitive information, including health information, only as needed to provide the Services you request, or with your consent. We do not use it to infer characteristics about you.
• Response time. We respond within 45 days. We may extend this by another 45 days where the law allows, and will tell you if we do.
• Authorized agents. You may use an authorized agent. We may ask for proof of their authority and to verify your identity directly.
• Appeals. If we decline your request, you can appeal by emailing legal@fourthregistry.com with the subject "Privacy Appeal." We will respond within the time your state's law requires. If you disagree with our decision, you can contact your state Attorney General.
• California. We do not disclose personal information to third parties for their direct marketing, so California's "Shine the Light" law does not require further disclosure. See the California notice below.

8.4 United Kingdom and European Union. You have the rights to access, rectification, erasure, restriction of processing, data portability, and objection, including to processing based on legitimate interests. You can withdraw consent at any time without affecting earlier processing. We respond within one month, which may be extended where the law allows. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

8.5 Verifying your identity. To protect you, we confirm requests through the email address on your account. For sensitive requests, such as a copy of tracker data, we may ask for a further step. We use this information only to verify your request.

California notice at collection

In the past 12 months, we have collected the following categories of personal information, as defined in the California Consumer Privacy Act. We have disclosed them only to service providers and the other recipients described in Section 4, for the business purposes in Section 3. We have not sold or shared any of them.

9. Children

Fourth is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18, including children under 13. Information about your baby that you add is used only to provide the Services to you. If we learn that someone under 18 has created an account, we will delete it. Contact us at legal@fourthregistry.com if you believe this has happened.

10. Emails and other messages

10.1 Marketing emails. We send marketing emails only if you opt in by an unticked checkbox or similar active step. Every marketing email identifies Fourth, gives our mailing address, and includes a one-click unsubscribe link. We process unsubscribe requests within 10 business days, and usually much sooner.

10.2 Service messages. We will still send messages you need to use Fourth, such as receipts, security alerts, registry activity and changes to our terms. These are not marketing.

10.3 Text messages. We do not currently send text messages. If we start, we will ask for your separate consent.

11. If something goes wrong

If a security incident affects your personal information, we will act quickly to contain it and will notify you and the relevant regulators as the law requires. This includes Canada's Privacy Commissioner, U.S. state authorities, the U.S. Federal Trade Commission where its Health Breach Notification Rule applies, and UK or EU regulators within 72 hours where required. We keep a record of every security incident involving personal information.

12. Changes to this policy

We may update this policy as Fourth or the law changes. The effective date at the top shows when it last changed. For material changes, we will email you or notify you in the Services at least 30 days before they take effect. We will not use information we already hold in a materially different way without your consent.

13. Contact us

Privacy Officer: Madison Schumann

The Mother Network Inc. (operating as Fourth), 212 King Street West, 6th Floor, Toronto, Ontario, Canada M5H 1K5

Email: legal@fourthregistry.com (subject line "Privacy")