How Tales handles personal data

Effective 29 July 2026

1. Controller

The controller is Aleksey Shlykov, Entrepreneur individuel, 73 rue Vaillant Couturier, 42000 Saint-Étienne, France. Privacy contact: buildtounderstand@gmail.com.

2. Data we process

• Account data: email address, user identifier, authentication and account status.
• Creation data: prompts, selected language, level, genre, generated story, job status, timestamps and technical generation records.
• Subscription data: plan, Stripe customer/subscription references, payment status and billing periods. Tales does not receive full card details.
• Interaction data: story ratings, shared-story requests, cookie choice, and security or server logs such as IP address and device/request metadata.
• Analytics data: page and checkout interactions only if you accept optional analytics cookies.
• Support data: messages and information you choose to send us.

3. Purposes and legal bases

• Provide accounts, generate and host stories, process subscriptions and send service emails: performance of a contract or steps requested before a contract.
• Prevent abuse, secure the service, diagnose failures and defend legal claims: legitimate interests and, where applicable, legal obligations.
• Maintain accounting and transaction records: legal obligations.
• Measure site usage through Google Analytics: consent, which may be withdrawn through “Cookie settings”.
• Publish submitted and generated stories in the public library: performance of the service under the public-sharing terms accepted when using Tales. Do not include learner personal data in prompts.

4. Recipients and processors

Data is shared only as needed with service providers, including Supabase (authentication, database and storage), OpenAI (text and image generation), Stripe (payments and subscriptions), Resend (transactional email), Railway (hosting) and Google Analytics (optional analytics). It may also be disclosed to advisers, authorities or rights-holders where required by law or necessary to establish or defend legal rights.

5. International transfers

Some providers operate in the United States or other countries outside the EEA. Where GDPR requires it, transfers rely on an adequacy decision, the EU–US Data Privacy Framework for participating recipients, Standard Contractual Clauses or another lawful safeguard. You may request information about the applicable safeguard.

6. Retention

Account and story data is generally retained while the account or published story remains active. Public stories may remain available after subscription cancellation. Support messages and operational logs are kept only as reasonably needed for support, security and disputes. Transaction and accounting records are retained for the periods required by French law. Optional analytics retention follows the configured Google Analytics period. Data may be retained longer where necessary for a legal claim, fraud prevention or binding legal request.

7. Public stories and learners

Story links are public and may be forwarded or indexed. Prompts and output may appear in the public library. Never submit names, contact details, health information or other personal data about a learner. Learners do not need an account to open a shared story. Tales is offered to adult account holders and does not knowingly request account data directly from children.

8. Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent without affecting earlier processing. Email buildtounderstand@gmail.com. We may verify identity. You may complain to the CNIL at cnil.fr or to your local supervisory authority.

9. Security and required data

We use reasonable technical and organisational measures, but no online system is completely secure. Account email and authentication data are required to save stories and buy a plan; payment information required by Stripe is necessary to subscribe. Without them, those features cannot be provided.

10. Changes

We may update this Policy to reflect the service or law. Material changes will be indicated on the site or by another appropriate notice. The effective date appears above.