> Short version: We store as little as possible. No advertising, no data selling, no third parties in your child's bedroom. Your data stays in the EU. Everything is deletable at any time.
Richtfest Tech UG (haftungsbeschränkt) Seegefelder Weg 317, 13591 Berlin E-Mail: admin@bedtimestories.me Managing Director: Jessica Dobberphul
E-mail address, optionally first name. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
First name, age, story preferences. You create and manage these yourself. No public profile for children. Legal basis: consent (Art. 6(1)(a) GDPR).
Story texts, cover images, audio files (pre-made AI voices only — voice cloning not yet active). Legal basis: performance of contract.
Voice cloning is not yet available. When activated, voice profiles will require explicit separate consent and will be classified as biometric data (Art. 9 GDPR). This Privacy Policy will be updated at that time.
Processed exclusively by Stripe, Inc. We never see your card number. Legal basis: performance of contract.
Server logs (IP address, timestamp, requested URL) for up to 7 days for security purposes. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
We use the following carefully selected service providers who process data on our behalf:
| Provider | Purpose | Location | DPA | |---|---|---|---| | HostEurope GmbH | Web hosting, server infrastructure | Germany | Concluded | | OpenAI, Inc. | AI story & image generation | USA (SCCs) | Standard DPA | | ElevenLabs, Inc. | Text-to-speech (AI voices) | USA (SCCs) | To be concluded | | Inworld AI, Inc. | Text-to-speech (AI voices) | USA (SCCs) | To be concluded | | Stripe, Inc. | Payment processing | Ireland (EU) | Standard DPA | | Google Ireland Ltd. | Web analytics & marketing (Google Analytics, Google Tag Manager) — only with consent | Ireland (EU); transfer to USA possible (SCCs / EU-US DPF) | Standard DPA | | Cloudflare, Inc. | Bot detection on sign-up & password reset (Turnstile) | USA (SCCs / EU-US DPF) | Standard DPA |
For transfers to the USA, EU Standard Contractual Clauses (SCCs) apply. All processors are contractually bound to process data only on our documented instructions.
Our service is designed for use by parents. Children under the age of 16 require the consent of a parent or guardian. We do not collect personal data from children directly and do not create public profiles for children. Parents are responsible for the data they enter for child profiles.
Technically necessary cookies: session/login cookies required to operate the site (legal basis Art. 6(1)(f) GDPR, § 25(2) TTDSG). These are set without consent.
Analytics & marketing (only with your consent): With your consent we use Google Tag Manager (Google Ireland Ltd.) to load Google Analytics 4 and, where applicable, marketing tags of the platforms Meta (Facebook/Instagram), TikTok and Google/YouTube. This lets us analyse the use of our website in a pseudonymised way and measure the performance of our advertising. Cookies may be set and data (including a shortened IP address, device and usage data) may be transferred to Google and the aforementioned providers; a transfer to the USA is possible (safeguarded by EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework). Legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). These tags are only executed after you actively agree in the cookie banner (Google Consent Mode v2). Analytics data is retained according to our Google settings (usually max. 14 months).
Withdrawal: You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.
When you sign up or request a password reset link, we use Cloudflare Turnstile (Cloudflare, Inc., USA) to prevent automated mass sign-ups by bots. Without this protection, attackers can create large numbers of accounts using other people's email addresses, flooding the inboxes of uninvolved individuals with confirmation emails.
In doing so, your IP address and technical characteristics of your browser (including device and browser properties as well as interaction patterns) are transmitted to Cloudflare and evaluated there in order to distinguish humans from automated scripts. Cloudflare does not set advertising cookies for this purpose and, according to its own statements, does not use the data for advertising purposes. A transfer to the USA is possible; it is safeguarded by EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.
The legal basis is our legitimate interest in preventing abuse and in the security of our service (Art. 6(1)(f) GDPR). As this is a protective measure necessary for secure operation, it does not depend on your consent in the cookie banner.
Under GDPR you have the following rights, exercisable at any time at admin@bedtimestories.me:
We will notify registered users by e-mail of material changes. The current version is always available at this URL. The date of the last update is shown above.