Privacy Policy

1. Introduction

Petit Tales ("we," "us," or "our") is operated by Eduardo Javier Serra Lenti. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered bedtime story application available at www.petittales.com and through our mobile applications on the Apple App Store and Google Play Store (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

Contact Information:
Email: support@petittales.com

2. Information We Collect

We collect the following categories of personal information:

2.1 Account Information

• Email address - for account creation and communication
• Password - stored in encrypted (hashed) form

2.2 Child Profile Information

When you create a profile for your child, we collect:

• Child's first name - for story personalization
• Child's age (1-12 years) - for age-appropriate content
• Interests (up to 10) - for story theme customization

Important: Child profile information is provided exclusively by parents or legal guardians. Children under 13 do not directly provide personal information to us.

2.3 Family Member Information

• Family member names and email addresses - for chapter notification emails
• Notification preferences - opt-in/opt-out settings

2.4 Payment Information

Payment processing is handled by Paddle.com Market Limited ("Paddle"), our Merchant of Record. We do not store credit card numbers or banking information. We receive:

• Customer ID and email (from Paddle)
• Subscription status and history
• Transaction records

2.5 Usage and Technical Data

• Device information and browser type
• IP address
• Pages viewed and features used
• Session duration and interactions

3. Children's Privacy (COPPA Compliance)

All child profile information (name, age, interests) is provided by the parent or legal guardian. By creating a child profile, you represent and warrant that:

• You are the parent or legal guardian of the child;
• You consent to our collection and use of your child's information as described in this Privacy Policy;
• You have read and agree to these terms on behalf of your child.

3.1 Parental Rights Under COPPA

As a parent or guardian, you have the right to:

• Review your child's personal information we have collected
• Request deletion of your child's personal information
• Refuse further collection of your child's information
• Withdraw consent at any time

To exercise these rights, contact us at support@petittales.com. We will respond within 30 days.

3.2 How We Use Children's Information

• Generating personalized AI stories appropriate for the child's age
• Maintaining story continuity across chapters
• We do NOT use children's information for behavioral advertising
• We do NOT sell children's personal information

3.3 Data Retention for Children's Information

We retain child profile information only as long as necessary to provide the Service. Upon account deletion or parent request:

• Child profile information is deleted within 30 days
• Associated story content is deleted within 30 days
• Backup copies are purged within 90 days

4. Your Rights Under GDPR (EU Users)

If you are located in the European Economic Area (EEA), you have the following rights:

4.1 Lawful Basis for Processing

• Contractual necessity: Account creation, story generation, service delivery
• Legitimate interest: Analytics, service improvement
• Consent: Email notifications to family members, marketing communications (if any)

4.2 Your Data Subject Rights

• Right of access - Request copies of your personal data
• Right to rectification - Request correction of inaccurate data
• Right to erasure - Request deletion of your data ("right to be forgotten")
• Right to restriction - Request limitation of processing
• Right to data portability - Request transfer of your data
• Right to object - Object to certain processing activities
• Right to withdraw consent - Withdraw consent at any time

4.3 Children's Data Under GDPR

For users in the EEA, if you provide information about a child under 16 years of age, you represent that you hold parental responsibility and consent to the processing of the child's data as described herein. Individual EU Member States may have set a lower age threshold (but not below 13).

4.4 International Data Transfers

Your data may be transferred to and processed in:

• United States (Supabase, Anthropic, Vercel)
• United Kingdom (Paddle)

We rely on Standard Contractual Clauses and/or adequacy decisions for lawful international transfers.

5. Third-Party Service Providers

We share information with the following service providers:

5.1 Supabase

Purpose: User authentication and data storage

Data shared: Account information, child profiles, stories

Privacy policy: https://supabase.com/privacy

5.2 Anthropic (Claude AI)

Purpose: AI story generation

Data shared: Child name, age, and interests (for story prompts only)

Privacy policy: https://www.anthropic.com/privacy

5.3 Paddle (Payment Processing)

Purpose: Subscription billing and payment processing (Merchant of Record)

Data shared: Email, customer ID, payment information

Privacy policy: https://www.paddle.com/legal/privacy

5.4 Resend (Email)

Purpose: Chapter notification emails to family members

Data shared: Family member names and email addresses

Privacy policy: https://resend.com/legal/privacy-policy

5.5 Vercel (Hosting and Analytics)

Purpose: Application hosting and performance analytics

Data shared: Technical data, usage patterns

Privacy policy: https://vercel.com/legal/privacy-policy

6. Cookies and Tracking Technologies

6.1 Essential Cookies

We use essential cookies for:

• Authentication session management
• Security tokens

6.2 Analytics

We use Vercel Analytics to understand usage patterns. This collects anonymized data about page views and session duration.

6.3 No Third-Party Advertising

Petit Tales does NOT use third-party advertising cookies or trackers. We do NOT sell your personal information to advertisers.

7. Data Security

We implement appropriate technical and organizational measures to protect your information:

• HTTPS encryption for all data in transit
• Encrypted storage at rest
• Secure authentication via Supabase Auth
• No storage of raw payment card data (handled by Paddle)
• Access controls and role-based permissions

7.1 Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you via email within 72 hours of becoming aware of the breach, as required by applicable law.

8. Your Rights and Choices

8.1 Account Management

• Update your profile information via Settings
• Delete your account via Settings
• Request data export by contacting us

8.2 Communication Preferences

• Family members can opt in/out of chapter notifications
• Manage preferences via the Family settings page

8.3 Contact for Privacy Inquiries

Email: support@petittales.com
Response time: Within 30 days

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Right to know - Request disclosure of information collected about you
• Right to delete - Request deletion of your personal information
• Right to opt-out of sale - We do NOT sell personal information
• Right to non-discrimination - Equal service regardless of privacy choices

Do Not Sell My Personal Information: Petit Tales does NOT sell personal information to third parties.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new Privacy Policy on this page
• Sending an email notification to your registered email address
• Displaying a prominent notice in the app

Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: support@petittales.com
Operator: Eduardo Javier Serra Lenti