Privacy & Cookie Policy

1. Data controller

The controller of personal data is Jakub Szozda, address for correspondence: ul. Łódzka 10/26, 50-521 Wrocław, Polska, e-mail: szozdanet@gmail.com.

For all matters concerning the processing of personal data, you may contact the controller at the e-mail address: szozdanet@gmail.com.

2. Scope of processed data

Data of the parent/guardian placing the order: e-mail address (and data necessary for payment handling, processed by the payment provider).

Account data (for registered users): e-mail address, name (optional), Google/Facebook sign-in identifier, order history, points and credits balance, saved characters (character library).

Data of the child the story concerns: name, age, gender, interests, occasion and other characteristics provided in the form — to the extent necessary to personalise the Digital content. The generated story text (containing the child's name) is stored for order fulfilment and complaint handling.

Optionally: photos of the child and/or a toy uploaded by the parent to personalise the illustrations. Uploading photos is voluntary.

Technical data: IP address (stored, among others, as proof of consent), session information and preferences (language, currency, theme).

3. Legal bases for processing

Performance of the contract for the supply of Digital content, maintaining the account and order handling — Article 6(1)(b) GDPR.

Processing of the child's data and photos — based on the consent of the parent or guardian exercising parental authority (Article 6(1)(a) GDPR). By placing an order, the parent declares they are entitled to provide the child's data and to consent on the child's behalf.

Compliance with the controller's legal obligations (e.g. handling complaints) — Article 6(1)(c) GDPR.

Own marketing (newsletter) — based on separate, voluntary consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.

Establishment or defence of claims and abuse prevention (legitimate interest) — Article 6(1)(f) GDPR.

4. Purposes of processing and automation

Generating and delivering the personalised story (MP3/PDF) in accordance with the order.

Contacting the Customer and handling orders, the account and complaints.

Sending the newsletter and commercial information — only with consent.

Ensuring security, accountability (proof of consent) and pursuing potential claims.

Story generation is automated (AI models process the form data without human involvement). However, we do not make automated decisions producing legal effects concerning you or the child or similarly significantly affecting you (Article 22 GDPR), and we do not profile users.

5. Data recipients and transfers outside the EEA

To provide the service, the controller uses processors (sub-processors). Some of them are based in the USA, which involves transferring data outside the European Economic Area.

Stripe (payment provider) — data necessary to process payments.

Resend (transactional e-mail provider) — the e-mail address and the message containing the link to the Product.

Anthropic (Claude), OpenAI, Google (Gemini) and ElevenLabs — providers of the AI models generating text, illustrations and voice. They process the data provided in the order, including the child's data and uploaded photos, to the extent necessary to generate the story.

Hetzner Online GmbH (Germany) — server infrastructure provider; the application and files are stored on servers located in the EEA.

Lemon Squeezy (payment provider) — when this payment method is active.

Transfers to the USA are based on Standard Contractual Clauses (SCC) approved by the European Commission, the EU-U.S. Data Privacy Framework adequacy decision (for DPF-certified providers) or other mechanisms compliant with Chapter V of the GDPR.

6. Retention period

Order data (including the story text and proof of consent) is kept for the period necessary to perform the contract and to establish/defend claims (in line with applicable limitation periods).

MP3/PDF files (and any video) are made available via a link active for 30 days from delivery; for signed-in users they remain on the shelf in the account. Files in the account are deleted after 3 months of account inactivity (after two e-mail reminders), unless you have an active subscription — in which case we keep them without a time limit. The order itself remains in your history.

Photos of the child/toy uploaded with an order are deleted immediately after an appearance description has been generated from them — usually within minutes of fulfilment starting. They are not used to train AI models.

Exception: if a signed-in Customer saves a character to the character library themselves („Save to library”), the related data (appearance description and generated character ILLUSTRATIONS — so-called anchors, which are not photos) is kept until the Customer deletes the character or the account.

Account data — until the account is deleted. Data processed on the basis of consent (newsletter) — until consent is withdrawn.

7. Rights of data subjects

You have the right to access your data, rectify it, erase it, restrict its processing, port it and object to processing.

For data processed on the basis of consent — the right to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

You have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Providing data is voluntary but necessary to fulfil the order; without it the story cannot be generated and delivered.

8. Cookies and similar technologies

The Service uses only functional and strictly necessary cookies and local storage. We do not use analytics or marketing cookies and do not profile users.

fablio_lang — remembers the selected interface language (functional).

cur — remembers the selected currency (functional).

fablio_theme — remembers the light/dark theme (browser local storage).

ref_code — supports the referral programme; set only after entering the Service via a referral link (the user's action), stored for 30 days.

Login session cookie (NextAuth) — necessary for the account and user panel to work.

Fonts used in the Service are served from our own servers (self-hosting) — displaying the page sends no requests to external font providers. We do not share data for advertising purposes.

9. Support chat (AI assistant)

The Service provides an AI-based support chat. We store the content of conversations to answer questions, resolve order issues, and improve our help and FAQ.

The language-model provider is OpenAI (a processor) — the content of your messages is sent to OpenAI solely to generate a reply.

Opening the chat from a link in an order e-mail loads it in the context of that single order (the link is tied to the order and read-only). Access to your other orders requires logging in.

We anonymise conversations after 12 months (removing the link to the account, order, and guest identifier).

Legal basis: the controller's legitimate interest — customer support and service improvement (Article 6(1)(f) GDPR). We do not make decisions producing legal effects concerning you solely by automated means.