Privacy Policy
Effective date: March 29, 2026
1. Who We Are
Create Tale ("we", "us", "our") is the data controller responsible for the processing of your personal data. Create Tale is an AI-powered children's story generation service designed for parents and guardians.
For privacy-related inquiries, you can contact us at: privacy@createtale.com
2. What Data We Collect
2.1. Adult Account Data
When you register and use the Service, we collect:
- Email address and password (hashed);
- Full name;
- Language and region preferences;
- Subscription status and billing identifiers (Stripe customer ID or Apple transaction ID);
- Email verification status and consent timestamps;
- Parent/guardian confirmation status.
2.2. Child Profile Data
When you create child profiles, you provide:
- Child's name or nickname;
- Age or date of birth;
- Interests, hobbies, and personality traits;
- Family role (e.g., "daughter", "son");
- Optional: avatar or photo.
Important: All child data is provided by the parent or guardian. We do not collect personal information directly from children. Children do not have independent accounts.
2.3. Story & Diary Content
- Daily highlight diary entries (text descriptions of your day);
- Photos uploaded to diary entries;
- Story generation parameters (theme, moral, language, age range);
- Generated stories, illustrations, and audio narrations.
2.4. Technical & Analytics Data
- IP address (for security and rate limiting);
- Browser type, device type, operating system;
- Pages visited and feature usage patterns;
- Error logs and performance data;
- Authentication events (login, logout, token refresh).
3. Why We Process Your Data (Purposes and Legal Bases)
| Purpose | Data used | Legal basis |
|---|---|---|
| Account creation and management | Email, name, password hash | Contract performance |
| Story generation and delivery | Family profiles, diary entries, photos, story parameters | Contract performance (with parental authorization for child data) |
| Subscription billing | Billing identifiers, subscription status | Contract performance |
| Email communications (verification, password reset) | Email address | Contract performance |
| Public Story Library | Story text, cover, display name | Explicit parental action (separate publication consent) |
| Product analytics and improvement | Usage patterns, page visits, anonymized metrics | Consent (via cookie banner) |
| Error tracking and service reliability | Error logs, device info, IP address | Legitimate interest (service stability) |
| Security and fraud prevention | Authentication events, IP, abuse signals | Legitimate interest / Legal obligation |
| Tax and accounting records | Invoice data, billing history | Legal obligation |
4. Children's Privacy
Create Tale is designed as a parent-directed service. We take the privacy of children very seriously.
- No direct collection from children. All data about children is entered by the parent or guardian. Children do not create accounts or interact with the Service independently.
- Private by default. Child profiles and photos are visible only to the account holder and invited family members. Nothing is publicly visible unless the parent explicitly publishes a story.
- No behavioral advertising. We do not serve targeted or behavioral advertising based on children's data.
- No AI training on child data. We do not use children's names, photos, diary entries, or generated stories to train, fine-tune, or improve AI models.
- Parental control. Parents can view, edit, and delete all child profiles and associated data at any time through their account settings.
- Secure media delivery. Photos and media files are stored in private storage and delivered via time-limited signed URLs, not publicly accessible links.
For additional information about our compliance with COPPA and European children's privacy requirements, please see our Children's Privacy Notice.
5. Who We Share Data With
We do not sell your personal data. We share data only with service providers ("processors") who help us operate the Service, under strict data processing agreements:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| OpenAI | AI story generation, photo analysis | Story prompts, family context, diary text, photos (when photo analysis is used) | USA |
| Stripe | Payment processing | Email, billing details | USA / EU |
| Sentry | Error tracking and monitoring | Error logs, device/browser info, IP | USA / EU |
| Cloud hosting provider | Infrastructure and data storage | All service data (encrypted at rest) | EU |
| Email delivery service | Transactional emails | Email address, message content | EU |
6. International Data Transfers
Some of our service providers process data outside the European Economic Area (EEA), primarily in the United States. For such transfers, we rely on:
- European Commission adequacy decisions, where applicable;
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- Additional technical and organizational safeguards as needed.
7. Data Retention
We retain your data for as long as necessary to provide the Service and fulfill the purposes described in this policy:
| Data category | Retention period |
|---|---|
| Active account and profile data | Until account deletion |
| Child profiles and photos | Until deleted by parent or account deletion |
| Generated stories | Until deleted by user or account deletion |
| Billing and invoice records | As required by tax law (typically 7-10 years) |
| Security and authentication logs | Up to 180 days |
| Deleted data in backups | Up to 90 days (purged on next backup rotation) |
8. Your Rights
Under the GDPR and other applicable data protection laws, you have the right to:
- Access — request a copy of your personal data;
- Rectification — correct inaccurate or incomplete data;
- Erasure — request deletion of your data ("right to be forgotten");
- Restriction — request that we limit processing of your data;
- Portability — receive your data in a structured, machine-readable format;
- Objection — object to processing based on legitimate interests;
- Withdraw consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
To exercise these rights, contact us at privacy@createtale.com. We will respond within 30 days. You may also manage most of your data directly through your account settings (edit profile, delete photos, delete child profiles, delete account).
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.
9. Automated Decision-Making
Create Tale uses AI to generate stories, illustrations, and audio narrations based on the information you provide. This processing does not produce legal effects or similarly significant effects on you or your children. The AI is used solely to create entertainment content that you review before sharing with your family. No automated profiling is used for marketing, advertising, or access decisions.
10. Cookies and Similar Technologies
We use essential cookies for session management and optional analytics cookies with your consent. For full details, see our Cookie Policy.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice in the Service. The updated policy will include a new effective date at the top of this page.
12. Contact Us
For any privacy-related questions or to exercise your rights:
Email: privacy@createtale.com
Last updated: March 29, 2026