Privacy Policy

At KidsAI Storybook ("we", "us", "our"), we take your privacy and your child's privacy seriously. This policy explains what data we collect, how we use it, and how we protect it.

1. Information We Collect

When you create a storybook, we collect:

• Your email address and account password (hashed — never stored in plain text)
• Your child's first name, age, and personality traits you provide
• Photos you upload of your child (used solely to generate the book's illustrations)
• Payment information — processed securely by Stripe; we never see or store your card details
• Basic usage data (pages visited, browser type) via server logs

2. How We Use Your Information

We use your information to:

• Generate your child's personalised storybook
• Deliver the completed book to you by email
• Send password reset codes if requested
• Improve our service and fix bugs
• Comply with legal obligations

We do not use your child's photos or personal details for any purpose other than generating the book you ordered. We do not sell your data to third parties.

3. Data Storage & Security

Your data is stored on secure servers hosted on Amazon Web Services (AWS) in the Asia Pacific region. We use industry-standard encryption for data in transit (HTTPS/TLS) and at rest. Passwords are hashed using bcrypt and are never recoverable.

Photos and generated images are stored in a private S3 bucket and accessed only via time-limited signed URLs.

4. Children's Privacy

We are committed to protecting children's privacy. We do not knowingly create accounts for children under 13. The account holder must be an adult (parent or guardian). Children's names, photos, and details are used only to create the storybook and are not used for marketing or shared with any third party.

5. Third-Party Services

We use the following trusted third-party services:

• Stripe — payment processing (subject to Stripe's privacy policy)
• OpenAI — story text generation
• Replicate — AI image generation
• Resend / SendGrid — transactional email delivery
• Amazon Web Services — hosting and file storage
• Railway — application hosting

Each of these providers has their own privacy policy and data handling practices.

6. Data Retention

We retain your account data and generated books for as long as your account is active. You may request deletion of your account and all associated data at any time by emailing info@lilauthor.com. We will process deletion requests within 30 days.

7. Cookies

We use a single session cookie to keep you logged in. We do not use advertising cookies or third-party tracking cookies. No cookie consent banner is required as we only use essential cookies.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to processing of your data
• Lodge a complaint with a supervisory authority

To exercise any of these rights, please contact us at info@lilauthor.com.

9. Changes to This Policy

We may update this policy from time to time. We will notify registered users of significant changes by email. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or concerns, please contact us at info@lilauthor.com.