Privacy Policy

1. Who we are (data controller)

Plumakids ("we", "us", "our") operates plumakids.com, an AI-assisted creative writing platform for children. The data controller responsible for your personal data is Fernando Angulo, 43004 Tarragona, Spain, contactable at privacy@plumakids.com. We are committed to protecting the privacy of children and families in compliance with the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD), and — for families in the United States — the Children's Online Privacy Protection Act (COPPA).

2. Information we collect

We collect the minimum information necessary to provide our service:

• Parent account: email address and name (via Clerk authentication).
• Child profile: first name and age range — collected only after verified parental consent.
• Story content: stories and scenes written by children, stored securely and never shared publicly without parental approval.
• Usage data: progress, XP, achievements — used only to power the in-app experience.

We do not collect precise location, phone numbers, photos of children, or any sensitive personal information beyond what is listed above. Character portraits are generated from text descriptions your child chooses (such as hair and eye colour), never from an uploaded photo.

3. Legal basis for processing

Under the GDPR we must have a legal basis for every use of your data. We rely on:

• Contract (Art. 6(1)(b)) — to create and run your account and provide the Plumakids service you signed up for.
• Consent (Art. 6(1)(a) and Art. 8) — to process your child's personal data, which we do only after you, as the parent or guardian, give consent. You may withdraw it at any time by deleting the child profile or your account.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and understand aggregate, non-identifying usage. We never use this basis for advertising.

We do not ask for special categories of personal data (Art. 9). Because stories are free-form creative writing, we ask families not to include real sensitive personal information in them. We do not make automated decisions that produce legal or similarly significant effects.

4. Children, age & parental consent

Plumakids is designed for children aged 6–14, and accounts are always created by a parent or legal guardian on the child's behalf. Under the Spanish LOPDGDD, children aged 14 or over may consent to the processing of their own data; below that age, consent must come from the holder of parental responsibility. We therefore require verified parental consent for every child profile, regardless of age, before any child information is recorded. For families in the United States this also satisfies COPPA's verifiable parental consent requirement. Parents can review, correct, or delete their child's data at any time (see "Your rights") or by emailing privacy@plumakids.com.

5. How we use your information

• To provide and improve the Plumakids service.
• To send parents optional weekly progress digests (opt-out available at any time).
• To moderate story content for safety before any public sharing.
• We never sell personal data. We never use children's data for advertising.

6. Who we share data with & international transfers

We share data only with the service providers necessary to operate Plumakids, and only for that purpose:

• Clerk — account authentication.
• Supabase — database and secure file storage.
• Anthropic (Claude) — AI writing assistance.
• Google (Gemini) — AI writing assistance, cover-image generation, and voice narration.
• fal.ai — hero-portrait and cover-image generation.

All providers are bound by data processing agreements to handle data securely and not to use it for their own purposes.

International transfers. Your child's data is stored in the European Union. Some providers (for example Clerk, Anthropic, Google, and fal.ai) are based in the United States, so running the service can involve transferring personal data outside the European Economic Area. Where that happens, we rely on transfer safeguards recognised under the GDPR — the EU–U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. You can ask us for more detail using the contact details below.

7. How long we keep your data

We keep your account and your child's data for as long as your account is active. When you request deletion or close your account, we permanently erase it within 30 days across our database and identity provider, and it is cycled out of backups shortly after. Aggregate, non-identifying usage statistics may be kept longer, as they can no longer be linked to you or your child.

8. Your rights

As the parent or guardian acting for your child — and for your own data — you have the right to:

• Access — get a copy of the personal data we hold.
• Rectification — correct data that is wrong or incomplete.
• Erasure — delete your account and all associated data (see below).
• Restriction & objection — limit or object to certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent — at any time, without affecting processing already carried out.

To exercise any of these, email privacy@plumakids.com. You also have the right to lodge a complaint with a data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD, www.aepd.es); you may also complain to the authority in your own country of residence.

9. Deleting your account & data

You may delete your account and all associated data (parent profile, every child profile, every story and scene, XP, achievements, and your Plumakids sign-in) at any time from your account settings. Deletion is permanent, irreversible, and cascades through every related record in our database and identity provider. If you prefer email-based erasure, contact privacy@plumakids.com.

10. Security

We use industry-standard security practices: encrypted connections (HTTPS), hashed credentials, and access controls. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.

11. Contact

Questions about this policy or requests to exercise your rights: privacy@plumakids.com