Privacy Policy

1. Who we are (data controller)

Plumakids ("we", "us", "our") operates plumakids.com, an AI-assisted creative writing platform for children. The data controller responsible for your personal data is Fernando Angulo, 43004 Tarragona, Spain, contactable at privacy@plumakids.com. The private pilot is currently limited to families in Spain and is governed by the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. Information we collect

We collect the minimum information necessary to provide our service:

• Parent account: email address and name (via Clerk authentication).
• Child profile: first name and age range — collected only after a parent or legal guardian gives consent during onboarding.
• Story content: stories and scenes written by children, stored securely and never shared publicly without parental approval.
• Creative media: optional freehand hero drawings and any legacy portraits, covers, or illustrations retained for compatibility. New AI image generation is disabled during this pilot.
• Optional voice writing: the browser may send microphone audio to its own speech-recognition provider. Plumakids receives only the finalized transcript, stores it as story text, and does not receive or retain the microphone audio.
• Usage data: progress, XP, achievements — used only to power the in-app experience.
• AI abuse controls: a parent-linked request count for each 10-minute window — used only to prevent abuse and control AI costs.
• Limited beta operations: account-registration time, country code, and a masked network prefix for short-lived reliability and abuse diagnostics. We never store the full IP address.

The adult email and authentication data are required to open and secure the parent account. A child first name, age range, and story input are required to create that child profile and story; without them we cannot provide those parts of the service. Drawings and dictation are optional. We do not ask for precise location, phone numbers, surnames, or photographs of children. New character portraits are not generated during this pilot. Stories and drawings are free-form, so families should avoid including real-world sensitive or identifying information.

3. Legal basis for processing

Under the GDPR we must have a legal basis for every use of your data. We rely on:

• Contract (Art. 6(1)(b)) — to create and run your account and provide the Plumakids service you signed up for.
• Consent (Art. 6(1)(a) and Art. 8) — to process your child's personal data, which we do only after you, as the parent or guardian, give consent. You may withdraw it at any time by deleting the child profile or your account.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and understand aggregate, non-identifying usage. We never use this basis for advertising.

We do not ask for special categories of personal data (Art. 9). Because stories are free-form creative writing, we ask families not to include real sensitive personal information in them. We do not make automated decisions that produce legal or similarly significant effects.

4. Children, age & parental consent

The Spain private pilot is limited to children aged 9–12, and accounts are always created by a parent or legal guardian on the child's behalf. Under the Spanish LOPDGDD, children aged 14 or over may consent to the processing of their own data; below that age, consent must come from the holder of parental responsibility. We require the adult account holder to confirm their parental or guardianship authority and give consent during onboarding before a child profile is created. This confirmation does not independently verify the adult's identity, and the consent method remains under legal review for this pilot. Parents can review, correct, or delete their child's data at any time (see "Your rights") or by emailing privacy@plumakids.com.

5. How we use your information

• To provide and improve the Plumakids service.
• To provide writing and safety features requested by the family. You are interacting with AI when a Story Spirit or other AI guide responds. The AI-assisted book edition is identified in the experience, and AI output may contain mistakes. New AI images and narration are disabled during this pilot.
• To moderate story content for safety before any public sharing.
• We never sell personal data. We never use children's data for advertising.

6. Who we share data with & international transfers

We share data only with the service providers necessary to operate Plumakids, and only for that purpose:

• Clerk — account authentication.
• Supabase — database and secure file storage.
• Anthropic (Claude) — AI writing assistance.
• fal.ai — disabled during this pilot; no new child prompts or media are sent.
• Browser speech provider — optional speech-to-text is controlled by the browser and may use its vendor service; Plumakids receives only finalized text and stores no microphone audio.

Our processor and transfer register records the contract, processing terms, location, and applicable safeguard for each provider. The controller has documented the incorporated processor terms and transfer safeguards for this closed pilot of no more than ten invited families. Independent review remains required before expansion.

International transfers. Your child's database records and stored files are hosted in the European Union. Some enabled providers (for example Clerk and Anthropic) operate from or may process data in the United States, so using a feature can involve a transfer outside the European Economic Area. Their incorporated data-processing terms and transfer safeguards are recorded for this limited pilot. Google Gemini and fal.ai are disabled. You can ask us for the current register using the contact details below.

7. How long we keep your data

We keep your account, canonical stories, and creative media while your account is active. Full AI request/response interaction records and count-only writing/save telemetry expire within 30 days. During the limited beta, a masked network prefix and its rotating diagnostic hash expire within seven days, and country code expires within 30 days. We never retain the full IP address. To prevent abuse and control AI costs, we keep a parent-linked count for each 10-minute AI-request window; these counters expire within one day. When you request deletion or close your account, we immediately erase the primary database records, remove operational account, invitation, and network linkage, request identity deletion, and delete matching stored media. A daily authenticated cleanup retries and verifies orphan media so provider failures remain within the 30 days maximum. Supabase Free does not provide Plumakids with a managed recovery backup for the database or stored files, so a severe provider or operational failure could permanently lose stories or media; do not use Plumakids as the only copy of something you want to keep. Other provider backup copies follow the reviewed schedule recorded in our processor register. Aggregate, non-identifying usage statistics may be kept longer, as they can no longer be linked to you or your child.

8. Your rights

As the parent or guardian acting for your child — and for your own data — you have the right to:

• Access — get a copy of the personal data we hold.
• Rectification — correct data that is wrong or incomplete.
• Erasure — delete your account and all associated data (see below).
• Restriction & objection — limit or object to certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent — at any time, without affecting processing already carried out.

To exercise any of these, email privacy@plumakids.com. You also have the right to lodge a complaint with a data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD, www.aepd.es); you may also complain to the authority in your own country of residence.

9. Deleting your account & data

You may delete your account and all associated data (parent profile, every child profile, every story and scene, XP, achievements, and your Plumakids sign-in) at any time from your account settings. Deletion is permanent and irreversible. It cascades through related child records and immediately anonymizes beta registration, invitation, and network diagnostics before the sign-in identity is removed. If you prefer email-based erasure, contact privacy@plumakids.com.

10. Security

We use industry-standard security practices: encrypted connections (HTTPS), hashed credentials, and access controls. No system is perfectly secure — if you believe your account has been compromised, contact us immediately.

11. Contact

We have not designated a Data Protection Officer. Questions about this policy or requests to exercise your rights should be sent to our privacy contact: privacy@plumakids.com