Privacy Policy

2.1 Information You Provide Directly

- **Account Information:** When you register, we collect your name, email address, and a hashed version of your password. We never store your password in plain text. - **Story Inputs:** The names, ages, themes, characters, and other story parameters you enter when generating a story. These inputs are used solely to generate your story and are associated with your account. - **Payment Information:** When you purchase credits, we collect billing details through our payment processor (Razorpay). We do not store your credit card numbers or bank details on our servers; all payment data is handled by Razorpay under their PCI-DSS-compliant infrastructure. - **Feedback and Support:** Any messages, feedback, or support requests you send us.

2.2 Information Collected Automatically

- **Usage Data:** Pages visited, features used, story generation events, credit usage, session duration, and navigation patterns within the app. - **Device and Technical Information:** IP address, browser type and version, operating system, device type, screen resolution, and referring URLs. - **Cookies and Similar Technologies:** Session tokens, preference cookies, and analytics cookies (see Section 7 for full details).

2.3 Information from Third Parties

- **Google Gemini API:** When you generate a story, your story parameters are sent to Google's Gemini API. Google may process this data in accordance with their own privacy policy. We do not receive any personal data back from Google beyond the generated story content. - **Amazon Web Services (AWS S3):** Story images and content may be stored in our AWS S3 buckets. AWS processes data under their Data Processing Agreement.

3.1 Providing the Service

- Creating and managing your account - Generating personalized stories using AI based on your inputs - Managing and tracking your credit balance - Storing and displaying your previously generated stories - Delivering story content and images to your device

3.2 Processing Payments

- Verifying purchases and crediting your account - Preventing fraudulent transactions - Sending payment confirmation emails and receipts

3.3 Improving the Platform

- Analysing aggregated, anonymised usage patterns to improve features - Identifying and fixing bugs and performance issues - Understanding which story types and features are most valuable - Conducting internal research and product development

3.4 Communications

- Sending transactional emails (account creation, purchase confirmations, password resets) - Sending service-related announcements (major changes, maintenance windows) - Sending optional product updates and offers, but only if you have opted in

3.5 Safety and Legal Compliance

- Detecting, investigating, and preventing abuse, fraud, or policy violations - Complying with applicable laws, regulations, and lawful government requests - Enforcing our Terms and Conditions

4.1 Story Text Generation (Google Gemini)

When you create a story, the parameters you provide (child's name, age, theme, characters, moral lesson, language, etc.) are transmitted to Google's Gemini large language model API. This data is processed by Google to generate story text, which is then returned to our servers and stored in your account.

4.2 Story Images

Story illustrations and images generated for your stories are stored on Amazon Web Services S3 in encrypted buckets. These images are associated with your account and are accessible only by you (and our administrative team for support purposes). Images are not shared publicly unless you explicitly share your story through any future sharing features.

4.3 Content Moderation

All story inputs are processed through safety filters before being sent to the AI model. Our prompts are designed to produce age-appropriate, child-safe content only. We do not generate stories involving violence, adult content, discrimination, or any content that could be harmful to children.

4.4 No Training on Your Data

MumTales does not use your story inputs, story content, or personal data to train our own AI models or to improve third-party AI models. Your stories are yours.

4.5 Accuracy and Limitations

AI-generated stories are creative content and are not factual articles. While we take care to produce appropriate content, AI models can occasionally produce unexpected output. MumTales is not liable for AI-generated content that is inaccurate, incomplete, or not to your taste. Please review all generated content before sharing with children.

5.1 Who Creates Accounts

MumTales accounts are created by adults (18 years or older). We do not knowingly allow children under 13 to create accounts directly. If you are under 13, please ask a parent or guardian to create an account and use MumTales on your behalf.

5.2 Children's Data in Stories

When you create a story featuring a child's name, age, or characteristics, we store this information as part of your story record. This data is: - Linked to your adult account only - Never shared with third parties for marketing - Never used to build profiles about children - Stored only as long as necessary to provide the service

5.3 Parental Controls

As the account holder, you have full control over your account and all stories within it. You can delete any story and all associated data at any time from your account dashboard.

5.4 COPPA

We comply with the Children's Online Privacy Protection Act (COPPA) in the United States. If you believe we have inadvertently collected personal information from a child under 13 without parental consent, please contact us immediately at [email protected] and we will delete that information promptly.

5.5 GDPR: Children in the EU/UK

Under GDPR and the UK GDPR, the age of digital consent varies by country (typically 13-16). If you are using MumTales in the EU or UK, you confirm that you are an adult and that any story inputs relating to children are provided under your own authority as a parent or guardian.

6.1 Essential Cookies

These are strictly necessary for the service to function and cannot be disabled: - **Authentication Cookie (mt_token):** An HTTP-only, Secure, SameSite=Lax JSON Web Token cookie that keeps you logged in for up to 7 days. This cookie is not accessible to JavaScript and cannot be read by third-party scripts. It is automatically cleared on logout or expiry.

6.2 Analytics Cookies

We may use privacy-respecting analytics tools to understand how users interact with MumTales. These tools collect anonymised, aggregated data such as page views, session duration, and feature usage. We do not use Google Analytics' advertising features or any cross-site tracking cookies.

6.3 No Third-Party Advertising Cookies

We do not use advertising networks, retargeting pixels, or social media tracking cookies. No Facebook Pixel, Google Ads remarketing tags, or similar trackers are present on MumTales.

6.4 Managing Cookies

You can control cookies through your browser settings. Note that disabling the authentication cookie will prevent you from staying logged in. Most modern browsers allow you to block third-party cookies without affecting essential functionality.

7.1 Where We Store Your Data

Your data is stored on: - **MongoDB Atlas**: Account information, story metadata, and credit balances are stored in MongoDB Atlas clusters. Data may be hosted in the United States or European regions depending on your location and our infrastructure configuration. - **Amazon S3**: Story images and generated content files are stored in AWS S3 with server-side encryption (AES-256). - **Vercel**: Our application is deployed on Vercel's edge infrastructure. Vercel may process request data (IP addresses, headers) as part of request routing.

7.2 Security Measures

We implement industry-standard security practices including: - Passwords are hashed using bcrypt with an appropriate work factor; plain-text passwords are never stored - Authentication tokens are HTTP-only cookies (inaccessible to JavaScript) - All data in transit is encrypted using TLS 1.2 or higher (HTTPS) - Database credentials and API keys are stored as environment variables, never in source code - AWS S3 buckets are private by default with no public access - We conduct periodic reviews of our security posture

7.3 Data Retention

- **Account data:** Retained for as long as your account is active, plus a 90-day deletion window after account closure - **Story data:** Retained for the lifetime of your account; you may delete individual stories at any time - **Payment records:** Retained for 7 years as required by financial regulations - **Server logs:** Automatically purged after 30 days - **Anonymised analytics data:** May be retained indefinitely as it cannot identify you

7.4 Account Deletion

You may request full deletion of your account and all associated data by contacting [email protected]. We will process deletion requests within 30 days. Note that payment records required for legal compliance may be retained in anonymised form.

9.1 Rights Under GDPR (EU/UK Residents)

- **Right of Access:** Request a copy of all personal data we hold about you - **Right to Rectification:** Ask us to correct inaccurate or incomplete data - **Right to Erasure ("Right to be Forgotten"):** Request deletion of your personal data, subject to legal retention obligations - **Right to Restriction:** Ask us to limit how we process your data in certain circumstances - **Right to Data Portability:** Receive your data in a structured, machine-readable format (JSON/CSV) - **Right to Object:** Object to processing based on legitimate interests or for direct marketing purposes - **Right to Withdraw Consent:** Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

9.2 Rights Under CCPA (California Residents)

- Right to know what personal information we collect and how it is used - Right to delete personal information - Right to opt out of the sale of personal information (we do not sell personal information) - Right to non-discrimination for exercising your privacy rights

9.3 How to Exercise Your Rights

To exercise any of the above rights, contact us at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 days (or sooner where required by law). We may need to verify your identity before processing your request.

Hauper Technologies

MumTales Privacy Team