AI-Koma Kids
EN
Create my storyCreate

Privacy policy

This English version is a courtesy translation. The French version prevails. Version of 3 November 2026. What we record, why, on what legal basis, with whom, for how long, and how to exercise your rights (General Data Protection Regulation, “GDPR”, and the French Data Protection Act).

1. Controller

Florent Puccini, entrepreneur individuel (EI), Chemin de la Daby, 83330 Le Beausset, France, publisher of AI-Koma Kids, is the controller. Contact for any question or to exercise your rights: contact@aikomakids.com. AI-Koma Kids has not appointed a data protection officer; this contact acts as such.

2. What we record, why and for how long

  • Account (email address; hashed password, managed by Supabase Auth and never readable by us; optional display name; dates of sign-up, of email confirmation and of acceptance of the terms; account status). Why: to provide the service. Basis: performance of the contract. Duration: until the account is deleted, which you can do at any time from “My account”.
  • Books (closed choices, age range, optional first name, optional value, title, texts, illustrations and, if the option was used, the reading audio). Why: to create your books and show them to you. Basis: performance of the contract. Duration: until you delete the book or your account. Books created with subscription credits or with the free book are erased at the latest thirty days after your subscription ends (or thirty days after the account is opened if you have never subscribed): texts, illustrations and audio are then erased for good, after a notice in your library and by email. Books created with an extra book bought individually are kept as long as the account exists. Any deletion is immediate and permanent. Only you can see the books.
  • Cuddly toys (name, short description of the toy, drawn portrait). The photo you send is never kept: it is only used to check it and draw the portrait. Why: to make the cuddly toy appear in your books. Basis: performance of the contract. Duration: a cuddly toy you remove is erased at once if none of your books uses it; otherwise it is only hidden. Everything is erased with your account.
  • Free book (an irreversible fingerprint (hash) of your email address, never the address itself). Why: to give the first book only once per address, even after an account is deleted. Basis: legitimate interest (preventing abuse of a free offer). Duration: three years, including after the account is deleted.
  • Credits and payments (credit movements, subscription, extra books, customer identifier at Stripe). We never receive or keep your card number. Basis: contract and accounting obligations. Duration: accounting records ten years (French commercial code, art. L123-22), including after the account is deleted.
  • Technical log (errors, content refusals by the automated checks with a short reason, never the full text of a book). Basis: legitimate interest (security, abuse prevention, proper operation). Duration: twelve months, then automatic erasure.
  • Internal usage measurement (section 8). Basis: legitimate interest (understanding and improving the service). Duration: erased when the account is deleted, and at the latest after twenty-four months.
  • Service emails (email confirmation at sign-up, link to choose a new password, notice before the books in your library are erased), sent to your email address, never advertising. Basis: performance of the contract.
  • Newsletter, only if you accept it (optional box at sign-up or button in “My account”): your email address and the date of your consent. Why: to write to you from time to time about our news (new worlds, new characters, reading ideas), never advertising for other brands. Legal basis: your consent, which you can withdraw at any time in “My account” or with the link in every newsletter. Duration: until you withdraw your consent or delete your account.
  • IP address: used in memory to limit login attempts, never stored in our database; our hosting providers keep it briefly in their access logs, for security.

The email address and password are mandatory: without them, we cannot open an account. We do not ask for your name or postal address, except your name if you withdraw from a purchase. No advertising, no commercial profiling, no data resale, no marketing email without your consent.

3. Your child’s data

We record as little as possible. Your child has no account and we build no profile about them. For each book, we record only their age range (3-5, 6-8 or 9-12; never their date of birth) and, if you wish, their first name (or a nickname) as well as a value chosen from a list. No photo of your child, no free text and no other information are requested; the only photo accepted is one of their cuddly toy or toy, with no person.

This data is processed on the basis of the contract concluded with you, the parent or legal guardian, and is used only to write, illustrate and read the book; it is neither published nor used to train models. The first name is sent to OpenAI to write the story and to Microsoft (Azure Speech) to prepare the reading voice of each page; it is never sent for the illustrations, nor linked to your email address at these providers. If you prefer, use a nickname or leave the field empty: the book is then written without a first name. You erase this data at any time by deleting the book or your account.

4. Who receives your data

Apart from the team and Stripe, these recipients are our processors (GDPR, art. 28): they process your data on our behalf, on our instructions and only for the task described.

  • The AI-Koma Kids team, for operations and support.
  • Render Services, Inc. (United States): application hosting, servers in Frankfurt (Germany).
  • Supabase Pte. Ltd. (Singapore): database, accounts, book files and sending of service emails, servers in Ireland (European Union).
  • OpenAI (United States): writing the story and moderating the text; it receives your choices, the age range and the optional first name and, if you add a cuddly toy, its photo to check and describe it; never your email address. According to its policy for API services, it keeps this data for thirty days at most for abuse monitoring and does not use it to train its models.
  • fal.ai (United States): illustrations; it receives the scene descriptions, without the first name, the characters’ portraits and, if you add a cuddly toy, its photo to draw its portrait. Retention under its own terms.
  • Microsoft Ireland Operations Ltd (Ireland), Azure Speech service: reading voice, prepared for every book; it receives the text of the pages, first name included, processed on servers located in France. Retention under its own terms.
  • Stripe Payments Europe, Ltd. (Ireland), Stripe group (United States): payment; it receives your email address and processes your card data, for which it is responsible.
  • Resend, Inc. (United States), sending of service emails from servers located in Ireland: it receives your email address and the text of the email, for example the notice before books are erased.
  • Google Ireland Limited (Ireland), Google group (United States), Google Analytics service: audience measurement of the public pages, only if you accept it (section 7); it receives the browsing information described in section 7, never your email address or the data of your books. Transfers to the United States rely on the EU–US Data Privacy Framework, under which Google LLC is certified.

Transfers outside the European Union. Your data is hosted in the European Union (Germany, Ireland). Some providers are established outside the European Union and may access it or receive part of it: OpenAI, fal.ai, Render, Resend and the Stripe group in the United States, Supabase in Singapore. These transfers rely, as the case may be, on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023), for the US companies certified under it, and on the European Commission’s standard contractual clauses. You can obtain a copy of these safeguards by writing to contact@aikomakids.com.

5. Automated decisions

The text and illustrations of every book, as well as the photo of a cuddly toy, are checked automatically to remain suitable for children: a book may be refused before being shown, its credit is then returned; a photo may be refused, it is then not used. You are informed of it. On simple request to contact@aikomakids.com, a person reviews any automated decision concerning you and you can express your point of view.

6. Your rights

You may access your data, have it corrected or erased, restrict its processing, object to processing based on our legitimate interest and get your data back in a reusable format: each book can be downloaded as a PDF from your account (think of it before your library’s retention period ends, section 2), and you can ask us for a copy of your account data. Deleting a book or the account can be done at any time from “My account” and takes effect immediately. You may also set instructions on what happens to your data after your death (French Data Protection Act, art. 85). Write to contact@aikomakids.com: we answer within one month. You may lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, France (cnil.fr).

7. Cookies and local storage

Strictly necessary cookies, set without asking for your consent: your session cookie, which keeps you signed in (HttpOnly). The language of the site is read from the page address (/en, /es, /pt, /it, /de): no cookie is set for it. No advertising cookie.

Audience measurement with Google Analytics, only if you accept it. On the public pages of the site (home, plans, sample, blog…), a banner asks whether you accept that Google Analytics measures the audience. Until you click “Accept”, nothing is loaded or sent to Google. If you accept, Google sets measurement cookies (_ga) lasting thirteen months at most and receives the address of the page viewed (without parameters), the previous page, your type of device and browser and an approximate location; advertising signals are turned off and Google Analytics is never loaded in your library, your books or your account: it never receives your email address, your child’s first name or the text of the books. Legal basis: your consent. Your choice is kept for six months in your browser; you can change it at any time with the “Cookies” link at the bottom of every page, and declining does not stop you from using the site.

The reader’s preferences (text size, reading voice, sound effects) stay in your browser (local storage) and are not sent to us.

8. Internal usage measurement

To know whether the service works and what is useful to families, we record a few events ourselves: book started, finished or failed, reading time, website pages viewed (address without parameters). These events are linked to your account identifier, never to the child’s first name or to the text of the books. This measurement is done without cookies and without any third party; it is erased when your account is deleted and at the latest after twenty-four months. Legal basis: our legitimate interest in understanding and improving the service; you may object by writing to contact@aikomakids.com.

9. Security and incidents

Encrypted connection (HTTPS), hashed passwords, book files stored in a private space reachable only through short-lived signed links from your account, restricted admin access, backups at our hosting providers. In the event of a data breach, we record it, notify the CNIL within 72 hours when it presents a risk, and inform you if the risk is high.

10. Changes to this policy

A significant change is announced on the website before it takes effect. The version in force is always the one on this page.

Legal notice · Terms and conditions