1. Who We Are
Bedtime Stories by Luma is operated by a sole proprietor registered in Portugal. We are the data controller for your personal information.
Contact: hello@bedtimestoriesbyluma.com
2. What Data We Collect
Account Data
- Email address (for authentication and communication)
- Display name (optional)
- Authentication data (managed by Supabase Auth)
Story Creation Data
- Child's name, age, and gender (as provided by you for story personalization)
- Story preferences (theme, mode, language)
- Hero customization choices (personality, appearance)
Children's Photos
- Photos are uploaded voluntarily by parents/guardians for AI character generation.
- Photos are stored in encrypted, private storage accessible only to the uploading user.
- Photos are automatically deleted after story generation is complete.
- Photos are never shared with third parties, used for training, or stored long-term.
- During generation, photos are accessed via time-limited signed URLs (2-hour expiry).
Payment Data
- Payment processing is handled entirely by Stripe. We do not store credit card numbers.
- We store: transaction ID, package purchased, credits added, and amount paid.
Technical Data
- Browser type, device information (for compatibility)
- Usage analytics (pages visited, features used)
- Error logs (for debugging and service improvement)
3. How We Use Your Data
- Story generation: Your inputs (name, theme, photo) are processed by AI to create personalized content.
- Account management: Authentication, credit balance, story history.
- Payment processing: Handled by Stripe to fulfill purchases.
- Service improvement: Pseudonymized usage data (linked to internal IDs, not names or emails) helps us improve quality and performance.
- Communication: Service notifications (story ready, account updates). No marketing without consent.
4. Legal Basis (GDPR)
- Contract performance: Processing data to deliver the story generation service you purchased.
- Legitimate interest: Service improvement, fraud prevention, security.
- Consent: Optional marketing communications, cookie preferences.
- Legal obligation: Tax records, fraud prevention.
5. Third-Party Services
We use the following third-party services that may process your data:
- Supabase (EU region) — Authentication, database, file storage
- Stripe (USA/EU) — Payment processing
- Google Gemini AI — Story text generation (text prompts only, no photos sent)
- Kie.ai / ByteDance Seedream — Illustration generation (processes the uploaded photo once to draw the cartoon hero, then works only with generated artwork)
- Kie.ai / ByteDance Seedance — Video generation, including narration voice and music (uses generated AI illustrations, never the photo)
Important: Your child's photo is processed only by our illustration AI to create the cartoon-style hero. The original photo is never sent to the video model or any other service — only the generated cartoon artwork is animated. Narration and music are created inside the video model itself, not by separate voice or music services.
6. Data Retention
- Account data: Retained while your account is active. Deleted upon account deletion request.
- Generated stories: Retained until you delete them or your account.
- Children's photos: Automatically deleted after story generation completes. In rare cases where generation fails, photos are deleted within 24 hours.
- Payment records: Retained for 7 years (Portuguese tax law requirement).
- Analytics data: Pseudonymized (internal IDs only, no personal details) and retained for up to 2 years.
7. Your Rights (GDPR)
As an EU resident, you have the right to:
- Access — Request a copy of your personal data.
- Rectification — Correct inaccurate data.
- Erasure — Request deletion of your data ("right to be forgotten").
- Portability — Receive your data in a machine-readable format.
- Restriction — Limit how we process your data.
- Objection — Object to data processing based on legitimate interest.
- Withdraw consent — For consent-based processing, at any time.
To exercise any of these rights, email us at hello@bedtimestoriesbyluma.com. We will respond within 30 days.
8. Children's Privacy
We do not knowingly collect personal data from children under 16. The Service is designed for use by adults (parents, guardians) who create stories about their children. If you believe a child has provided us with personal data directly, please contact us immediately.
9. Security
- All data transmitted via HTTPS encryption.
- Children's photos stored in private, access-controlled storage with signed URLs.
- Database with row-level security (users can only access their own data).
- Payment data handled exclusively by PCI-DSS compliant Stripe.
- Regular security audits and monitoring.
10. Cookies
See our Cookie Policy for details on how we use cookies.
11. Changes
We may update this policy from time to time. Significant changes will be communicated via email to registered users.
12. Contact & Complaints
Email: hello@bedtimestoriesbyluma.com
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) or the supervisory authority in your EU member state.