Privacy notice

This privacy notice is issued by Augmentic AB ("Augmentic", "we", "us"), the company that operates Tinytold ("the service"). Augmentic AB is the data controller for personal data processed through Tinytold and is responsible for how that data is collected and used. You can reach us at privacy@tinytold.com.

Categories of personal data we collect

• Account data — email address, display name, password hash, chosen locale.
• Children's profile data — first name, age, pronouns, interests. Only what you choose to enter.
• Story content — prompts, generated text, images, and audio you create or save.
• Support communications — messages you send to our support team.
• Usage and device data — log data, device identifiers, IP address, browser type, pages viewed.
• Billing identifiers — customer and subscription IDs from our payment provider. We never see or store card numbers.

Purposes and legal bases

We process personal data under the following GDPR Article 6 legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create your account, deliver stories you generate, and operate subscriptions.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent fraud and abuse, and improve product quality in aggregate.
• Consent (Art. 6(1)(a)) — for optional marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to retain tax, accounting, and compliance records as required by law.

We do not sell personal data, we do not run advertising, and we do not use children's data for behavioural profiling.

AI processing

Story prompts and finished pages are sent to AI providers acting as our processors under contractual confidentiality. They are not permitted to retain content for model training.

Who we share data with

• Service providers (subprocessors) — hosting, database, analytics, email delivery, and AI providers, acting on our instructions.
• Paddle.com Market Limited ("Paddle") — our Merchant of Record. Paddle receives data necessary to process payments, manage subscriptions, handle invoicing, comply with sales tax obligations, and respond to refund or billing enquiries. Paddle acts as an independent controller for that processing. See Paddle's privacy notice.
• Professional advisers — legal, accounting, and audit advisers, where strictly necessary.
• Authorities — where required by law or to protect our rights.

International transfers

Some of our providers are located outside the EU/EEA. Where data is transferred internationally, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) approved by the European Commission, together with appropriate supplementary measures.

Data retention

• Account and child profile data — kept while your account is active and deleted within 30 days of account deletion.
• Story content — kept while your account is active. You may delete individual stories at any time.
• Support messages — kept for up to 24 months.
• Server and security logs — kept for up to 12 months.
• Billing and tax records — kept for up to 7 years where required by law.

Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS) and at rest, role-based access controls, hardened authentication, row-level database security, regular backups, and ongoing monitoring. No system is perfectly secure, but we work to keep risks low and respond quickly if something goes wrong.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. You can exercise most of these rights from the parent dashboard, or by writing to privacy@tinytold.com. We respond within one month. You also have the right to lodge a complaint with your local data protection supervisory authority.

Cookies

We use a small number of essential cookies to keep you signed in and to remember preferences. We do not use advertising cookies. If we add analytics cookies, we will ask for your consent first and provide a way to manage your choices.

Contact

Augmentic AB · privacy@tinytold.com