Privacy Policy

Last updated: November 5, 2026

1. Data Controller

Welink Tech SAS, publisher of StoryLoop, located at 6 Rue des Bateliers, 92110 Clichy, France (contact: contact@storyloopkids.com / privacy@storyloopkids.com).

2. Collected Data

• Parent account: Email address (authentication managed securely via Supabase Auth).
• Child profiles: First name and age (stored strictly in your private family space, never shared or sold).
• Parent voice sample: 20-second audio recording used exclusively for private voice modeling. Stored encrypted on Cloudflare R2 (EU region). Deletable at any time with 1 click from the parent space.
• Generated stories: Audio files and scripts, accessible solely by the authorized parent account.

3. Legal Basis

Explicit consent (GDPR Article 6.1.a) for parental voice modeling. Contract performance (Article 6.1.b) for story generation and delivery.

4. Children's Privacy (COPPA & GDPR-K)

StoryLoop does not collect personal identifiers directly from children. Child profiles are managed exclusively by verified parent accounts. No advertising, profiling, or behavioral tracking is conducted on children.

5. Sub-processors & Sovereignty

• Supabase Inc.: Encrypted database & authentication (EU servers in Frankfurt, Germany).
• Cloudflare Inc.: Edge CDN and encrypted audio storage via Cloudflare R2 (ISO 27001 / SOC 2).
• Fish Audio: Voice synthesis engine processing private family models.
• Google Cloud Vertex AI: Safe narrative generation model (receives only first name, age, plushie and positive bedtime topic).
• Stripe Inc.: PCI-DSS Level 1 payment processing. No payment card details touch StoryLoop servers.

6. Data Retention & Rights

Under GDPR and international privacy regulations, you have the right to access, rectify, export, or delete all family data at any time. To exercise your rights, email privacy@storyloopkids.com. Deletion requests are fulfilled within 48 hours.