Privacy notice

This privacy notice is issued by Augmentic AB ("Augmentic", "we", "us"), the company that operates Tinytold ("the service"). Augmentic AB is the data controller for personal data processed through Tinytold and is responsible for how that data is collected and used. You can reach us through our contact form — choose the “Privacy or data” topic.

Categories of personal data we collect

• Account data — email address, display name, password hash, chosen locale.
• Children's profile data — first name, age, pronouns, interests. Only what you choose to enter.
• Story content — prompts, generated text, images, and audio you create or save.
• Support communications — messages you send to our support team.
• Usage and device data — log data, device identifiers, IP address, browser type, pages viewed.
• Billing identifiers — customer and subscription IDs from our payment provider. We never see or store card numbers.

Purposes and legal bases

We process personal data under the following GDPR Article 6 legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create your account, deliver stories you generate, and operate subscriptions.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent fraud and abuse, and improve product quality in aggregate.
• Consent (Art. 6(1)(a)) — for optional marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to retain tax, accounting, and compliance records as required by law.

We do not sell personal data, we do not show ads inside Tinytold, and we do not use children's data for behavioural profiling. We may advertise Tinytold on Google and, only with your consent, measure which ads led to a purchase (see Cookies).

AI processing

Story prompts and finished pages are sent to AI providers acting as our processors under contractual confidentiality. They are not permitted to retain content for model training.

Who we share data with

• Service providers (subprocessors) — hosting, database, analytics, email delivery, and AI providers, acting on our instructions.
• Stripe — our payment processor. Stripe receives the data necessary to take payment, manage subscriptions, issue invoices, meet sales tax obligations and respond to refund, dispute or billing enquiries. We never see or store your card details. See Stripe's privacy notice.
• Professional advisers — legal, accounting, and audit advisers, where strictly necessary.
• Authorities — where required by law or to protect our rights.

International transfers

Some of our providers are located outside the EU/EEA. Where data is transferred internationally, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) approved by the European Commission, together with appropriate supplementary measures.

Data retention

• Account and child profile data — kept while your account is active and deleted within 30 days of account deletion.
• Story content — kept while your account is active. You may delete individual stories at any time.
• Support messages — kept for up to 24 months.
• Server and security logs — kept for up to 12 months.
• Billing and tax records — kept for up to 7 years where required by law.

Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS) and at rest, role-based access controls, hardened authentication, row-level database security, regular backups, and ongoing monitoring. No system is perfectly secure, but we work to keep risks low and respond quickly if something goes wrong.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. You can exercise most of these rights from the parent dashboard, or through our contact form using the “Privacy or data” topic. We respond within one month. You also have the right to lodge a complaint with your local data protection supervisory authority.

Cookies

We use a small number of essential cookies and browser storage to keep you signed in and to remember preferences, including your cookie choice (what you chose, when, and which notice version you saw). These are always on.

Optional: Google Ads purchase measurement. When this is switched on we ask first with an Accept / Decline choice; nothing from Google loads until you accept. If you accept, after a confirmed paid purchase (a Single Book or the first payment of a subscription) your browser sends Google Ireland Ltd / Google LLC one conversion containing the amount, currency and an anonymous order reference, plus the ad-click cookie Google sets on its tag. The purpose is solely to measure whether our ads work. We do not use remarketing, audience lists, ad personalisation or enhanced conversions, and we send no name, email, child details, story content or page addresses. Legal basis: consent (Art. 6(1)(a)). Google's privacy policy applies to its processing.

If you decline or ignore the choice, no Google Ads data is sent. You can change or withdraw your choice at any time with “Cookie settings” at the bottom of every page; withdrawal takes effect immediately and is not retroactive.

Contact

Augmentic AB · reach us through our contact form.