Privacy Policy
1. Who we are
The controller of your personal data is TaleLamp ("we"). Contact for all privacy matters: [email protected].
2. What data we process
- Details you enter to create the book: the child's first name, gender, age group, appearance choices (skin tone, hair, eyes, glasses), first names and roles of up to three companions (e.g. a sibling or a pet), and optionally a hobby, a town, a favourite toy, something the child is a little afraid of right now (chosen from a list) and a dedication, and optionally your own story idea in free text (1-3 sentences). These details are sent to the AI model provider only to write the text (see the processors list), are not used to train models and are kept by the provider no longer than its terms state. We never ask for surnames or dates of birth; a photo of the child is optional and used only for the photo hero (see section 3). A delivery address and phone number are requested only for a printed book — they are needed to perform the contract, passed to the print shop and deleted together with the order.
- Your own story idea (free text, optional) is sent to the AI model provider exactly like the other details above, is checked automatically before it is used and is never published. Please do not put surnames, addresses or health details in it.
- Your email address — to deliver the book and, if you ask for it, the free story.
- Order and payment data — what you bought, the price and payment status. Card and bank details are processed by the payment provider; we never see or store them.
- Technical data — IP address and browser type, used for security, fraud and abuse prevention.
- Advertising identifiers (e.g. campaign parameters, advertising cookies) — only if you accept marketing cookies.
We do not knowingly collect data from children. The service is intended for adults (parents, relatives, guardians) who provide the minimum information needed to personalise a story.
3. Why we process it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating the free story and the book, delivering it, customer support, rewriting stories on request | Performance of a contract and steps before it, Art. 6(1)(b) |
| Accounting and tax records | Legal obligation, Art. 6(1)(c) |
| Security, preventing abuse of the free story, handling claims | Legitimate interest, Art. 6(1)(f) |
| Reminder emails and offers (up to 3 emails after the free story, one about an unfinished order, a personal discount code; after a purchase up to 3 emails: reading tips, sharing, new packs); advertising measurement (pixels) | Your consent, Art. 6(1)(a) — you can withdraw it at any time |
| Narration in a parent's voice: your recording (up to 90 seconds) is sent to ElevenLabs to build a temporary voice model; the recording and the model are deleted right after narration, or within 2 days if narration did not happen | Your explicit consent, Art. 9(2)(a) (voice is biometric data); withdraw by deleting the recording before narration |
| Family Voice subscription: ElevenLabs creates a voice model from your recording (about a minute). The recording itself is deleted right after the model is created; we keep only the model’s id at ElevenLabs, the record of your consent (text, version, time, IP hash) and a short sample synthesised in your voice (“listen to yourself”). The model is used only to narrate your family’s books and stories and is kept while the subscription is active; when the subscription is cancelled or ends, a payment is overdue for more than 7 days, or you remove the voice or the account, it is deleted at ElevenLabs immediately. Books and stories already narrated stay with you. | Your explicit consent, Art. 9(2)(a) (a voice is biometric data), separately for each voice; withdraw it with “Remove voice” in your family account |
| Hero drawn from a photo: one photo of the child (up to 8 MB, metadata stripped on upload) is sent to fal.ai to draw the character; drawing starts right after the upload (the hero's portrait is shown in the constructor) and the photo is deleted as soon as the hero is drawn - usually within a minute, never later than 7 days; a drawn hero without a paid book is deleted after 7 days, with a book it is stored and deleted together with it; in the Premium tier the drawn hero is used to create the illustration of every scene of the book | Consent of the parent/legal guardian, Art. 6(1)(a); withdraw by deleting the book |
| "Story of the Week" subscription: your email, the hero's details and every delivered story are kept for the life of the subscription so that each new story continues the series; the payment provider holds the subscription itself (renewal date, card) | Performance of a contract, Art. 6(1)(b) |
| "My books" page: at your request we send a link (valid 7 days) to a page that lists the books bought with your email; the page shows only your own orders | Performance of a contract, Art. 6(1)(b) |
| Partner programme: a partner's name, email, partner code, clicks and commissions, so that we can pay them; a customer's order stores only the partner code | Performance of a contract with the partner, Art. 6(1)(b); legitimate interest in accounting for referred orders, Art. 6(1)(f) |
| Family account: your email, the children's profiles taken from your paid orders (name, gender, age group, look, companions - you can edit or delete each), the devices signed in (a short browser label and a keyed hash of the IP, never the address itself). A session ends after 60 days without use; an account with no book or subscription left and no sign-in for 365 days is deleted. You can download all your data as a file and delete everything from the account page | Performance of a contract, Art. 6(1)(b) |
| Gift certificates and scheduled delivery: the names and message on the certificate, your email and - if you want us to send it - the recipient's email and the delivery day. The addresses are cleared 365 days after the delivery | Performance of a contract, Art. 6(1)(b); for the recipient, our legitimate interest in delivering the gift you bought, Art. 6(1)(f) |
| Reviews: your rating and text and, only if you allow it, the hero's first name; published only with your consent and after moderation. Reviews that are not published are deleted after 365 days; published ones stay until you ask us to remove them | Your consent, Art. 6(1)(a) |
| Requests from organisations (/b2b page): name, email, organisation, message - kept 365 days | Steps before a contract, Art. 6(1)(b) |
| Partner (white-label) pages: if you buy on a branded page of a partner (a kindergarten, a shop), we remain the controller of your data; the partner receives no personal data - only the number and value of orders for its commission | Performance of a contract, Art. 6(1)(b) |
4. Who receives the data
We use the following service providers (processors), bound by data processing agreements:
| Provider | Purpose |
|---|---|
| Anthropic PBC (USA) | writing the story text (the child's first name and form details) |
| OpenAI, L.L.C. (USA) | narrating the audiobook (the story text; for a parent's voice — a voice model from your recording: a one-time one is deleted right after narration, a Family Voice one is kept while the subscription is active) |
| Lemon Squeezy, LLC (USA) — merchant of record | payments (we never see or store card details) |
| Resend, Inc. (USA) | sending emails with the link to your book |
| Hetzner Online GmbH (Germany) | hosting the website and storing books |
| Cloudflare, Inc. (USA) | bot protection (Turnstile) |
Where a provider is located outside the European Economic Area, data is transferred on the basis of the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We use AI providers only under business (API) terms, and we do not use your data to train AI models. We never sell personal data.
Backups. Once a day we make a backup of the database and the books. It is kept on our server for 14 days and a copy at a second EU hosting location for up to 60 days, then it is overwritten. Backups are a storage operation only: nothing is read from them except to restore the service, and data you have deleted disappears from them within that period.
5. How long we keep it
- Free story previews: 30 days.
- Unpaid orders: 7 days.
- Paid books (files and the child's details): 365 days, so you can download the book again. After that they are deleted automatically; you can delete them earlier yourself on the order page.
- Technical event logs: 180 days.
- Family Voice model: while the subscription is active; deleted as soon as it ends (unpaid: after 7 days), or when you remove the voice or the account. The voice recording is not kept — it is deleted right after the model is created.
- Accounting records: as long as tax law requires (in Poland — 5 years from the end of the tax year).
- Subscription data ("Story of the Week"): for the life of the subscription and 365 days after it ends, so you can still read the stories; you can ask for earlier deletion by email.
- Backups: 14 days on our server, up to 60 days at the backup location (see section 4).
6. Cookies and similar technologies
The site works without advertising cookies. With your consent we use advertising pixels (e.g. Meta, TikTok) and remember the ad campaign that brought you to us. You can change your choice at any time via "Cookie settings" at the bottom of the page. Bot protection, if enabled, is strictly necessary for the free story and does not require consent. With your consent we may also show you one of several versions of the site (for example a different headline or price) and remember that version in a cookie for 90 days to compare them; without consent you see the main version. If you switch on “Share the book”, the public link shows the child's name, the hero's look and the first story — no email or other data; you can switch the page off any time on the order page. Your friend code contains no personal data. If you arrive via a partner link, the partner code is stored with the campaign parameters to calculate their commission. Two functional cookies (ht_cc and ht_lang, 1 year) remember the country and site language you chose: the country sets the currency and prices, the language the texts; they need no consent and are not shared with anyone. Signing in to the family account sets two strictly necessary cookies, ht_sess (the session, not readable by scripts) and ht_csrf (protection against forged requests), for 60 days; they need no consent. The A/B version cookie is called ht_ab.
7. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting processing before the withdrawal). Write to [email protected]. You can delete your book and the child's details yourself on the order page. You also have the right to lodge a complaint with a supervisory authority — in particular in the country where you live or work — for us: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland.
8. Changes
We may update this policy; the current version is always available on this page with its date.