Privacy Policy

1. The data controller

The controller of the personal data processed through the Storyjamas service is the company that operates Storyjamas. The company’s full identification details (name, registered office, tax identification number, registration number) will be stated here in the final version of this document.

You can contact the controller, including for any question about data processing, at [email protected].

2. The data we collect

We collect strictly the data needed to provide the service. Account data: your email address and authentication credentials. We do not ask for your full name in order to use the service.

Data about the child, provided optionally by you: the child’s first name (optional) and the age range (for example 3-5, 5-7, 7-9, 9-12). We do not collect the exact date of birth, addresses, photos or other sensitive data about the child. This data is described in detail in the GDPR-for-children document.

Content: the stories you generate, the themes you choose, and the associated metadata (universe, target age, language).

Activity data: information about how the service is used, such as stories read and re-read, needed for features like the library and the re-read count.

3. Purposes of processing

We process data to: create and manage your account; generate and store your stories; provide the library and reader features; process subscriptions and print orders; ensure child safety through content review; communicate with you about the service; and comply with legal obligations.

We do not use the data for advertising profiling and we do not sell it.

4. Legal basis

We process data on the following bases under the General Data Protection Regulation (GDPR): performance of the contract with you (account creation, story generation, subscription); your consent, where required (for example the child’s optional first name or the optional statistics); our legitimate interest in keeping the service safe and functional; and compliance with legal obligations.

You can withdraw your consent at any time for processing based on it, without affecting the lawfulness of processing before the withdrawal.

5. Recipients and processors

We do not sell your data. We share it only with providers who help us deliver the service, acting as processors, under data-processing agreements and only to the extent necessary.

The current providers are: Replicate (illustration generation), Cloudflare R2 (image and file storage), and Resend (transactional email delivery).

Stripe is named as the future payment processor: payment processing for subscriptions and orders will be carried out by Stripe once payments are enabled. We do not store your full card details.

6. International transfers

Some of our providers may process data outside the European Economic Area. In those cases we ensure the transfer is covered by appropriate safeguards under the GDPR, such as the standard contractual clauses adopted by the European Commission or an adequacy decision.

You can request information about the applicable safeguards at the contact address below.

7. Retention period

We keep data for as long as you have an active account and as long as necessary for the purposes described here. Account data and stories are kept until you delete your account or request deletion.

Data about the child is kept according to the minimisation principle and is deleted when the account is deleted or at your request. Certain data may be kept longer only where a legal obligation requires it.

8. Your rights

You have the right of access to your data and the right to receive a copy of it.

You have the right to rectification of inaccurate data and to completion of incomplete data.

You have the right to erasure (the “right to be forgotten”), under the conditions provided by law.

You have the right to data portability: you can receive your data in a structured, commonly used, machine-readable format.

You have the right to restriction of processing and the right to object to certain processing.

You have the right to lodge a complaint with the Romanian data-protection authority (ANSPDCP) or with the supervisory authority of your country of residence.

9. How to exercise your rights

You can exercise your rights by writing to us at [email protected]. Some actions are available directly in the app: you can export your stories as PDF from each story’s page, and you can delete your account from settings.

We answer your requests within 72 hours of receipt, and full resolution takes place within the time limits set by the GDPR. We charge no fee for exercising your rights, as provided by law.

10. Cookies

We use cookies strictly for the app’s necessary functions and, optionally and only with your consent, for anonymous statistics hosted by us. Full details and your options are in the cookies policy.

11. Changes to this policy

We may update this policy to reflect changes to the service or the legal framework. We will notify you of significant changes by a reasonable means and update the date at the top of the document.

12. Data-protection contact

For any question about the processing of your data or about exercising your rights, you can contact us at [email protected]. We answer within 72 hours.