Privacy Policy

The controller of personal data collected through this site and the GrowTales service is the GrowTales project operator, in the legal form published in the legal notice. Privacy and rights requests: soporte@growtales.app.

Admin account management (registration, authentication, roles, email verification, password reset, optional 2FA).

Service delivery: board (device) registration and use, NFC figure UIDs, story generation or playback, credits, operational history (e.g. plays) as designed.

Board setup data entered by a guardian via QR/link (e.g. child nickname, approximate age, language, themes, duration): solely to personalize stories on that device.

Transactional email and support or contact responses.

Waiting list: if you sign up, we use your email — together with the site language and the page you signed up from — only to tell you when the board is available. We do not store your IP address.

Legal compliance, security (technical logs, abuse prevention, rate limiting), and reliability improvements.

Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).

Consent where required (Art. 6(1)(a)), e.g. non-essential cookies if enabled later.

Waiting list: your consent (Art. 6(1)(a)), which we record with its date and the version of the text you accepted and which you can withdraw at any time by writing to the contact address.

Legitimate interests (Art. 6(1)(f)) for security and proportionate operations.

Legal obligation where applicable (Art. 6(1)(c)).

Payments and subscriptions: Stripe Payments Europe, Ltd. processes subscription billing. Payment happens on a page hosted by Stripe, so GrowTales never receives or stores your card number, expiry date, or security code. For each subscription we keep only the customer and subscription identifiers Stripe returns, their status, and the renewal dates — what we need to know whether an account is active.

Text generation: Anthropic (Claude models) receives what is needed to write the story, which includes the profile an adult filled in for that board — name or nickname, approximate age, language, and topics — plus the characters of the figures placed on it. Your email address and other account data are not sent.

Voice synthesis: ElevenLabs turns the generated story text into audio. It receives that text, which may contain the child's name or nickname if an adult entered one in the profile.

Email: verification, password recovery, and contact messages use the SMTP infrastructure or email provider configured by the controller.

Hosting: data resides on the servers and databases (MongoDB) chosen for each deployment.

International transfers: Anthropic, ElevenLabs, and Stripe's parent company are established in the United States. Those transfers rely on the European Commission's standard contractual clauses or on the applicable adequacy framework, depending on what each provider has in place. You can request a copy of the safeguards at the contact address.

Account data is kept while the relationship is active and as long as needed for claims or law. Verification/reset tokens expire per backend rules. Technical logs may be retained for limited periods.

The waiting-list email is kept until you withdraw your consent or, at most, two years after signing up; after that it is deleted automatically.

You may request access, rectification, erasure, restriction, objection, portability, and withdraw consent where applicable via the contact address. You may lodge a complaint with the Spanish DPA (AEPD) or your local authority.

GrowTales is a product aimed at children, but **the service is never bought or configured by a child**. The account, the subscription, and the board profile are always created by an adult, and the child only interacts with the physical board, which asks for and collects nothing by itself.

The profile an adult may fill in to personalise stories accepts a name or nickname, an approximate age, the language, preferred topics, and a length. All of it is optional: **the board works with nothing filled in**, and the less is filled in, the less data about the child leaves the device.

Under Article 7 of Spanish Organic Law 3/2018, processing the data of children under fourteen requires the consent of whoever holds parental responsibility or guardianship. By entering the profile, the adult declares that they hold it or have their authorisation.

We recommend using a nickname rather than a real name. Whatever name is entered is sent to the text and voice providers so the story can say it aloud, and a nickname serves the same purpose without identifying anyone.

If you find that a child's data was processed without proper authorisation, write to us and we will delete it.

We apply reasonable measures: password hashing, JWT and httpOnly cookies where configured, rate limiting, and input validation. No system is perfectly secure; report suspected incidents promptly.