Privacy Policy

1. Data Controller

The controller responsible for data processing on this website and the talino.kids application is:

2. Overview

talino.kids ("we", "us", "our") provides an AI-powered platform that creates personalized bedtime stories for children, including illustrations and audio narration. This privacy policy explains how we collect, use, and protect personal data when you visit our website or use our application, in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

3. Data We Collect

3.1 Account Data

When you register via Google or Meta OAuth, we receive:

• Name (first and last)
• Email address
• Profile picture URL (if available)
• OAuth provider identifier

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3.2 Child Profile Data

To personalize stories you provide:

• Child's first name
• Child's age
• Interests / topic preferences (optional)

We do not collect the child's last name, location, photo, or any other identifying information. This data is stored solely to generate stories and can be deleted at any time from your account settings.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3.3 Payment Data

Payments are processed by Stripe, Inc. We do not store credit card numbers or bank account details. Stripe may collect:

• Card last four digits (for display purposes)
• Billing address
• Transaction history

See Stripe's Privacy Policy.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3.4 AI Processing & Content Generation

To generate stories, illustrations, and narration, we use third-party AI services:

• Anthropic (Claude) — generates story text. We send the child's first name, age, selected topic, and preferences. No other personal data is transmitted.
• Replicate — generates illustrations and audio narration using various AI models (e.g., Flux for images). We send story scene descriptions and art style preferences. No personal data beyond the child's first name (as it may appear in scene prompts) is transmitted.

Both services process data on-demand and do not retain personal data beyond the request. We have reviewed their data processing terms to ensure GDPR compliance.

See Anthropic's Privacy Policy and Replicate's Privacy Policy.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3.5 Usage & Analytics Data

We use Google Analytics to understand how visitors use our site. Data collected includes:

• Pages viewed, session duration, bounce rate
• Device type, browser, operating system
• Approximate location (country/city level from IP)
• Referral source

IP addresses are anonymized. We have signed a Data Processing Agreement (DPA) with Google.

Legal basis: Art. 6(1)(a) GDPR — your consent (via cookie banner).

3.6 Advertising Data

We use Google Ads and Meta (Facebook/Instagram) Ads to reach new users. These services may place tracking pixels and cookies to:

• Measure ad conversions
• Build remarketing audiences
• Optimize ad delivery

See Google's Privacy Policy and Meta's Privacy Policy.

Legal basis: Art. 6(1)(a) GDPR — your consent (via cookie banner).

4. Cookies

We use the following categories of cookies:

You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the footer or by clearing your browser cookies.

5. Third-Party Processors

* USA-based services operate under the EU–US Data Privacy Framework or Standard Contractual Clauses (SCCs) for GDPR-compliant data transfers.

6. Your Rights (GDPR)

Under the GDPR you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — restrict processing in certain cases
• Data portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — withdraw cookie/marketing consent at any time

To exercise any of these rights, email privacy@talino.kids. We will respond within 30 days.

7. Children's Privacy

talino.kids is designed for use by parents and guardians on behalf of their children. We do not knowingly collect personal data directly from children under 16. The child's first name and age are provided by the parent/guardian and used solely for story personalization. If you believe a child has provided us with personal data without parental consent, please contact us at privacy@talino.kids and we will delete it promptly.

8. Data Retention

• Account data: retained as long as your account is active. Deleted within 30 days of account deletion.
• Stories & illustrations: retained as long as your account is active.
• Payment records: retained for 7 years as required by Austrian tax law (BAO §132).
• Analytics data: automatically deleted after 14 months (Google Analytics setting).
• Cookie consent: your preference is stored for 12 months.

9. Data Security

We protect your data with HTTPS encryption in transit, encrypted storage at rest, and access controls limited to authorized personnel. Payment data is handled entirely by Stripe's PCI DSS-certified infrastructure.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on our website. The "last updated" date at the top reflects the most recent revision.

11. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Austrian Data Protection Authority:

12. Contact

For any questions about this privacy policy or your personal data, contact us at privacy@talino.kids.