Children's Privacy Notice

This Children's Privacy Notice explains how Create Tale handles the personal data of children. It supplements our main Privacy Policy and is written in plain language so that parents and guardians can clearly understand what data we process about their children and why.

1. Our Approach to Children's Privacy

Create Tale is built on a parent-directed model. This means:

• Only adults (parents or legal guardians) can create and manage accounts;
• Children do not register, log in, or use the Service independently;
• All information about children is provided by the parent or guardian;
• All decisions about data sharing, publication, and deletion are made by the parent or guardian.

We comply with the Children's Online Privacy Protection Act (COPPA) in the United States and the children's data protection provisions of the General Data Protection Regulation (GDPR) in the European Union, including national implementations of Article 8 GDPR regarding the age of digital consent.

2. What Data We Collect About Children

We collect only the information that a parent or guardian chooses to provide when creating a child profile or using the Service:

• Name or nickname — used to personalize stories (e.g., making the child a character);
• Age or date of birth — used to generate age-appropriate content;
• Interests and hobbies — used to tailor story themes (e.g., "loves dinosaurs");
• Family role — used for story context (e.g., "older sister");
• Photos — optionally uploaded by the parent for the family diary; stored in private storage only;
• Daily highlights — diary entries written by the parent describing the child's day, used to enrich stories.

3. How We Use Children's Data

Children's data is used exclusively for:

• Story generation — to create personalized bedtime stories featuring the child as a character;
• Display within the family account — showing the child's profile, stories, and diary within the parent's account;
• Photo analysis — if the parent uses the "magic analyze" feature, photos may be sent to an AI provider to extract descriptive context for stories.

We do not use children's data for:

• Advertising or marketing;
• Behavioral profiling or tracking;
• Training, fine-tuning, or improving AI models;
• Sharing with third parties for their own purposes;
• Any purpose other than delivering the Service to the family.

4. Where Children's Data May Appear

• Within the family account — child profiles, diary entries, and stories are visible to the account holder and invited family members;
• In generated stories — the child's name and traits may appear as story characters;
• In the public Story Library — only if the parent explicitly publishes a story. We strongly encourage parents to remove or anonymize identifying details before publishing;
• With AI providers — story prompts containing child names and context are sent to our AI provider (OpenAI) for story generation. This data is processed under a data processing agreement and is not used by the AI provider for model training.

5. Parental Consent

By creating a Create Tale account and adding child profiles, you (the parent or guardian) provide consent for us to process the child's data as described in this Notice and our Privacy Policy. During registration, you are asked to confirm that:

• You are the parent or legal guardian of the children in the profiles you create;
• You consent to the processing of your children's data for story generation;
• You understand how the data will be used as described in this Notice.

We log the date, time, policy version, and method of consent for accountability purposes.

6. Parental Rights and Controls

As a parent or guardian, you have full control over your children's data. At any time, you can:

• View all data associated with your child's profile;
• Edit your child's name, age, interests, or other profile information;
• Delete photos individually or all at once;
• Delete the child's profile entirely, which will remove all associated data;
• Delete your account, which will delete all child profiles and associated data;
• Unpublish stories from the public library;
• Request a data export by contacting us;
• Withdraw consent for data processing at any time by deleting the child's profile or contacting us.

Most of these actions are available directly in your account settings. For actions that require our assistance, contact us at privacy@createtale.com.

7. Data Security

We implement appropriate technical and organizational measures to protect children's data:

• All data is encrypted in transit (TLS) and at rest;
• Photos are stored in private object storage, accessible only via time-limited signed URLs;
• Access to production data is restricted to authorized personnel on a need-to-know basis;
• Administrative actions are logged for audit purposes.

8. Data Retention and Deletion

Children's data is retained only as long as the child profile exists within the parent's account. When a parent deletes a child profile or their account:

• Profile data and associated stories are deleted from our production systems;
• Photos are removed from storage;
• Data may persist in encrypted backups for up to 90 days before being purged;
• Published stories will be removed from the public library.

9. Updates to This Notice

If we make material changes to how we handle children's data, we will notify you by email and update the effective date of this Notice. We will seek renewed consent where required by law.

10. Contact Us

If you have any questions about how we handle your child's data, or wish to exercise your parental rights:

Email: privacy@createtale.com

Last updated: March 29, 2026