Back to homepage Privacy

Privacy Policy

Last updated: June 1, 2026 · Version 1.1

Privacy Policy

> Short version: We store as little as possible. No advertising, no data selling, no third parties in your child's bedroom. Your data stays in the EU. Everything is deletable at any time.

1. Controller

Richtfest Tech UG (haftungsbeschränkt) Seegefelder Weg 317, 13591 Berlin E-Mail: admin@bedtimestories.me Managing Director: Jessica Dobberphul

2. Data We Process

Account data

E-mail address, optionally first name. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Child profiles

First name, age, story preferences. You create and manage these yourself. No public profile for children. Legal basis: consent (Art. 6(1)(a) GDPR).

Generated stories

Story texts, cover images, audio files (pre-made AI voices only — voice cloning not yet active). Legal basis: performance of contract.

Voice profiles (not yet active)

Voice cloning is not yet available. When activated, voice profiles will require explicit separate consent and will be classified as biometric data (Art. 9 GDPR). This Privacy Policy will be updated at that time.

Payment data

Processed exclusively by Stripe, Inc. We never see your card number. Legal basis: performance of contract.

Usage data / logs

Server logs (IP address, timestamp, requested URL) for up to 7 days for security purposes. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

3. Sub-Processors (Data Recipients)

We use the following carefully selected service providers who process data on our behalf:

| Provider | Purpose | Location | DPA | |---|---|---|---| | HostEurope GmbH | Web hosting, server infrastructure | Germany | Concluded | | OpenAI, Inc. | AI story & image generation | USA (SCCs) | Standard DPA | | ElevenLabs, Inc. | Text-to-speech (AI voices) | USA (SCCs) | To be concluded | | Inworld AI, Inc. | Text-to-speech (AI voices) | USA (SCCs) | To be concluded | | Stripe, Inc. | Payment processing | Ireland (EU) | Standard DPA |

For transfers to the USA, EU Standard Contractual Clauses (SCCs) apply. All processors are contractually bound to process data only on our documented instructions.

4. Storage Duration

  • Account data: for the duration of the contract + 3 years (statutory limitation periods)
  • Child profiles & stories: as long as the account exists — deletable at any time
  • Audio files (TTS): stored per story; deleted when story is deleted
  • Payment records: 10 years (§ 147 AO German Tax Code)
  • Server logs: max. 7 days

5. Children's Data

Our service is designed for use by parents. Children under the age of 16 require the consent of a parent or guardian. We do not collect personal data from children directly and do not create public profiles for children. Parents are responsible for the data they enter for child profiles.

6. Cookies

We use only technically necessary cookies (session management, login status). No tracking cookies, no advertising cookies, no third-party analytics. No cookie consent banner is therefore required.

7. Your Rights

Under GDPR you have the following rights, exercisable at any time at admin@bedtimestories.me:

  • Right of access — You can request a copy of all data we hold about you.
  • Right to rectification — Incorrect data must be corrected.
  • Right to erasure — Deletion of your account deletes all personal data, stories, and audio files.
  • Right to data portability — You can request your stories as a structured export.
  • Right to object — You can object to processing based on legitimate interests at any time.
  • Right to lodge a complaint — Supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

8. Changes to this Policy

We will notify registered users by e-mail of material changes. The current version is always available at this URL. The date of the last update is shown above.