Privacy Policy
Last Updated: 2026-10-08
1. Who We Are
StoryWarm ("we", "us", "our") is an independent service operated from Turkey, reachable at [email protected]. We act as the data controller for personal information processed via our website (storywarm.com) and related services.
Contact:
- General: [email protected]
- Privacy / Data Requests: [email protected]
- DMCA / IP Notices: [email protected]
2. Information We Collect
2.1 Information You Provide Directly
- Waitlist: Email address, optional marketing consent. Every announcement carries a one-click unsubscribe link.
- Order e-mail: The address you give at checkout, used to deliver your book and its receipt. There are no user accounts and no passwords.
- Story input: Child's name, age, favorite things, special moments (children's books) or your first names and milestones (couple books) — provided by you on behalf of your family. We do not collect data directly from children under 13.
- Gift details (gift books): The recipient's name and e-mail address you enter, and your personal message, used only to deliver the gift link.
- Payment information: Processed entirely by Polar; we never see your full card number.
- Optional reference photo (couple books): Stored temporarily on Cloudflare R2 and deleted immediately after your paid book is generated, and in every case within 30 days of upload (a scheduled job purges unused uploads). We never train AI models on your photo.
2.2 Information Collected Automatically
- IP address, browser, OS, page views, timestamps — kept for security, fraud prevention and preview rate-limiting, and removed from our records 90 days after they were created (see §7)
- UTM tracking parameters (utm_source, utm_medium, utm_campaign)
2.3 What We Do NOT Collect
- ❌ Voice recordings
- ❌ Face recognition or biometric identification. For couple books, your optional reference photos are sent to the illustration provider (fal.ai) only so the drawn characters resemble you; we do not identify, match or index faces, and the photos are deleted as described in §2.1
- ❌ Children's personal information collected directly from children under 13
- ❌ Health information
- ❌ Financial information beyond Polar-tokenized payment
3. How We Use Your Information
- Service delivery: Generate your personalized digital storybook (story text and optional audio narration via OpenAI; illustrations via fal.ai — see §8)
- Customer support & communication
- Service improvement: Aggregated, anonymized analytics
- Legal compliance: Tax records, fraud prevention, DMCA processing
We do NOT:
- Sell personal data to third parties
- Share your story content with anyone outside the order fulfillment chain
- Train any AI models on your input or output
4. Children's Privacy (COPPA + GDPR-K)
StoryWarm is intended for parents, grandparents, and adults (age 18+). We do not knowingly collect personal information from children under 13 (US) / 16 (EU).
When you provide your child's name, age, or other details to create a personalized book, you do so as a parent or legal guardian providing third-party information about your own family.
If you believe a child has provided us with personal information without parental consent, contact us immediately at [email protected] — we will delete it.
5. International Data Transfers
| Recipient | Country | Safeguard |
|---|---|---|
| OpenAI (story text and audio narration) | USA | Provider data processing terms |
| fal.ai (illustrations) | USA | Provider data processing terms |
| Polar (Merchant of Record — payments, receipts) | USA / global | Provider data processing terms |
| Cloudflare (hosting, database, file storage, Turnstile bot protection) | USA / global | Provider data processing terms |
| Resend (transactional email) | USA | Provider data processing terms |
6. Your Rights
EU/UK GDPR
- Right of access
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with EU/UK supervisory authority
KVKK (Turkey)
You have all rights under KVKK Article 11. Contact: [email protected]
CCPA/CPRA (California)
Right to know, delete, opt out of sale (we do not sell), non-discrimination.
To exercise any right: Email [email protected] — we respond within 30 days.
7. Data Retention
| Data type | Retention |
|---|---|
| Waitlist email | Until you unsubscribe |
| Order and book records (e-mail, story input, generated files) | Kept so you can re-download your book; order facts needed for tax and refund records are kept up to 7 years (Turkey Tax Code). Ask [email protected] to delete a book earlier. |
| Reference photo (optional) | Maximum 30 days from upload; deleted immediately once your paid book is generated |
| IP address / user agent | Removed 90 days after the related record was created (automated daily job). Exception: the IP recorded with a photo-consent record is kept as proof of consent for as long as the related book exists. |
8. AI Disclosure
- Stories: Generated by OpenAI GPT models; optional audio narration by OpenAI text-to-speech
- Illustrations: Generated through fal.ai using Black Forest Labs FLUX models (children's books) and, for couple books, Google's image model or FLUX, depending on availability
- Every book is labelled as AI-generated in its colophon
9. Security
- TLS 1.3 encryption
- Polar-tokenized payment processing
- Optional photos deleted after your paid book is generated, and within 30 days at the latest
- Annual security review
10. Changes
We will notify users of material changes 30 days before taking effect.
11. Contact
Privacy questions: [email protected]
EU GDPR supervisory authority: your local DPA
UK ICO: ico.org.uk
Turkey KVKK: kvkk.gov.tr