> Short version: We store as little as possible. No advertising, no data selling, no third parties in your child's bedroom. Your data stays in the EU. Everything is deletable at any time.
Richtfest Tech UG (haftungsbeschränkt) Seegefelder Weg 317, 13591 Berlin E-Mail: admin@bedtimestories.me Managing Director: Jessica Dobberphul
E-mail address, optionally first name. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
First name, age, story preferences. You create and manage these yourself. No public profile for children. Legal basis: consent (Art. 6(1)(a) GDPR).
Story texts, cover images, audio files (pre-made AI voices only — voice cloning not yet active). Legal basis: performance of contract.
Voice cloning is not yet available. When activated, voice profiles will require explicit separate consent and will be classified as biometric data (Art. 9 GDPR). This Privacy Policy will be updated at that time.
Processed exclusively by Stripe, Inc. We never see your card number. Legal basis: performance of contract.
Server logs (IP address, timestamp, requested URL) for up to 7 days for security purposes. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
We use the following carefully selected service providers who process data on our behalf:
| Provider | Purpose | Location | DPA | |---|---|---|---| | HostEurope GmbH | Web hosting, server infrastructure | Germany | Concluded | | OpenAI, Inc. | AI story & image generation | USA (SCCs) | Standard DPA | | ElevenLabs, Inc. | Text-to-speech (AI voices) | USA (SCCs) | To be concluded | | Inworld AI, Inc. | Text-to-speech (AI voices) | USA (SCCs) | To be concluded | | Stripe, Inc. | Payment processing | Ireland (EU) | Standard DPA | | Google Ireland Ltd. | Web analytics & marketing (Google Analytics, Google Tag Manager) — only with consent | Ireland (EU); transfer to USA possible (SCCs / EU-US DPF) | Standard DPA |
For transfers to the USA, EU Standard Contractual Clauses (SCCs) apply. All processors are contractually bound to process data only on our documented instructions.
Our service is designed for use by parents. Children under the age of 16 require the consent of a parent or guardian. We do not collect personal data from children directly and do not create public profiles for children. Parents are responsible for the data they enter for child profiles.
Technically necessary cookies: session/login cookies required to operate the site (legal basis Art. 6(1)(f) GDPR, § 25(2) TTDSG). These are set without consent.
Analytics & marketing (only with your consent): With your consent we use Google Tag Manager (Google Ireland Ltd.) to load Google Analytics 4 and, where applicable, marketing tags of the platforms Meta (Facebook/Instagram), TikTok and Google/YouTube. This lets us analyse the use of our website in a pseudonymised way and measure the performance of our advertising. Cookies may be set and data (including a shortened IP address, device and usage data) may be transferred to Google and the aforementioned providers; a transfer to the USA is possible (safeguarded by EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework). Legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). These tags are only executed after you actively agree in the cookie banner (Google Consent Mode v2). Analytics data is retained according to our Google settings (usually max. 14 months).
Withdrawal: You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.
Under GDPR you have the following rights, exercisable at any time at admin@bedtimestories.me:
We will notify registered users by e-mail of material changes. The current version is always available at this URL. The date of the last update is shown above.