Privacy Policy

StoryTales ("we", "us") creates personalized, AI-illustrated children's books at storytales.art. This policy explains what we collect, why, and your choices. Contact: privacy@storytales.art.

Your child's photo

You upload a photo of your child so our app can describe their appearance (hair, eyes, style) for illustration. The photo is transmitted securely to our servers and forwarded to our AI provider — Google Gemini, and/or fal.ai, depending on which illustration engine generates your book — both to generate the appearance description and, for each illustrated scene, as a reference so your child's likeness stays consistent across the book. Which engine runs is set by the app (an engine picker is available in some cases, but the operating engine can also be set at the platform level) — it is not always the same as whichever option may be shown as selected on screen. We do not write the photo itself to our database. What we store is the resulting text appearance description and the AI-generated illustrations — never the original photo. We do not build face-recognition profiles, and we do not sell or share your child's photo.

What we collect

• Account data: email, name, password (hashed), login records.
• Book data: child's first name, age bracket, the text appearance description, story choices, and your generated books.
• Purchase data: plan, token balance and usage; payments are processed by Lemon Squeezy (our merchant of record) — we never see or store card numbers.
• Technical data: basic logs (IP, browser, errors) for security and debugging. We don't use advertising trackers.

AI providers we use

Story text and image work run on Google Gemini (paid API tier — Google does not use our data to train its models) and, optionally, fal.ai. When the fal.ai engine is used, it receives AI-generated illustrations and text scene descriptions as part of generating your book; any anonymized usage data a provider may derive from these inputs contains no biometric face-recognition data, since neither provider builds a face-matching profile from what we send. Hosting and data storage: Vercel and Supabase. Emails: our email delivery provider. These providers process data only to provide the service.

Why we process (legal bases)

To provide the service you asked for (contract); to secure and improve it (legitimate interest); marketing emails only with your consent (opt-out anytime); to meet legal obligations (tax, accounting).

Children

StoryTales is for parents and guardians. Accounts are for adults (18+). By uploading a photo you confirm you are the child's parent or legal guardian and consent to the processing described here. We never knowingly deal with children directly.

Retention & deletion

Your books and account data stay while your account is active. Delete a book, and it's gone from your library; delete your account, and we erase your personal data within 30 days except what tax law requires us to keep (purchase records, 7 years). Appearance descriptions are deleted with the books that use them.

Your rights

Access, correct, delete, or export your data; object to or restrict processing; withdraw consent. Israeli Privacy Protection Law and, where applicable, GDPR rights apply. Write to privacy@storytales.art; we answer within 30 days. You may also complain to the Israeli Privacy Protection Authority or your local EU authority.

Security

Encryption in transit, hashed passwords, role-restricted database access, audit-logged admin actions, and multi-factor authentication for administrative access. No system is perfect; if a breach affects you, we'll notify you and regulators as the law requires.

International transfers

Our infrastructure providers may process data outside Israel/the EEA (e.g., the US, Singapore) under their standard contractual safeguards.

Changes

We'll post changes here and, for material changes, email you. Continued use after the effective date means acceptance.