This Privacy Policy explains how [Your Company Legal Name, LLC] ("Lullaby," "we," "us") collects, uses, and shares information when you use lullabystories.app and our related services (the "Service"). For information specific to children, please also read our Children's Privacy Notice.
1. Information we collect
Information you provide
- Account: email address, display name, password (hashed), and authentication identifier when you sign in with Google.
- Story inputs: the lesson, characters, child's first name or nickname, age range, and any other prompt content you enter.
- Billing: handled by Stripe; we store a customer ID and your subscription status, not your full card number.
- Support communications: messages you send us.
Information collected automatically
- Log data such as IP address, device and browser type, pages viewed, and timestamps.
- Cookies and similar technologies used to keep you signed in and to measure aggregate usage.
2. How we use information
- To generate and deliver the stories, illustrations, and narration you request.
- To create and maintain your account and process subscription payments.
- To detect, prevent, and address fraud, abuse, and content-safety violations.
- To improve the Service, debug issues, and develop new features.
- To send transactional emails (receipts, password resets, important service notices).
- To comply with legal obligations.
We do not sell your personal information. We do not use children's information for behavioral advertising. We do not use your story prompts or generated stories to train third-party AI models.
3. How we share information
We share information only with service providers acting on our behalf, including:
- Lovable Cloud / Supabase — database and authentication hosting.
- Stripe, Inc. — payment processing.
- Anthropic, OpenAI, Google, Replicate, ElevenLabs — AI model providers that process prompts to generate story text, images, and audio. These providers are contractually restricted from using your prompts to train their models.
- Cloudflare — hosting and content delivery.
We may also disclose information when required by law, to protect rights and safety, or in connection with a merger or acquisition.
4. Data retention
- Account data is retained while your account is active and for a reasonable period after closure for tax, accounting, and dispute-resolution purposes.
- Generated stories remain in your library until you delete them or close your account.
- You can request deletion of your account and personal data at any time by emailing privacy@lullabystories.app.
5. Security
We use industry-standard safeguards including encryption in transit (HTTPS), encryption at rest, row-level access controls in our database, and least-privilege access for staff. No system is perfectly secure, and we cannot guarantee absolute security.
6. Your rights — California (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what categories of personal information we collect, the sources, the purposes, and the categories of third parties we share it with.
- Access a copy of the specific personal information we hold about you.
- Correct inaccurate personal information.
- Delete your personal information, subject to legal exceptions.
- Limit the use of sensitive personal information.
- Opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, so there is nothing to opt out of, but you can confirm this at any time by emailing us.
- Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised any of these rights.
Categories of personal information collected in the past 12 months:identifiers (name, email, account ID), commercial information (subscription and purchase history), internet activity (log data, device info), and user content (story prompts you submit). We do not knowingly collect sensitive personal information beyond account credentials and payment tokens handled by Stripe.
To exercise any right, email privacy@lullabystories.app from the account address. We will verify your request and respond within 45 days. You may also designate an authorized agent to make a request on your behalf.
7. Your rights — EEA, UK, and Switzerland (GDPR)
For users in the European Economic Area, the United Kingdom, and Switzerland,[Your Company Legal Name, LLC] is the data controller for your personal data. Our legal bases for processing are:
- Contract — to provide the Service you signed up for (generating stories, maintaining your account, processing payments).
- Legitimate interests — to secure the Service, prevent abuse, debug issues, and improve features, balanced against your privacy.
- Consent — for optional analytics cookies and for marketing email (you can withdraw consent at any time).
- Legal obligation — to comply with tax, accounting, and law-enforcement requirements.
You have the right to:
- Access, rectify, or erase your personal data.
- Restrict or object to processing based on legitimate interests.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time without affecting prior lawful processing.
- Lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority). For the UK, that is the Information Commissioner's Office.
International data transfers: Lullaby is operated from the United States. When we transfer personal data from the EEA, UK, or Switzerland to the U.S. or to our sub-processors, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) as the transfer mechanism.
Retention: we keep account data for as long as your account is active and for up to 24 months after closure for tax, dispute-resolution, and abuse-prevention purposes. Generated stories are kept until you delete them or close your account. Log and security data is retained for up to 12 months.
8. International users
If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection laws than your country.
9. Cookies
We use strictly necessary cookies for authentication and session management, and optional analytics cookies to understand aggregate usage. The first time you visit, you'll see a cookie banner letting you accept analytics or use essential-only cookies. You can change your choice at any time by clearing site data in your browser. We do not use advertising or cross-site tracking cookies, and we never use cookies to profile children.
10. Changes to this policy
We will post the updated policy here with a new "Last updated" date and, for material changes, notify you by email or in-app message.
11. Contact
[Your Company Legal Name, LLC]
[Street Address, City, State ZIP], USA
Privacy contact: privacy@lullabystories.app