Privacy Policy

Last updated: July 2026

This policy explains how we collect, use, store, and protect your family's data when you use our service.

1. Information We Collect

We collect only the information needed to provide personalised bedtime stories: your email address (for account creation), your child's first name or nickname and age, the emotions and situations you share to personalise each story, and any optional preferences you provide (favourite animals, interests, friends' names, bedtime challenges). We never ask for or store your child's full legal name.

Billing information: Payment processing is handled entirely by Stripe. We do not store your full payment card details on our servers. Stripe collects and processes payment information in accordance with its own privacy policy.

2. How We Use Your Data

Your data is used solely to generate personalised stories, improve our service, and send you the content you've requested. We never sell or share personal information with third parties for marketing purposes.

3. Lawful Basis for Processing

We process your data under the following lawful bases under UK GDPR:

• Consent (Article 6(1)(a)): You, as the parent or legal guardian, provide consent for us to process your child's name, age, emotional context, and personalisation preferences to generate stories. You may withdraw this consent at any time by deleting the relevant data from your account or by contacting us.
• Contract (Article 6(1)(b)): We process your email address, account details, and billing information as necessary to provide the subscription service you have purchased.
• Legitimate Interest (Article 6(1)(f)): We process anonymised usage data for service improvement and analytics, where this does not override your or your child's rights and freedoms.

4. Children's Privacy & Verifiable Parental Consent

SootheStories is designed for children but is controlled entirely by their parents or guardians. We comply with the UK Children's Code (Age Appropriate Design Code) under the Data Protection Act 2018, and with the U.S. Children's Online Privacy Protection Act (COPPA) where applicable. We do not collect personal information from children directly — all data is provided by the parent or guardian who creates and manages the account.

Account creation requires an adult, verified through Stripe's payment verification process at the point of trial or subscription signup. This card-based verification is recognised under COPPA as a valid method of obtaining verifiable parental consent (16 CFR § 312.5(b)(2)). The parent or guardian controls what information is entered into the child's profile and can view and delete it at any time through the account dashboard.

5. Data Storage & Security

Your account data, child profiles, story content, and audio files are stored on Supabase, which provides encryption at rest (AES-256) and encryption in transit (TLS 1.2+). Supabase servers are hosted in the EU. Access to your data is strictly controlled through Supabase's Row-Level Security (RLS) policies, which ensure that you can only access data belonging to your own account and your own children. Our team accesses production data only when necessary for support and debugging, using service-role credentials with audit logging.

6. International Data Transfers

While your primary data is stored in the EU (Supabase), several service providers operate outside the UK and European Economic Area:

• Anthropic PBC (Claude): Story generation requests are sent to Anthropic's API, hosted in the United States. Anthropic has confirmed that it does not use customer-submitted data for model training and processes data under Standard Contractual Clauses.
• Fish Audio (text-to-speech): Audio narration requests are sent to Fish Audio's API. Fish Audio processes data under Standard Contractual Clauses.
• KIE.ai / Runware (image generation): Story illustration requests are sent to third-party image generation APIs. Only story prompt text is transmitted.
• Resend (email delivery): Transactional emails are sent via Resend, which may process data through their sub-processor PlanetScale for database hosting.
• Vercel (hosting & analytics): Application hosting and page view analytics are provided by Vercel, operating under Standard Contractual Clauses.

Content sent to these providers is limited to what is needed to perform the specific service. No billing information or full child profile is transmitted. Transfers to Anthropic, Stripe, PostHog, Resend, and Vercel are protected by Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office as providing adequate safeguards for international data transfers under UK GDPR. Other providers reference SCCs in their terms or privacy policies.

7. Sub-Processors

We use the following third-party services to operate SootheStories:

8. Analytics & Cookies

We use PostHog and Vercel Analytics for anonymised product analytics to understand how families use SootheStories and to improve the service. PostHog operates on EU-hosted infrastructure and does not receive your name, email, or child's personal data. Vercel Analytics captures page view counts and technical metadata (device type, country, referrer) only — no personal data is collected. Both analytics tools are governed by our cookie consent mechanism — you are asked for consent on your first visit and may change your preference at any time. We do not use tracking cookies for advertising or cross-site tracking purposes, and we comply with the Privacy and Electronic Communications Regulations (PECR) for all cookie-based data collection.

Story generation uses Anthropic Claude and Fish Audio APIs — no story content is used for model training by any of our providers.

9. Data Retention

We retain your child's name, age, emotional history, and story content for the duration of your active subscription. If you cancel your subscription, your data is retained for 30 days to allow you to reactivate without losing your child's story history. After 30 days, all personal data and generated content associated with your account is permanently deleted. You may request immediate deletion at any time by contacting us or using the account deletion function in your dashboard settings.

10. Your Data Subject Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of all personal data we hold about you and your child.
• Right to rectification: You can correct inaccurate or incomplete data through your account dashboard or by contacting us.
• Right to erasure: You can request deletion of your data at any time.
• Right to restriction: You can ask us to limit how we process your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email us at hello@soothestories.com. We will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been infringed.

11. Contact

hello@soothestories.com