Privacy Policy

This Privacy Policy explains how StoryAloft LLC, a limited liability company organized in the Commonwealth of Virginia, United States (“StoryAloft,” “we,” “us,” or “our”), collects, uses, and shares information in connection with our website (the “Site”), our waitlist, and our storybook application (the “App”) (together, the “Services”). By using the Services, you agree to this Policy.

1. Who this is for

The Site and our waitlist are intended for adults (parents and guardians). Our App is designed to be purchased and set up by a parent or guardian for use with their child. We do not knowingly allow children to sign up for the waitlist or create accounts themselves.

2. Information we collect

Information you give us. When you join the waitlist, we collect your email address. When you create an account or subscribe, we collect your account details and your subscription and purchase history. If you contact us, we collect the information you choose to share.

Information collected automatically. Like most websites, we (and our infrastructure providers) may collect limited technical information such as your IP address, browser and device type, device and online identifiers, referring page, approximate location derived from your IP address, and general usage data, in order to operate, secure, and improve the Site.

Children’s information (in the App).In the App, a parent or guardian may choose to provide a child’s first name, a child’s photo, and a parent’s recorded voiceso we can create that family’s personalized stories and narration. We collect this information only with the involvement and consent of the parent or guardian, use it solely to provide the Services to that family, and handle it as described in Sections 5 and 6. We do not collect children’s information through the Site or the waitlist.

3. How we use information

• To operate the waitlist and notify you when the App is available;
• To create and deliver personalized stories and narration (in the App);
• To process subscriptions and payments and manage your account;
• To respond to your questions and provide support;
• To operate, secure, maintain, and improve the Services;
• To advertise and promote our adult-facing Site (not the App); and
• To comply with law and enforce our terms.

4. How we share information

We do not sell your personal information for money, and we never use a child’s information for advertising. To promote our Services, we do use advertising and analytics technologies on our adult-facing Site (see Section 8), which may involve sharing limited online identifiers with advertising partners. Under some U.S. state privacy laws this can be considered “sharing” or “targeted advertising,” and you can opt out as described in Sections 9 and 10. We share information with:

• Service providers that help us run the Services (for example, website hosting, data storage, email delivery, payment processing, and, in the App, AI providers that generate stories, images, and narration), under agreements that limit their use of the information to providing services to us;
• Advertising and analytics partners (for example, Meta (Facebook) and Google) that help us measure, run, and target ads for our adult-facing Site, as described in Section 8;
• Legal and safety purposes, when we believe in good faith it is required by law or necessary to protect rights, safety, or property; and
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Payments. Subscription payments are processed by Stripe. We do not store full payment card numbers. Stripe processes your payment information under its own terms and privacy practices.

5. Photos, voice, biometric and sensitive data, and AI

A child’s photo and a parent’s recorded voice (collected only in the App) are used for one purpose: creating that family’s stories and narration. They are collected only with parental involvement and consent. We do not sell them, we do not share them for advertising, and we do not use them to train artificial-intelligence models (ours or any third party’s). The AI providers that help us create stories, illustrations, and narration are Google (through Google Cloud and Vertex AI), OpenAI, and ElevenLabs. Each is engaged as a service provider under a data processing agreement that limits their use of the content to providing these Services to us and prohibits them from using your or your child’s content for their own purposes or to train their models. Some U.S. states regulate voice and facial data as biometric or sensitive information, and we handle a parent’s voice recording and a child’s photo accordingly. We use this sensitive information only to provide the Services and not to infer characteristics about you or your child. You can delete a photo, a voice recording, or your entire account at any time, after which we delete the associated content from our active systems within a reasonable period, except where retention is required by law.

6. Children’s privacy (COPPA)

We are committed to protecting children’s privacy and to complying with the U.S. Children’s Online Privacy Protection Act (COPPA) and its rules. In the App:

• We obtain verifiable parental consent before collecting personal information from a child;
• We minimizethe information we collect and do not condition a child’s participation on collecting more information than is reasonably necessary;
• Parents may review and deletetheir child’s information and refuse further collection at any time;
• We do not use behavioral advertising, third-party tracking, or any advertising technology directed to children; and
• Our AI providers act as our service providersand are contractually barred from using a child’s information for their own purposes or to train their models.

The Site and waitlist are not directed to children and do not knowingly collect children’s information. If you believe a child has provided us information through the Site, contact us at privacy@storyaloft.com and we will delete it.

7. Data retention

We keep personal information only as long as needed for the purposes described in this Policy or as required by law, then delete or de-identify it. In general:

• Waitlist email: kept until you unsubscribe or after a period of inactivity, whichever comes first;
• Account information: kept while your account is active and for a reasonable period afterward;
• A child’s photo and a parent’s voice recording: kept until the parent deletes them or closes the account, then deleted from our active systems within a reasonable period;
• Payment and tax records: kept as required by law; and
• Technical logs: kept for a short period for security and troubleshooting.

8. Cookies, analytics & advertising technologies

On our adult-facing Site and waitlist, we use cookies and similar technologies, including third-party analytics and advertising tools such as the Meta (Facebook) Pixel and Google Analytics and Google Ads. These tools may collect online identifiers, device and browser information, and your activity on the Site (such as the pages you view and the waitlist sign-up), and may set cookies that let us and these platforms measure and improve our advertising, understand how visitors find us, and show our ads to relevant audiences, including retargeting, across other sites and apps. This information is shared with those platforms under their own terms and may be combined with data they already hold about you.

We use these technologies only on the Site and waitlist, which are intended for adults. We do not use advertising or third-party tracking technologies inside the children’s App, and we never use a child’s information for advertising.

You can control these technologies by adjusting your browser cookie settings, by sending a Global Privacy Control (GPC) signal (which we honor as an opt-out of targeted advertising and sharing), by using the ad settings offered by Meta and Google directly, or through the industry opt-out tools at the DAA and NAI.

9. California privacy rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Policy. It describes our practices and your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).

Categories of personal information we collect. In the past twelve months we have collected the following statutory categories of personal information:

• Identifiers: email address, IP address, device and online identifiers, and account ID;
• Customer records and commercial information: subscription and purchase history. Payments are processed by Stripe, and we do not store full payment card numbers;
• Internet or other network activity: Site interactions and pixel/analytics data;
• Geolocation: approximate location derived from your IP address;
• Audio and electronic information: a parent’s voice recording (in the App);
• Visual information: a child’s photo (in the App);
• Professional, employment, and education information: none;
• Inferences: limited (for example, advertising audiences on the adult Site); and
• Sensitive personal information: account log-in credentials, and, in the App, a child’s photo and a parent’s voice recording to the extent treated as biometric or sensitive information.

Sources, purposes, and recipients. For each category above:

• Sources: you, your device, and our service providers.
• Business and commercial purposes: to provide and secure the Services, provide customer support, improve the Services, advertise the adult Site, and comply with law.
• Categories of recipients: service providers, advertising and analytics partners (adult Site only), legal and safety recipients, and parties to a business transfer.

Sale or sharing of personal information. We do not sell personal information for money. Only on the adult-facing Site do we “share” online identifiers and internet activity with advertising partners for cross-context behavioral advertising, and you may opt out of that sharing as described below. We do notsell or share the personal information of any child or anyone we know to be under 16, and we never use a child’s information for advertising.

Sensitive personal information. We use sensitive personal information only to provide the Services, and not to infer characteristics about you. You may request that we limit the use of your sensitive personal information to those permitted purposes.

Your California rights. Subject to verification and legal limits, you have the right to:

• Know and access the personal information we hold about you;
• Delete personal information we have collected from you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information;
• Limit the use of your sensitive personal information; and
• Non-discrimination for exercising any of these rights.

How to exercise your rights. You can submit a request by emailing us at privacy@storyaloft.com. We also honor the Global Privacy Control (GPC) browser signal as an opt-out of the sale or sharing of your personal information. We provide at least two methods to exercise your rights (email and the GPC browser signal). You may exercise the following clearly labeled options by email at privacy@storyaloft.com or, where applicable, by sending a GPC signal:

• “Do Not Sell or Share My Personal Information”; and
• “Limit the Use of My Sensitive Personal Information”.

Authorized agents, verification, and timeline. You may use an authorized agent to submit a request on your behalf, and we may ask the agent for proof of authorization and may verify your identity directly. To protect your information, we will take reasonable steps to verify your identity before responding, typically by matching information you provide against information we hold. We will respond within 45 days, and may extend that period by an additional 45 days when reasonably necessary, with notice to you.

Minors under 16. We do not sell or share the personal information of consumers we know to be under 16. Such activity would require opt-in consent, which we do not seek.

Notice of financial incentive. Our referral program (free credits) and our first-story-free offer may be considered financial incentives under the CCPA/CPRA. Participation is entirely optional, you may withdraw at any time, and no one is penalized for choosing not to participate. We have a good-faith belief that the value of any data involved is reasonably related to the value of the incentive offered, which is based on the cost of providing the free credits or free first story.

Shine the Light (California Civil Code Section 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes. California residents may request information about such disclosures by contacting us at privacy@storyaloft.com.

Request metrics. We will provide any consumer-request metrics required by California law on request, available by emailing privacy@storyaloft.com.

10. Other U.S. state privacy rights

If you are a resident of Virginia (under the Virginia Consumer Data Protection Act, or VCDPA) or another U.S. state with a comprehensive privacy law, you may have the right to:

• Access the personal data we process about you;
• Correct inaccuracies in your personal data;
• Delete personal data we hold about you;
• Obtain a copy of your personal data in a portable format; and
• Opt out of targeted advertising and the sale of personal data.

To exercise these rights, email us at privacy@storyaloft.com. Appeals: if we decline your request, you may appeal that decision by emailing privacy@storyaloft.com with the word “Appeal” in your message. We will respond to your appeal within the time required by applicable law and, if we deny the appeal, will tell you how to contact your state attorney general to submit a complaint.

11. Do Not Track and Global Privacy Control

We honor the Global Privacy Control (GPC) browser signal as an opt-out of the sale or sharing of your personal information and of targeted advertising. There is no common industry standard for responding to “Do Not Track” browser signals, so we do not respond to them separately.

12. Your choices

You may unsubscribe from waitlist or marketing emails at any time using the link in the email or by contacting us. You may delete a photo, a voice recording, or your entire account in the App at any time. You may also exercise the state-law rights described in Sections 9 and 10. We do not discriminate against you for exercising your rights.

13. Data security

We use reasonable administrative, technical, and physical safeguards to protect information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

14. Third-party links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third-party sites, and this Policy does not apply to them. We encourage you to review their privacy policies.

15. U.S. processing & governing law

The Services are operated from the United States and intended for U.S. users; information is processed in the United States. This Policy and the Services are governed by the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws rules.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new “Last updated” date, and, where appropriate, notify you.

17. Contact us

StoryAloft LLC (Virginia, USA)
Email: privacy@storyaloft.com