Privacy Notice

1. Who we are

MyStoryMail (“we”, “us”) operates the personalized bedtime story service at mystorymail.ai. We are the data controller for personal data processed through the Service. Questions about this Privacy Notice may be sent to hello@mystorymail.ai.

2. Data we collect

We collect only what is necessary to run the Service:

• Parent account data: your email address, name, and password (stored as a secure hash — we never see the plaintext).
• Child profile data (provided by the parent): a child's first name, age, interests, chosen story language and delivery time, and optionally a brief appearance description used to guide illustrations. We do not collect children's email addresses, phone numbers, photos, location, or any contact information.
• Generated stories: the text, illustrations and audio narrations created for your family, stored in your story archive.
• Usage data: standard server logs (IP address, browser type, pages visited, timestamps) used for security and debugging.
• Payment data: handled entirely by Stripe or Paystack. We receive a payment confirmation and subscription status only. We never see or store card numbers, bank details, or full payment information.

3. How we use your data

• Story generation: child profile data is sent to our AI models to generate personalized stories.
• Story delivery: your email address is used to send stories at your scheduled time.
• Billing: your email and subscription status are used to manage your account with our payment processors.
• Service communications: we may send transactional emails (receipts, important notices). We do not send marketing emails without your explicit opt-in.
• Safety and security: usage data helps us detect abuse, enforce our Terms, and maintain the Service.

4. Children's privacy and COPPA

MyStoryMail is designed to be conscious of the U.S. Children's Online Privacy Protection Act (COPPA), the EU's GDPR-K, and South Africa's POPIA:

• Children are not our users — parents are. All accounts require an adult email address. Children never interact with the Service directly.
• All child data is provided by the parent and used solely to personalize stories. We do not collect child contact information, photos, precise location, or behavioral data.
• We do not serve advertising to children and we do not sell, share, or use child data for any commercial purpose other than generating their personalized stories.
• Parents may view, update, or permanently delete any child profile at any time from their dashboard. Deleting a child profile permanently deletes all stories associated with that profile.
• We do not knowingly allow children under 13 to create accounts. If we discover a child has created an account directly, we will delete it promptly.

5. Legal bases for processing

Where GDPR or POPIA applies, we process personal data on the following bases:

• Contract: processing your account data, child profile data, and payment data to deliver the Service you have subscribed to.
• Legitimate interests: security logging and abuse prevention.
• Legal obligation: retaining billing records as required by applicable tax law.
• Consent: optional marketing emails (where you have opted in).

6. Subprocessors

We share data with the following trusted subprocessors, each of which receives only the minimum data required for its function:

7. Retention and deletion

We retain your data for as long as your account is active. If you close your account, all personal data (account information, child profiles, and generated stories) is permanently deleted within 30 days, except where we are required to retain billing records by law (typically 5–7 years). You can delete individual child profiles, and all associated stories, at any time from your dashboard without closing your account.

8. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: obtain a copy of the data we hold about you.
• Correction: request that inaccurate data be corrected.
• Deletion: request erasure of your personal data.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Restriction: request that we limit processing in certain circumstances.

To exercise any of these rights, email hello@mystorymail.ai. We respond within 30 days, usually much faster. You may also have the right to lodge a complaint with your local data protection authority.

9. Cookies

We use essential session cookies only — to keep you logged in and to protect against cross-site request forgery. We do not use advertising cookies, analytics cookies from third parties, or tracking pixels. No cookie consent banner is required because we use only strictly necessary cookies.

10. Security measures

We use industry-standard security measures including TLS encryption in transit, bcrypt password hashing, and access controls limiting which team members can access production data. No system is perfectly secure; in the event of a data breach affecting your personal data we will notify you as required by applicable law.

11. International transfers

Your data may be processed in countries outside your own, including the United States, where our subprocessors are based. We ensure appropriate safeguards are in place (such as Standard Contractual Clauses for EU data) where required by law.

12. Changes to this Notice

We may update this Privacy Notice from time to time. We will post changes here and update the “Last updated” date. For material changes we will notify you by email.

13. Contact

Privacy questions: hello@mystorymail.ai
General: hello@mystorymail.ai
MyStoryMail · mystorymail.ai