Your data, your child’s data — the clear deal

Who is responsible?

Kids Stories (kidstories.app) is the data controller for the data described here, within the meaning of the GDPR. Contact: bonjour@kidstories.app. You can also lodge a complaint with the CNIL (cnil.fr) if you feel your rights are not respected.

What we collect about your child

• Their first name — it becomes the hero’s name in the story.
• Their date of birth — encrypted at rest, never displayed: it only serves to work out the age band that adapts the story’s vocabulary.
• Their preferences — worlds, favourite animals, tone, lesson, length, language: whatever you choose in their profile.
• Their photo, only if you provide one — detailed in the next section.

Nothing else: no last name, no address, no school, no geolocation. Your own email and billing address (payments) belong to your account, not your child’s.

Your child’s photo — exactly what happens

Purpose. The photo does exactly one thing: make the illustrated hero look like your child. A vision algorithm extracts a short list of traits (hair colour and style, glasses, freckles, skin tone) — words, never a copy. Only that trait list guides the cartoon-style illustrations; the photo itself never appears in a story, a book or any public page.

No facial recognition. The photo is never used to identify your child, find them in other images or match them to an identity — so the processing is not biometric processing within the meaning of GDPR Article 9.

A check first, as a matter of principle. Before any use, the photo goes through automated safety checks (inappropriate content, more than one person in frame). If in doubt, it is rejected — no silent exceptions.

Storage. Encrypted, private, accessible only to your authenticated account. Never published, never sold, never shared with third parties for advertising. The file’s technical metadata (device, any GPS location) is stripped before it reaches our servers.

Retention. Until you remove it, withdraw your consent, or delete the profile. A photo rejected by the verification is isolated, then destroyed within 30 days.

Legal basis. Your explicit consent (GDPR Article 6(1)(a) and Article 45 of the French Data Protection Act) — a dedicated checkbox, never buried in the terms of service. For a child under 15, the law expects joint agreement: pick the photo together and show them what will happen — they have the right to know.

Who handles what (subprocessors)

The story is written and illustrated by models hosted on our technical processors’ infrastructure: Cloudflare (hosting, storage, AI), Google Cloud (database), Stripe (payments), Resend (service emails). They process data on our behalf, within their contractual limits — none receives content for its own purposes.

Your rights — and how to exercise them

You exercise your child’s rights on their behalf: access, rectification, erasure, restriction, objection, portability. Two direct actions exist in the app:

• “Remove photo” in the profile — erases the photo and its extracted traits, leaving the profile untouched.
• Withdrawing photo consent — erases every photo on the account and ends the processing. Withdrawing is as simple as granting (GDPR Article 7(3)).

For any other right (full access, export, account deletion): bonjour@kidstories.app. We reply within one month at most.

If you believe the processing breaches your rights, you can lodge a complaint with the CNIL — www.cnil.fr.

Simplified version for your child

“Your photo is used to draw a hero who looks like you. A program looks at your hair colour and whether you wear glasses, then it forgets the photo — it never appears in the book. Your parents can delete it whenever they want.” — read it together before ticking the box; the law gives children the right to understand.