Privacy Policy

1. Introduction

This Privacy Policy explains how ParentTales ("we", "us", or "our") collects, uses, and protects your personal data when you use our service available at parenttal.es (the "Service").

We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

The data controller responsible for your personal data is:

Contact email: [email protected]

3. Data We Collect

We collect and process the following categories of personal data:

3.1. Account Data

• Email address
• Name

3.2. Voice Data

• Voice recordings for creating your voice profile
• Voice models generated from your recordings

3.3. Children's Data

• Children's names
• Children's ages
• Preferences for story personalization (themes, genres)

3.4. Technical Data

• IP address
• Browser type and device information
• Usage data and analytics

4. How We Use Your Data

We process your personal data for the following purposes:

Purpose	Legal Basis
Providing access to the Service	Contract performance
Creating and training voice models	Consent
Generating personalized stories	Contract performance
Processing payments	Contract performance
Customer support	Legitimate interest
Optional public-site analytics	Consent, which you may withdraw at any time
Sending service notifications	Contract performance
Legal compliance	Legal obligation

5. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Consent — for processing voice recordings and children's data. You can withdraw consent at any time.
• Contract performance — necessary to provide the Service you have requested.
• Legitimate interests — for improving our Service, security, and fraud prevention.
• Legal obligation — to comply with applicable laws and regulations.

6. Data Storage and International Transfers

Your personal data may be stored and processed in the following locations:

• European Union — for users outside Russia
• Russian Federation — for Russian users (as required by Russian data localization laws)

When we transfer data outside the EU/EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Transfers to countries with adequate data protection levels
• Explicit consent for specific transfers

7. Third-Party Services

We share your data with the following third-party service providers:

Service	Purpose	Location	Data Shared
Kinde	Authentication	Australia/EU	Email, name
Fish Audio	Text-to-speech, voice cloning	USA	Voice recordings
Google (Gemini)	AI story generation	USA	Story prompts, preferences
Google Analytics	Optional public-site analytics after consent	USA	Page views, access-link placement, campaign labels, browser/device data and cookie identifiers; network requests disclose your IP address to Google
Robokassa	Payment processing	Russia	Payment information

8. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access — obtain a copy of your personal data
• Right to rectification — correct inaccurate personal data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — limit how we use your data
• Right to withdraw consent — withdraw consent at any time for consent-based processing

To exercise your rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority in your country of residence.

9. Children's Data

Our Service is designed for parents and legal guardians to create stories for their children. We do not collect personal data directly from children under 16 years of age.

Information about children (names, ages, preferences) is provided by parents or legal guardians and is used solely for personalizing stories.

Parents or legal guardians are responsible for providing information about their children and may request its deletion at any time.

If you believe we have collected data from a child without parental consent, please contact us immediately.

10. Cookies and Public-Site Analytics

On parenttal.es and its public legal pages, Google Analytics 4 is optional and runs only when configured and after you choose Accept analytics. Before acceptance, or after rejection, this integration does not load the Google tag or send analytics requests. Browsing the site or accepting an older cookie notice does not grant analytics consent.

We measure page views and clicks on request-access links, including the link’s fixed placement (navigation, hero, pricing plan, or final call to action). We send the canonical page address, standard non-personal campaign labels when present, and only the referring site’s origin. We do not send arbitrary URL parameters, URL fragments, form contents, names, email addresses, voice recordings, child data, or account identifiers through this integration. Campaign links must not contain personal information.

Google also processes cookie identifiers and browser/device information; connections to Google disclose your IP address. This measurement is not anonymous. Advertising storage, advertising personalization, and Google signals are disabled. Automatic enhanced-measurement interactions are disabled for this integration.

Your choice is stored in this browser under parenttales_analytics_consent_v1 in local storage until you change it or clear site data. Analytics cookies use the pt_landing prefix, are limited to this hostname, and expire after at most 180 days without extending their lifetime on each visit. If browser storage is unavailable, your choice applies to the current page and may need to be made again.

Use Cookie settings on any public page to accept or reject analytics at any time. Rejection stops subsequent collection and removes this integration’s analytics cookies, even if saving the choice fails. Withdrawal does not erase data already sent; contact us to exercise applicable data rights. Analytics consent here does not grant consent on the separate access/authentication site or in the app, where necessary authentication and session cookies may be used.

11. Data Retention

We retain your personal data for the following periods:

• Account data — duration of account activity plus 3 years after deletion
• Voice data — duration of account activity, deleted upon request
• Children's data — duration of account activity
• Payment records — 7 years (legal requirement)
• Usage logs — 90 days

12. Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS/SSL)
• Encryption at rest
• Access controls and authentication
• Regular security assessments
• Incident response procedures

Despite our efforts, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new policy on our website
• Sending an email notification
• Displaying a notice in the Service

Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

For any questions about this Privacy Policy or our data practices, please contact us:

Effective Date: January 19, 2026
Public-site analytics update: September 10, 2026