Your privacy matters to us — especially when it comes to your children. This policy explains what data we collect, why we collect it, how we use it, and what rights you have over it.
We've written this in plain English because we'd rather you understand it than skim past a wall of legal text. If anything is unclear, please email us at support@luanastales.com.
1. Who We Are
Luana's Tales is a digital service that creates AI-generated, personalised bedtime stories for children. We are the data controller for the personal information collected through our website and app.
For any privacy-related enquiries, you can contact us at:
Luana's Tales — support@luanastales.com
We are based in the United Kingdom and comply with the UK GDPR and, where applicable, the EU GDPR.
2. What Data We Collect
We collect only the information we need to run the service. Here's what that looks like:
- Account information: Your email address and password (stored securely via Supabase Auth).
- Subscription status: Whether you are on a free trial, active plan, or have cancelled — managed via RevenueCat.
- Child profile data: Names, ages, favourite things, and any preferences you enter when creating a child profile. You provide this voluntarily so we can personalise stories.
- Voice & accent preferences: The narration style you select for each story session.
- Generated stories: The stories we create for you, stored in your personal library so you can replay them.
- Usage data: Basic information about how you use the app (e.g. pages visited, features used) to help us improve the service. This is non-identifying aggregate data.
- Payment data: We do not store your full card details. Payment information is handled directly by Stripe and RevenueCat, both of which are PCI-DSS compliant.
3. How We Use Your Data
We use your data to provide and improve the service. Specifically:
- Delivering the service: We use your child profile information to generate personalised stories via the Google Gemini API and to narrate them with AI voices.
- Account management: We use your email address to send you account-related emails — such as confirmation, password reset, and subscription updates. We do not send marketing emails without your explicit consent.
- Processing payments: We share the minimum necessary information with Stripe and RevenueCat to process your subscription and handle billing.
- Improving the service: Anonymous, aggregated usage data helps us understand how people use Luana's Tales so we can make it better.
- Customer support: If you contact us, we'll use your information to help resolve your enquiry.
We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in this policy.
4. Data Retention
We keep your data for as long as your account is active or as needed to provide the service. Specifically:
- Account data: Retained until you delete your account.
- Child profiles and generated stories: Retained until you delete them or delete your account.
- Payment records: Retained for 7 years as required by UK tax and accounting law.
- Support correspondence: Retained for up to 2 years after the enquiry is resolved.
When you request account deletion, we will remove your personal data within 30 days, except where retention is required by law.
5. Third-Party Services
To run Luana's Tales, we work with a small number of trusted third-party providers. Each has been selected for its privacy standards and security practices:
Each of these providers operates under their own privacy policy and complies with applicable data protection laws. We have data processing agreements in place with our key providers as required under UK GDPR.
6. Children's Data
We take the privacy of children very seriously. Luana's Tales is designed to be used by parents and guardians on behalf of their children. We do not knowingly collect personal data directly from children under the age of 13.
When you create a child profile, you — the adult account holder — are entering that information on your child's behalf. The information you provide (such as your child's name, age, and interests) is used solely to personalise their stories. It is not shared with third parties for marketing or any other commercial purpose.
We do not send marketing communications to children. We do not build advertising profiles based on children's data.
If you discover that a child has created an account independently or provided personal data without your knowledge, please contact us at support@luanastales.com and we will delete the relevant data promptly.
7. Your Rights (GDPR)
Under the UK GDPR (and EU GDPR where applicable), you have the following rights in relation to your personal data:
- AccessRequest a copy of the personal data we hold about you.
- RectificationAsk us to correct any inaccurate or incomplete data.
- ErasureRequest that we delete your personal data ("right to be forgotten").
- PortabilityReceive your data in a structured, machine-readable format.
- RestrictionAsk us to limit how we process your data in certain circumstances.
- ObjectionObject to processing based on legitimate interests.
- Withdraw ConsentWhere processing is based on consent, withdraw it at any time.
To exercise any of these rights, email us at support@luanastales.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8. Cookies
Luana's Tales uses a minimal number of cookies — only those necessary for the service to function correctly. Specifically:
- Session cookies: Used to keep you logged in during your browsing session. These expire when you close your browser.
- Authentication tokens: Stored in secure, HttpOnly cookies to maintain your logged-in state between sessions.
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not use cookies for profiling or behavioural targeting.
You can control cookies through your browser settings, though disabling essential cookies may prevent the app from working correctly.
9. Security
We take the security of your data seriously and implement appropriate technical and organisational measures to protect it. These include:
- All data is transmitted over HTTPS using TLS encryption
- Passwords are never stored in plain text — they are hashed and salted by Supabase Auth
- Database access is restricted using row-level security policies
- Payment card data is never transmitted to or stored on our servers — it goes directly to Stripe
- We regularly review our security practices and apply updates promptly
No system is 100% secure. If you believe your account has been compromised, please contact us immediately at support@luanastales.com.
10. Contact & Data Controller
Luana's Tales is the data controller for the personal information processed through this service. If you have any questions about this Privacy Policy or how your data is handled, please contact us:
Luana's Tales
Email: support@luanastales.com
We aim to respond to all privacy-related enquiries within 5 business days.
If you have a complaint about how we have handled your personal data and are not satisfied with our response, you can contact the Information Commissioner's Office (ICO): ico.org.uk/concerns