Privacy Policy

1. Introduction

1.1. This Privacy Policy describes how Evallume LLC ("Company," "we," "us") collects, uses, and shares information when you use skazka.ai and related services (the "Service"). Evallume LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA; privacy@skazka.ai. Cookies are addressed in the Cookie Policy; biometric data in the Biometric Data Consent.

2. Information We Collect

• Account information: email address; if you sign in with Google or Facebook, also the name, profile picture, and account identifier that provider shares with us (and a technical placeholder in place of the email address if the provider does not share one).
• Child's information (provided by a parent/guardian): first name, age range, gender, eye color, interests, and a photo (to create the Avatar).
• Photos of other people (for example, family members) that you choose to add as characters, which you may upload only with their consent.
• Voice recording of the adult Customer — only when ordering voice narration (Audio Clone).
• Contact and shipping address — for printed-book orders.
• Waitlist: if you tap "I want this" in the "What else should we make from your story?" block, or "Get notified" for a product we haven't launched, your email address, the product, and when you tapped.
• Payment information: transaction data (processed by our payment providers; we do not store full card numbers).
• Device information: IP address and the approximate country derived from it, browser type, operating system, device type, and a random device identifier stored in your browser.
• Usage data: pages you visit, steps you take in the story-creation flow, scroll depth and time on a page, the referring site and campaign parameters of the link you arrived by, and technical error reports. Our own servers record these whatever you choose in the cookie banner (see the Cookie Policy, §3.2); third-party analytics (Google Analytics) records its own statistics only where you allow it.

3. Photos and Voice (Biometric Data)

3.1. Photos. To create the Avatar, the photo you upload is stored in our private cloud storage and sent to our image-generation provider, OpenAI (United States), which processes it on our behalf only to generate Avatar options. The original photo is deleted when you choose an Avatar. If you do not choose one, a nightly cleanup deletes the original photo (and any unselected options) once the character it belongs to has gone 3 days without changes, and a daily backstop sweep deletes any remaining original once it is 7 days old; a photo is kept longer only while a generation that needs it is still running. The Avatar — a stylized depiction — is stored in your account and is sent to OpenAI as a reference each time illustrations for your stories are generated, until you delete your account or ask us to delete it.

3.2. Voice recordings. For narration in the Customer's voice (Audio Clone), the voice recording you provide is stored in our private cloud storage and kept in your account so that it can be used for every narration you order. Each time a narration or a preview is produced, we send the recording to our speech-synthesis provider, ElevenLabs, which creates a temporary voice model on our behalf; that model is deleted right after the narration is produced (a safety job deletes any leftover temporary model within hours). Voices set up before we moved to temporary models are the exception: we no longer hold the original recording of such a voice, and the voice model made from it stays at ElevenLabs until you delete the voice in your account or ask us to delete it. You can delete a voice recording at any time in your account or by emailing privacy@skazka.ai, and in any case we delete it no later than 3 years after you last used it for a narration (a recording that was never used, no later than 3 years after it was made). Audio Clone is for the adult Customer's own voice only: recording a child's voice or another person's voice is not allowed.

3.3. The photo and the voice recording are treated as biometric data and are processed only on the basis of your separate explicit consent (see the Biometric Data Consent; GDPR Art. 9(2)(a); and, where applicable, U.S. state biometric laws such as Illinois BIPA), solely to provide the Service. We do not use them for advertising or identification, and we do not sell, lease, or trade them. The retention schedule and destruction guidelines are published in the Biometric Data Consent.

4. How We Use Information and Legal Bases

We use information to create and deliver personalized stories and audio; process payments; send order confirmations and notifications; provide support; email you once when a product you asked about launches (waitlist); operate, secure, and improve the Service (including through our own usage statistics); and comply with legal obligations. Under the GDPR, our legal bases are: performance of a contract; your consent (including separate explicit consent for biometric data and for marketing); our legitimate interests; and legal obligations.

5. Children's Privacy (COPPA)

5.1. The Service is for adults; children under 13 may not use it directly. We collect a child's information only from the parent/guardian, who represents they are authorized to provide it and to consent on the child's behalf.

5.2. Consistent with the amended COPPA Rule, a child's photo and any voice data are treated as personal information (biometric identifiers); we maintain a data-retention policy and do not retain such data longer than necessary. We obtain separate parental consent before disclosing a child's data to third parties where such disclosure is not integral to the Service.

5.3. Parental rights. You may review your child's information, request its deletion, refuse further collection or use, and withdraw consent, by contacting privacy@skazka.ai (we respond within 30 days).

6. Subprocessors and Sharing

We share the minimum necessary information with subprocessors, which process it on our behalf to provide the Service:

• OpenAI (United States) — story-text and illustration generation, including processing of your child's photo (to create the Avatar) and of the Avatar (as a reference for illustrations);
• ElevenLabs — voice synthesis and temporary voice cloning for Audio Clone; receives your voice recording each time a narration or a preview is produced; for a voice set up before we moved to temporary models it also keeps the voice model made earlier (see §3.2);
• Replicate (United States) — image generation, used only when our team redraws an illustration of your book at your request: it receives the scene description, the child's first name, and your book's existing stylized illustrations as references (not the original photo);
• Cloudflare — cloud storage of files (photos, voice recordings, avatars, illustrations, books);
• Resend — delivery of email;
• Lulu — printing and shipping of physical books: receives the recipient's name, shipping address, phone number, and email address, and the print files of your book (its text and illustrations, which include the child's name and any dedication you added);
• Lemon Squeezy — Merchant of Record and payment processing (Online/Digital/Audio);
• Stripe — payment processing for printed books;
• Analytics and advertising, only if you allow them: Google Analytics (analytics); Meta Pixel, TikTok Pixel, Pinterest Tag, and Google Ads (advertising). Purchase and sign-up (account registration) events may also be sent from our servers: to Meta (Purchase, CompleteRegistration), TikTok (CompletePayment, CompleteRegistration), and Pinterest (checkout, sign-up) only when advertising is on — with your email address and your account ID, and for TikTok the phone number you gave for delivery, each in hashed form, plus your IP address, browser details, and advertising click identifiers — and to Google Analytics (purchase) only when analytics is on, with a device identifier and the order value. See the Cookie Policy;
• Hosting: cloud servers (United States).

We do not sell or rent children's personal information, and we do not share it with third parties for marketing purposes. The providers above receive it only to perform the services described in this Policy.

7. International Data Transfers

7.1. Your information may be processed in the United States and other countries where our providers operate. For transfers from the EU/EEA/UK, we rely on the EU-U.S. Data Privacy Framework where available and, as a safeguard, on the European Commission's Standard Contractual Clauses (and the UK Addendum). You may request information about these safeguards at privacy@skazka.ai.

8. Retention and Deletion

• Original photos: deleted when you choose an Avatar; if you do not, a nightly cleanup deletes the original once the character it belongs to has gone 3 days without changes, and a daily backstop sweep deletes any remaining original once it is 7 days old (see §3.1).
• Voice recordings: kept in your account until you delete them or ask us to, and in any case deleted no later than 3 years after you last used them for a narration (see §3.2). Temporary voice models at the provider are deleted right after each narration or preview; a voice set up earlier may instead have a permanent voice model at the provider, which stays until you delete the voice or ask us to (see §3.2).
• Avatars and child's data: retained until account deletion or your request.
• Unpaid previews: deleted after the period stated on the Site (the avatar and child's data remain in the account).
• Waitlist: until we email you about the launch or you ask us to delete it, and in any case no longer than 12 months; then deleted.
• Account data: retained until you request deletion or close your account.
• Usage statistics: kept on our servers for as long as needed to run and improve the Service; you can ask us to delete the records linked to you.
• Transaction records: retained for the period required by applicable accounting and tax law.

You may request deletion at any time at privacy@skazka.ai. The full biometric retention schedule is in the Biometric Data Consent.

9. Cookies

9.1. We use cookies and similar technologies; details and choices are in the Cookie Policy. Cookies and tools that are not strictly necessary — analytics and advertising — are loaded or set only after you click "Accept all" or switch the category on in "Settings". You can click "Reject all" or simply leave them off, and you can change your choice at any time through "Cookie settings" in the footer. If your browser sends a Global Privacy Control (GPC) signal, we keep advertising off.

10. Your Rights

10.1. GDPR (EU/EEA/UK): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with your local supervisory authority.

10.2. California (CCPA/CPRA): the right to know, delete, correct, and opt out of the sale/sharing of personal information. If you click "Accept all" (or turn advertising on in "Settings"), advertising tools from Meta, TikTok, Pinterest, and Google may collect information about your visit — such as pages viewed, device and browser identifiers, and, on a purchase, a hashed email address — for cross-context behavioral advertising, which California law may treat as "sharing" of personal information. These tools are off until you allow them, stay off if you click "Reject all" or your browser sends a Global Privacy Control signal, and you can switch them off at any time with the "Do Not Sell or Share My Personal Information" link in the footer of the U.S. site (or with "Cookie settings" in the footer of any version of the Site). We do not sell your child's photo, your voice recording, or the content of your stories, and we do not sell the personal information of consumers under 16.

10.3. To exercise any right, contact privacy@skazka.ai.

11. Contact for the EU and the UK

11.1. If you are in the EU/EEA or the UK, you can exercise the rights described in §10.1 and ask questions about this Policy by writing to support@skazka.ai; we respond within 30 days.

12. Data Security

12.1. We use SSL/TLS encryption in transit, access controls, and other measures. No method of internet transmission is 100% secure, and we cannot guarantee absolute security.

13. Changes to This Policy

13.1. We may update this Policy. We will post the new Policy with its version number and date and, for material changes, provide additional notice. Version history is retained.

14. Contact