Privacy Policy — Tale Boo

Last updated: July 5, 2026 Status: Draft pending legal review

1. Who we are

The data controller is:

Mente Spółka Akcyjna (Mente S.A., a Polish joint-stock company) ul. Pl. Zwycięstwa 2, 90-312 Łódź, Poland National Court Register (KRS): 0001044782 · Tax ID (NIP): 7282875373 · REGON: 525942709 Share capital: PLN 100,000.00 Privacy contact email: rodo@taleboo.com

(referred to as "we", "us", "the Controller")

2. Who this app is for, and who may create an account

Tale Boo creates personalized, educational bedtime stories for children aged 3–12, co-written and narrated together with a friendly character named "Boo".

Only an adult — a parent or legal guardian, 18 years or older — may create an account. Children do not create their own accounts and never provide their own email address, password, or other contact information. Every child profile is created and managed exclusively by the parent/guardian from within their own account.

By registering, you confirm that you are the parent or legal guardian of any child profile(s) you create, and that you are at least 18 years old.

3. What data we collect

a) Parent/guardian account data

Email address, preferred language and timezone, account creation date, an optional parent PIN (used solely as a local screen-lock on the device to keep settings away from the child).

b) Child profile (entered exclusively by the parent)

First name or nickname, age (3–12), math and English learning level, hobbies/interests, preferred narrator voice.

c) Story content

Story ideas/topics provided by the child (typed or spoken), the generated story chapters, story ratings (1–5 stars, favorite themes), and a short history of past stories (used only so future stories don't repeat plots and continue to develop the child).

d) Voice recordings — handled with extra care

• The child's spoken answers (e.g. answering Boo's question) are sent to a speech-to-text service solely to obtain a text transcript. We do not permanently store the child's raw audio — the recording is discarded on our side after transcription. The sub-processor performing transcription (see Section 6) may apply its own API-level retention policy.
• Voice cloning source audio (e.g. a recording of a parent, grandmother, or grandfather, made knowingly by an adult, to create a narrator voice) is sent to our voice-technology provider (ElevenLabs) and stored there as a voice model until deleted. Voice cloning requires the separate, informed consent of the person whose voice is being cloned — the parent confirms they have the right and consent of that person to use their voice this way.

e) Usage data

Number of stories/chapters generated, daily usage limits, subscription plan (free/trial/premium), history of redeemed promo codes.

f) Payment data

Payments (once enabled) will be handled by a certified third-party payment processor (Stripe). We do not store card numbers on our own servers.

g) Technical data

IP address (used for security and abuse prevention), a referral identifier stored locally in the browser if the user arrived via a referral link.

4. Why we process this data

• Providing the service: generating personalized stories, speech synthesis and recognition, saving the child's progress
• Child safety: content moderation (every topic the child submits and every generated story is automatically screened for content unsuitable for children), enforcing usage limits
• Account, subscription, and billing administration
• Improving the service, based on aggregated and anonymized data
• Necessary communication with the parent (e.g. account confirmations, important service changes)

What we never do with a child's data

• We never show advertising targeted at children and never profile children for advertising purposes
• We never sell children's or parents' personal data
• We never share a child's data with other users without the parent's explicit, informed consent (see public gallery, Section 9)
• We do not allow children to contact strangers within the app

5. Legal bases for processing (GDPR)

• Consent (Art. 6(1)(a) GDPR) — for a child's data, consent is given by the parent/legal guardian, consistent with Art. 8 GDPR on consent for information society services offered directly to a child
• Performance of a contract (Art. 6(1)(b)) — delivering the app functionality the user selected
• Legitimate interest of the Controller (Art. 6(1)(f)) — abuse prevention, technical security, enforcing usage limits
• Legal obligation (Art. 6(1)(c)) — e.g. retaining billing records as required by tax law

6. Who we share data with (sub-processors)

We use trusted technology providers who process data on our behalf, under data processing agreements (GDPR Art. 28):

Where data is transferred outside the European Economic Area, we rely on appropriate legal safeguards, in particular the European Commission's Standard Contractual Clauses (SCCs), or another lawful GDPR transfer mechanism. (To be confirmed and completed by legal counsel based on current provider agreements.)

7. How long we keep data

Data is retained for as long as the account remains active. Upon account deletion ("Delete account forever" in Settings → Privacy), our database records are permanently deleted within a reasonable technical timeframe. Cloned voice models held by our third-party voice provider (ElevenLabs) are deleted when the voice is removed in Voice Settings or automatically upon account deletion.

8. Your rights as a parent/guardian

Under GDPR (and equivalent rights under other applicable laws), you have the right to:

• Access your data — a full export of your account and children's data is available in Settings → Privacy → "Download my data"
• Rectify inaccurate data
• Erasure ("right to be forgotten") — via "Delete account forever"
• Restrict processing
• Data portability — receive your data in JSON format
• Object to processing based on legitimate interest
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Lodge a complaint with a supervisory authority — in Poland: the President of the Personal Data Protection Office (UODO, uodo.gov.pl); residents of other EU countries may complain to their local data protection authority

To exercise any of these rights beyond what's available in-app, contact: rodo@taleboo.com

9. Child safety — our specific commitments

• Content filtering is always active and cannot be disabled in settings
• Every topic submitted by a child and every generated story is automatically screened for unsuitable content (violence, adult content, unsafe behavior); if an unsuitable topic is detected, the app creatively transforms the idea into a safe version rather than showing the child a refusal message
• No social features between children — children cannot communicate with each other in the app
• Publishing a story to the public gallery is off by default and requires the parent to knowingly enable it for each child profile individually; the parent also controls whether the child's name is shown in the public gallery
• Parent PIN lets you lock app settings away from a child using the same device
• We never show children advertising or sponsored content

10. International users

The app is available globally, including to Polish families living abroad. Depending on your place of residence, additional laws may apply:

• European Union / European Economic Area and the United Kingdom: GDPR / UK GDPR, and — for the UK — the Age Appropriate Design Code
• United States: Children's Online Privacy Protection Act (COPPA) — we do not collect data directly from a child without a parent as intermediary, we do not require a child to disclose more information than is reasonably necessary to use a feature, and we do not allow a child to publicly disclose contact information. California residents: California Consumer Privacy Act / CPRA — we do not "sell" or "share" (as defined under the CCPA) personal information
• All other countries: we apply the above as a global minimum standard for protecting children's data, regardless of local legal requirements

11. Cookies and similar technologies

We use only a minimal, technical referral identifier, stored locally in the browser (localStorage), when a user arrives via another user's referral link. We do not use advertising, tracking, or child-profiling cookies.

12. Changes to this policy

We will notify you of material changes to this policy in advance, by email and via a visible notice in the app, before the changes take effect.

13. Contact

For questions about data protection and this policy: rodo@taleboo.com

Draft prepared 2026-07-05. Requires legal review before publication — see COMPLIANCE_CHECKLIST.md in this folder.