1. Controller
The personal-data controller is AVATARLAND Sp. z o.o., ul. Trybunalska 46, 60-325 Poznań, Polska, KRS 0000099765, NIP 7792167451, REGON 634272390.
Contact us about data protection at gdpr@tales4kids.ai. This is a dedicated GDPR contact address and does not by itself mean that a formal Data Protection Officer has been appointed.
2. Data we collect
- Wallet data: email, language, verification status, Credit balance and transaction history;
- form and output data: character name or nickname, description, companion, place, lesson, generated text, images and audio;
- activity data: generation identifier and status, rating, reward information, social platform and a hash of the published-post link;
- payment data: package, amount, currency, payment status and transaction ID; full card details are handled by the payment provider, not the Service;
- technical data: encrypted IP and IP hash, approximate country, city and coordinates from a local GeoLite2 database, timestamps, error logs and a hashed browser identifier;
- acceptance evidence: document versions and hashes, language, time, IP hash and user-agent hash;
- communications: support, complaint and data-rights correspondence.
3. Children’s data
The Service is for adults and does not invite children to open accounts. An adult may provide a child’s first name or nickname and neutral plot details if authorised.
Do not provide a surname, address, school, contact details, photographs, identifiers or special-category data such as health, disability, ethnicity, religion or sexuality. Contact us if such data was submitted.
Incidental child data is processed to fulfil the adult’s request on the basis of the legitimate interest of the Controller and User in creating the requested safe Story, with data minimisation and short retention.
4. Purposes and legal bases
- Wallet creation, email verification, Story, image and narration generation, delivery, Credits and payment – contract performance or pre-contract steps (GDPR Art. 6(1)(b));
- moderation, abuse prevention, account protection, diagnostics, logs, cost control and security – legitimate interests (Art. 6(1)(f));
- approximate geographic and product statistics, ratings and reliability improvement without using story content for marketing – legitimate interests (Art. 6(1)(f));
- measurement of site visits and performance through Cloudflare Web Analytics – consent (Art. 6(1)(a)), which can be withdrawn at any time in Cookie settings;
- complaints, legal claims and acceptance evidence – contract, legal obligation and legitimate interest in legal defence (Art. 6(1)(b), (c) and (f));
- accounting and tax records – legal obligation (Art. 6(1)(c));
- transactional Wallet and Story emails – contract performance; no newsletter or marketing is sent without a separate legal basis.
5. Use of artificial intelligence
Form data is sent through secured APIs to OpenAI for moderation and text generation. Story and scene descriptions may be sent to Google Gemini for images. Only after the narration button is pressed are the title and Story sent to ElevenLabs for speech synthesis.
Providers act as processors or, for limited security and operational data, independent controllers under their terms. We use business/API services. OpenAI does not train on API data by default; Google’s EEA rules apply paid-service data treatment; ElevenLabs may retain data under its DPA and account settings.
AI automatically checks whether a request is child-appropriate and properly uses the form. Refusal has no legal or similarly significant effect under GDPR Art. 22. Suspected errors may be sent to info@tales4kids.ai.
6. Recipients and suppliers
We do not sell personal data or share child data with advertisers. IP geolocation is performed locally with GeoLite2 and not by sending IPs to an external geolocation API.
- dhosting.pl – application, database and file hosting;
- OpenAI – moderation and text generation;
- Google Gemini – illustration generation;
- ElevenLabs – optional user-triggered speech synthesis;
- Mailjet / Sinch Email – transactional email;
- Cloudflare Web Analytics – visit and performance statistics after consent;
- Stripe and payment-system participants – payment processing when enabled;
- IT support, accountants, legal advisers and authorised public bodies – only where necessary and lawful.
7. Transfers outside the EEA
Some technology providers may process data in the United States or other countries outside the EEA. Transfers rely on an adequacy decision such as the EU–US Data Privacy Framework, or European Commission Standard Contractual Clauses with supplementary safeguards where required.
Ask gdpr@tales4kids.ai for information on the current transfer mechanism or safeguards. Security or trade-secret information may be redacted.
8. Retention periods
- form data, Story title and text, images, audio, error content and encrypted raw IP – up to 30 days, then deleted or anonymised;
- an unverified Wallet and related requests – up to 30 days unless a payment or legal retention duty exists;
- Wallet email, balance, Credit history and core operational data – while the Wallet is used and, after deletion is requested, as needed to close matters and defend claims, generally no longer than 6 years;
- pseudonymised IP hash, approximate location, status, timestamps, usage, cost and rating data – until Wallet deletion or the legitimate statistical, security and accounting purpose ends, then deleted or aggregated;
- acceptance evidence and complaints – for the agreement and limitation period, generally up to 6 years;
- payment and tax records – as required by law, usually 5 years after the relevant tax year;
- technical logs – normally up to 90 days, or longer where needed for an incident or legal claim;
- Cloudflare Web Analytics data – raw data for up to 7 days and aggregated statistics for up to 6 months, under the supplier’s policy;
- supplier-held data – according to our agreements, security settings and suppliers’ legal duties.
10. Your rights
Send requests to gdpr@tales4kids.ai. We may verify control of the Wallet email to prevent unauthorised disclosure. We respond without undue delay, generally within one month.
- access to personal data and a copy;
- rectification and completion;
- erasure where legal conditions apply;
- restriction of processing;
- portability of contract-based data where applicable;
- objection to legitimate-interest processing on grounds relating to your situation;
- withdrawal of consent at any time where a specific activity is consent-based, without affecting earlier lawfulness;
- a complaint to the President of the Polish Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl, or the authority in your habitual-residence country.
11. Security
We use risk-appropriate measures including HTTPS, access controls, encryption of selected fields, token and IP hashing, rate limits, backups, error logging and scoped API permissions.
No system is absolutely secure. Protect your email and device and do not share magic links. Report suspected incidents to gdpr@tales4kids.ai.
12. Sources and third-party data
Data comes from the User, their device, the payment provider and Service operation. A User submitting another person’s data, including child data, must have a lawful basis and make this notice available to that person or guardian as appropriate.
We do not intentionally obtain child data from brokers or public sources. Approximate location is derived from IP through a local GeoLite2 database.
13. Policy changes
This Policy may change due to law, technology, suppliers or functions. The current version always shows a number and effective date. Material changes to rights or data use will be announced in the Service or by email.
Where a new purpose requires consent, we will request it separately. Silence is not consent.
Data protection contact
Questions, requests and objections concerning personal data may be sent to gdpr@tales4kids.ai or by post to the Controller.
gdpr@tales4kids.ai