Privacy Policy

Company: Pumi Technologies, Inc.

Privacy Contact Email: service@pumistories.com

For privacy inquiries, data access requests, or deletion requests, please contact us at service@pumistories.com.

The Services are intended for parents and legal guardians (“Parents”) who create and manage accounts. Children may view or listen to stories, but the Parent controls the account, settings, and any content uploaded or generated.

A) Information You Provide

• Account Information: email address and optional profile details you choose to provide.
• Parent Inputs: prompts, categories, story requests, feedback, and any text you enter.
• Child Data (optional, provided by Parent): a child's nickname, age range, preferences, and other information a Parent chooses to provide for personalization.
• Child Photos (optional, provided by Parent): if you upload a photo of a child (“Child Photo”), we process it to generate stylized story illustrations and related visuals as described in Section 8.
• Communications: messages you send to us (support requests, bug reports), including attachments.

B) Information Collected Automatically

• Device and App Data: device model, operating system, app version, language, time zone, and IP address.
• Usage Data: screens viewed, feature usage, session duration, and interaction logs.
• Diagnostics: crash logs, performance data, and error reports.

C) Purchases and Subscriptions

If you purchase a subscription or in-app purchase through Apple App Store or Google Play, the platform processes payment. We do not receive your full payment card details. We may receive limited information such as: subscription status (active/expired), product identifier, purchase and renewal dates, and a transaction or receipt identifier.

D) Cookies (Website Only, If Applicable)

If we operate a website, it may use cookies or similar technologies for essential functionality, security, and analytics. You can control cookies via your browser settings.

We use information to:

• Provide and operate the Services (account creation, story generation, content delivery, and support).
• Personalize stories based on Parent inputs and selected preferences.
• Process uploaded images (including Child Photos) to create stylized story visuals (Section 8).
• Maintain security and integrity (fraud prevention, abuse detection, troubleshooting, enforcement).
• Improve the Services (analytics, debugging, performance monitoring, feature development).
• Communicate with you about service-related matters (support responses, important notices).
• Comply with legal obligations and respond to lawful requests.

Where GDPR or UK GDPR applies, we rely on one or more of:

• Contract: to provide the Services you request.
• Consent: for optional features (for example uploading a Child Photo) and marketing where required by law.
• Legitimate interests: to secure, maintain, and improve the Services, balanced against your rights.
• Legal obligation: to comply with applicable laws.

We do not sell personal information for money. We share information only as described below:

A) Service Providers (Processors)

We use trusted vendors to help operate the Services (hosting, storage, analytics, crash reporting, customer support, and AI processing). They may access information only to provide services on our behalf and must protect it.

B) App Stores and Platform Providers

Apple and Google process payments and may collect data under their own privacy policies. We receive limited subscription status signals described in Section 3C.

C) Legal and Safety

We may disclose information if we believe it is reasonably necessary to:

• comply with law, regulation, legal process, or governmental request,
• protect safety, rights, property, or security of users or the public,
• detect, prevent, or address fraud, abuse, or security issues.

D) Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.

The Services are designed for Parents. We do not knowingly use Child Data for behavioral advertising.

We do not build advertising profiles about children.

Please do not submit sensitive information (for example medical details) in free-text prompts.

A) What We Do With Uploaded Photos

The child's photo and limited profile information needed for personalization are securely processed using OpenAI solely to create personalized illustrations:

• create an illustration-style depiction suitable for story visuals, and
• generate related images aligned to the story context and Parent selections.

B) Identification and Biometric Use

We do not use uploaded photos for identity verification, facial recognition, or to identify a child in the real world. We do not intentionally create or store biometric identifiers (for example faceprints) for identification purposes.

C) Model Training

We do not intentionally use Child Photos to train our own general-purpose AI models. OpenAI is the only AI provider currently used and may process inputs to provide outputs. Where available, we use provider settings and contractual controls designed to restrict providers from using customer content for training. If a provider's policy differs, we will reflect it in our subprocessor disclosures or in-product notices.

D) Automated Generation

Stories and images may be generated using automated systems. We do not use automated decision-making that produces legal or similarly significant effects about you or your child.

The Services are intended for Parents. Parents may provide Child Data (including Child Photos) for personalization. By providing Child Data, the Parent represents they are the child's parent or legal guardian and consent to our processing of that data for the purposes described in this Policy.

If you believe we collected Child Data without proper consent, contact us at service@pumistories.com and we will take appropriate steps, including deletion where required.

We retain information only as long as reasonably necessary for the purposes described in this Policy:

• Account Data: while your account is active and for a reasonable period after to comply with law, resolve disputes, and enforce agreements.
• Generated Content (stories and images): retained until you delete it or delete your account, unless we must retain certain records for legal reasons.
• Child Photos: retained only as needed to provide photo-based features and allow reuse, unless you delete them or delete your account.
• Logs and Diagnostics: typically retained for a limited period for security and reliability (for example 30 to 180 days), then deleted or de-identified, unless a longer period is required to investigate security incidents or comply with law.

When an account is deleted we keep a small deletion record so we can prove the deletion happened and answer a later billing or legal query. It contains a one-way hash of your email address rather than the address itself, the date of deletion, and coarse billing facts such as which plan was held and when. It cannot be used to reconstruct your account, and we cannot use it to contact you.

We also keep pseudonymous usage counts — for example the number of stories created on a given day — that were recorded before deletion. These contain no name, email address, photograph or story content and are not linked back to you.

We use reasonable safeguards designed to protect information, including encryption in transit, access controls, and least-privilege access. No system is completely secure, and we cannot guarantee absolute security.

We may process and store information in countries other than your own. Where required, we use appropriate safeguards (for example Standard Contractual Clauses) or other lawful mechanisms.

A) Access, Deletion, and Account Controls

The primary way to delete your account is in the app itself: Profile → Delete account. You do not need to contact us, and the deletion runs immediately rather than being queued for manual handling.

You can also delete an individual child profile in the app without closing your account. Doing so removes that child's profile, their photograph, the illustrations and reference images generated from it, and the stories created for them. Other children on the account are unaffected.

If you no longer have access to the app, you may request deletion by emailing service@pumistories.com from the email address linked to your account, with the subject line “Delete My Account”. The same address can be used to request deletion of specific Child Photos or generated content. We may ask you to verify your request before completing deletion, and we aim to complete verified requests within 30 days.

Deleting your account does not cancel your subscription. Subscriptions are managed by Apple or Google, not by us, so please cancel in your store subscription settings before deleting.

Deletion is permanent. Once it completes we cannot restore your stories, images or account. Step-by-step instructions are on our account deletion page.

B) GDPR/UK GDPR Rights (If Applicable)

You may have the right to access, correct, delete, restrict processing, object, and request data portability, and to withdraw consent where processing is based on consent. You may also lodge a complaint with a supervisory authority.

C) US State Privacy Rights (If Applicable)

Depending on your state, you may have rights to know, access, delete, and correct certain personal information. We do not knowingly sell children's personal information.

D) Canada (If Applicable)

You may request access to and correction of your personal information and ask questions about our practices via service@pumistories.com.

We may send push notifications for service-related messages (for example “your story is ready”). You can disable notifications via device settings.

If we send marketing emails where permitted by law, you can opt out using the unsubscribe mechanism or by contacting us.

The Services may link to third-party sites or services. We are not responsible for third-party privacy practices.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required. The “Last Updated” date reflects the latest version.

We use third-party service providers to help deliver the Services (for example hosting, storage, analytics, crash reporting, customer support, and AI processing). You may request a current list of key subprocessors and their roles by emailing service@pumistories.com.