Privacy Policy
This Privacy Policy explains how My Little Tale collects, uses, stores and shares personal data when you use the My Little Tale Telegram Mini App, the @MyLittleTaleBot bot and the My Little Tale website.
We process personal data in accordance with the European Union General Data Protection Regulation (GDPR) and other applicable laws.
1. Who is responsible for processing your data
The data controller is:
FOP Tiodorov Yevhen Kostiantynovych
Individual entrepreneur
Dnipro, Ukraine
Postal address: 10 Volodymyra Monomakha St., Apt. 7, Dnipro, Ukraine
Email: support@mylittletale.top
For privacy enquiries or to exercise your data-protection rights, contact:
2. Who may use the Service
My Little Tale is intended for use by adults.
A child’s profile may be created only by the child’s parent or legal guardian. By creating a profile, the user confirms that they have the right to provide the child’s personal data and photographs.
A child does not independently create an account or enter into a contract with us.
A parent or legal guardian may request access to, correction of or deletion of the child’s data on the child’s behalf.
We recommend using the child’s first name or nickname rather than their full legal name and not adding information that is unnecessary for creating a story.
3. What data we collect
3.1. Telegram user data
We may receive the following information from Telegram:
- Telegram user ID;
- first name and display name;
- Telegram username, if provided;
- app or device language;
- profile photograph, if provided by Telegram;
- Mini App session identifier;
- technical information required to verify the authenticity of Telegram data.
We retain only the data necessary to operate the Service.
3.2. Child profile data
We process information that you add to a child’s profile, including:
- first name or nickname;
- age;
- interests;
- appearance description;
- preferred story themes and morals;
- information about family members, friends, toys and pets;
- other information you voluntarily provide.
The child’s name and age are required to create a personalized story. Other information is optional.
3.3. Photographs
You may voluntarily upload:
- a photograph of the child;
- photographs of family members or friends;
- photographs of toys, pets or other characters.
Photographs are used only to create characters and illustrations resembling the people or objects shown.
We do not use photographs:
- for advertising or marketing;
- to establish a person’s identity;
- for facial recognition;
- for biometric identification;
- for profiling;
- to train our own or third-party artificial intelligence models.
Uploading photographs is optional. Without a photograph, an illustration cannot be based on a person’s real appearance.
3.4. Requests and generated content
We process:
- selected story themes and generation settings;
- text instructions;
- generated stories;
- generated illustrations;
- generation history and information about the use of your available allowance.
3.5. Family access
If you invite another parent or legal guardian, we may process:
- their Telegram user ID;
- information about the invitation;
- the relationship between your accounts;
- shared child profiles;
- the shared library and generation allowance.
The invited user will be able to view the data and content available through family access. You are responsible for inviting the correct person.
3.6. Subscription and payment data
We may receive and retain:
- the selected plan;
- subscription status;
- subscription start, renewal, cancellation or end date;
- payment platform;
- transaction identifier;
- the number of used and available generations;
- information about refunds, payment reversals or payment disputes.
We do not receive or store full payment-card details. They are processed by Paddle or the relevant payment system.
3.7. Technical data
To operate and protect the Service, we may process:
- IP address;
- date and time of requests;
- device and browser type;
- operating system;
- app version;
- error logs;
- performance information;
- security events;
- information about suspicious or automated activity.
3.8. Support communications
If you contact customer support, we process:
- your email address;
- Telegram username or user ID;
- the content of your request;
- attached materials;
- communication history;
- information required to verify a payment or technical problem.
4. Where we obtain data
We obtain personal data:
- directly from you;
- from Telegram when you launch the bot or Mini App;
- from Paddle in connection with card payments;
- from Telegram in connection with Stars payments;
- automatically when you use the Service;
- from a person you invite to family access;
- from technical and payment-infrastructure providers.
5. Why we process data and our legal bases
| Processing purpose | Data | Legal basis |
|---|---|---|
| Creating and maintaining an account | Telegram ID, language and profile data | Performance of a contract — GDPR Article 6(1)(b) |
| Providing subscriptions and managing allowances | Plan, subscription status and generations | Performance of a contract — GDPR Article 6(1)(b) |
| Creating stories and illustrations | Profile data, requests and generated content | Performance of a contract with the adult user — GDPR Article 6(1)(b) |
| Processing essential child profile data | Name, age, interests and other information provided by the guardian | Our legitimate interest in providing the Service requested by the guardian — GDPR Article 6(1)(f) |
| Using optional photographs | Uploaded photographs | Consent — GDPR Article 6(1)(a) |
| Providing family access | Invited user’s Telegram ID, shared profiles and library | Performance of a contract and our legitimate interest in providing family-access features |
| Payments, subscriptions and refunds | Transactions, payment and subscription status | Performance of a contract and compliance with legal obligations — GDPR Articles 6(1)(b) and 6(1)(c) |
| Security and abuse prevention | IP address, logs and security events | Legitimate interests — GDPR Article 6(1)(f) |
| Technical support | Communications, account and transaction data | Performance of a contract and legitimate interests |
| Compliance with legal requirements | Necessary records and documents | Legal obligation — GDPR Article 6(1)(c) |
| Protection of our legal rights | Communications, payments, logs and consent records | Legitimate interests — GDPR Article 6(1)(f) |
| Website analytics | Cookie ID, IP address, browser and visit events | Consent — GDPR Article 6(1)(a) |
Our legitimate interests include providing features requested by a parent or guardian, maintaining security, preventing fraud, resolving errors and protecting our rights.
When processing children’s data, we limit the information collected, do not use it for advertising or profiling, and allow the parent or guardian to delete it.
6. Consent to photograph processing
Before uploading a photograph, you will be asked to confirm that:
- you are the child’s parent or legal guardian or have the necessary permission;
- uploading the photograph is voluntary;
- the photograph will be processed to create a similar-looking illustration;
- the photograph will be shared with the AI provider required to generate the image.
You may withdraw your consent at any time by deleting the photograph in the Service or contacting us.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal and does not automatically delete previously generated illustrations. You may delete them separately together with the relevant story or account.
7. How we use artificial intelligence
We use the commercial APIs of the following providers to create content.
7.1. Anthropic
Anthropic (Claude) generates the story text.
The following information may be shared with Anthropic for generation:
- the child’s first name or nickname and age;
- interests;
- selected theme and moral;
- character descriptions;
- information about family members, friends, toys and pets;
- other text instructions required for the story.
The child’s photograph is not shared with Anthropic to generate text unless a separately selected feature requires it and the user is informed.
Anthropic processes this data on our behalf as a processor under its Commercial Terms and Data Processing Addendum.
By default, data submitted through Anthropic’s commercial API is not used to train its models. The standard retention period for API inputs and outputs is up to 30 days, except where longer retention is required for legal, security, policy-enforcement or feature-specific reasons.
Anthropic documents:
7.2. OpenAI
OpenAI (gpt-image-1) generates illustrations.
The following information may be shared with OpenAI for generation:
- character descriptions;
- necessary profile information;
- part of the story or a scene description;
- selected illustration style;
- optional photographs, if you choose to use them to create similar-looking characters.
OpenAI processes this data on our behalf as a processor under the OpenAI Services Agreement and Data Processing Addendum.
By default, OpenAI does not use commercial API data to train its models. API inputs and outputs may be retained for up to 30 days to provide the services, maintain security and detect abuse, except for specific features, configurations or circumstances required by law.
OpenAI documents:
7.3. Restrictions on the use of data for training
We do not enable the voluntary sharing of API inputs or outputs with Anthropic or OpenAI for training or improving their models.
We do not use children’s data, photographs, stories or illustrations to train our own models.
8. Payment and platform services
8.1. Paddle
Paddle processes card payments on our external website as our authorized reseller and Merchant of Record.
For payment collection, taxes, buyer verification, refunds and fraud prevention, Paddle acts as an independent data controller.
Paddle may share with us the information required to:
- activate a subscription;
- identify a transaction;
- support a buyer;
- process a refund or dispute;
- comply with financial and legal obligations.
We and Paddle are independently responsible for the processing carried out within our respective functions.
Paddle documents:
8.2. Telegram
Telegram provides the platform, user account, Mini App, bot and Telegram Stars payments.
Telegram independently determines how it processes data in connection with its platform, the purchase of Stars and the operation of Telegram accounts.
We are responsible for the data we receive from Telegram and process directly through My Little Tale.
Telegram documents:
9. Who we share data with
We may share personal data with the following recipients:
| Recipient | Purpose |
|---|---|
| Anthropic | Generating story text |
| OpenAI | Generating illustrations |
| Paddle | Card payments, subscriptions, taxes and refunds |
| Telegram | Operation of the bot, Mini App and Stars payments |
| Google Analytics | Website analytics after consent has been obtained |
| Hosting Ukraine LLC | Hosting the application, database and files |
| Email provider | Processing customer-support communications |
| Invited family-access participant | Shared profiles, library and allowances |
| Lawyers, accountants and advisers | Compliance with legal and financial obligations |
| Courts and public authorities | Only where disclosure is required by law |
We do not sell or rent personal data.
We do not share data with advertising networks or use it for personalized advertising.
10. International data transfers
Some providers may process data outside Ukraine and the European Economic Area, including in the United States.
Where the GDPR requires additional safeguards, transfers are made on the basis of:
- European Commission adequacy decisions;
- European Union Standard Contractual Clauses;
- the relevant provider’s data-protection addendum;
- other mechanisms permitted under Chapter V of the GDPR.
The OpenAI and Anthropic Data Processing Addenda include relevant contractual safeguards for international data transfers. Data sharing between us and Paddle is governed by the Paddle Data Sharing Addendum.
You may request additional information about the safeguards used by contacting support@mylittletale.top.
11. How long we retain data
We retain personal data only for as long as necessary for the purposes described in this Policy.
11.1. Profiles and accounts
- A child’s profile and photograph may be deleted at any time.
- Free accounts that have never had a subscription are automatically deleted after 14 days of inactivity. Where reasonably possible, we warn the user in advance.
- After a subscription ends, the account is deleted after 30 days unless the subscription is renewed. Where reasonably possible, we warn the user in advance.
- The user may delete the entire account earlier through the Service.
11.2. Stories and illustrations
Generated stories and illustrations are retained in the library for no longer than 30 days unless the user deletes them earlier.
After the retention period expires, the story is deleted together with its related illustrations.
11.3. Technical logs
Technical logs are normally retained for no longer than 30 days.
Individual records may be retained for longer where necessary to investigate a security incident, prevent fraud, resolve a dispute or comply with legal requirements.
11.4. Payments and legal records
Information about payments, refunds, taxes and legally significant consent records is retained for the period required under applicable tax, accounting and other laws.
11.5. Support
Customer-support communications are retained for as long as necessary to handle the request, resolve a potential dispute and protect our legal rights.
11.6. Backups
We do not create separate scheduled backups of user stories, photographs or profiles.
After deletion, information may remain temporarily in technical systems only to the extent necessary to safely complete the deletion process or comply with legal requirements.
12. How we protect data
We use technical and organizational security measures, including:
- encryption of connections while data is in transit;
- encryption of sensitive fields and photographs at rest using AES-256-GCM;
- a separate key for each account;
- storage of master key material separately from the database;
- restricted access to production systems;
- authentication of data received from Telegram;
- security logs;
- retention limits;
- minimization of data shared with providers.
Payment-card details do not reach our servers.
Despite these measures, no method of storing or transmitting information can guarantee absolute security.
13. Cookies and local storage
The Telegram Mini App does not use advertising cookies.
The following information may be stored in the browser’s local storage on the user’s device:
- selected language;
- interface settings;
- user decisions regarding cookies and consent;
- technical data required for the session.
Our website uses Google Analytics cookies only after the user has provided consent.
You may change or withdraw your consent at any time through “Cookie settings.” Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
14. Automated decision-making
We do not sell data, use it for advertising profiling, or make decisions that produce legal or similarly significant effects solely through automated processing within the meaning of Article 22 GDPR.
Artificial intelligence is used to create stories and illustrations, not to assess a child or determine their abilities, health, behaviour or other personal characteristics.
15. Your rights
Depending on applicable law, you have the right to:
- obtain confirmation that your data is being processed;
- access your data;
- obtain a copy of your data;
- correct inaccurate data;
- erase data;
- restrict processing;
- object to processing based on legitimate interests;
- receive data in a portable format;
- withdraw consent;
- lodge a complaint with a supervisory authority.
You may delete a child’s profile, photograph, story or your entire account directly through the Service.
To exercise any other right, contact support@mylittletale.top.
We may request information necessary to verify your identity and your authority to act on behalf of the child.
We respond to requests within one month unless the law permits an extension.
16. Complaints
You may lodge a complaint with a data-protection supervisory authority:
- in the European Union, with the authority in the country of your residence, place of work or the alleged infringement;
- in Ukraine, with the Ukrainian Parliament Commissioner for Human Rights.
Contacting a supervisory authority does not affect your right to contact us or bring a claim before a court.
17. Changes to this Policy
We may update this Policy from time to time.
The current version will be published on this page with an updated revision date.
If changes materially affect how personal data is used or require new consent, we will notify the user and, where necessary, request separate consent.
18. Contact
For questions about privacy, data deletion or the exercise of your rights, contact:
FOP Tiodorov Yevhen Kostiantynovych
Dnipro, Ukraine
Postal address: 10 Volodymyra Monomakha St., Apt. 7, Dnipro, Ukraine
Email: support@mylittletale.top