Privacy Policy

This policy explains what data we collect, why, and for how long. Controller: Arsenii Bandurin; requisites are on the Contact page. We do not call ourselves an “EU GDPR controller”: the seller is a Georgian IE and there is no EU representative. Buyers in Israel and elsewhere get the same transparency.

1. Parent data

Name, email, phone, billing address if provided, order history, selected plan and currency, technical logs: IP, interface language, consent version, sign-in time. For a printed book — recipient, phone and delivery address.

We do not store the card number, expiry or CVV and do not ask for them on our forms. TBC Bank or lava.top processes those on their page.

2. Child data

Name, age band (2–12), gender, interests, appearance and story prompt, companions and, if uploaded, a photo. These data exist to build the story, not a marketing profile of the child. Service email goes to the parent, not the child.

We do not publish your child’s full name in public SEO samples. Demos on the home page are separate public copies, not your order.

3. Photos

The original photo is kept for no more than 24 hours and then deleted. The book uses a stylised character. If a photo was uploaded, checkout asks for separate consent. A guest link to the finished story does not contain the original photo.

We do not sell photos or send them to ad networks. Vision analysis is only used to describe appearance for generation.

4. Purposes and legal bases

We process data to perform the contract (generation, delivery, print shipping), to provide support, to prevent fraud, to answer the bank on a disputed payment (cardholder fields for at least 6 months) and to keep records Georgian accounting requires.

Bases: the contract with you; consent — for the photo and for child data you enter; legitimate interest — service security and chargeback handling. Marketing email only with separate consent and only to the parent.

5. Who we share with

TBC Bank — international card acquiring. lava.top — payments from Russia. Hosting, message queues and generation (text, images, speech) — infrastructure without which the story cannot be built. A sandbox administrator may see the request to fix defects.

We do not sell personal data. Cross-border transfer is possible: processors and cloud may sit outside Georgia. We do not claim every contractor is a Georgian resident.

6. Retention

Questionnaires and story files are kept while the account needs re-download (up to 12 months on request, then deletion on request unless we must keep them). Payment and order records for at least 6 months and for as long as Georgian accounting rules require (years, not days: invoices are not wiped when you download the PDF).

Original photos — up to 24 hours. Access logs — a limited security window.

7. Your rights

You may request a copy, correction, deletion (where we are not required to keep data for the bank or tax), and withdrawal of photo consent. Email hello@taleori.com from the order address. We will not delete a payment record the law requires us to keep.

To stop marketing, reply to the message or write to the same inbox. Transactional email for a paid order cannot be switched off: that is how the download link arrives.

8. Children

We do not collect data “to market to the child” and we do not run a child account. The contract is with an adult. If a teenager writes without a parent, we will ask a guardian to contact us.

9. Security and cookies

The site is served over HTTPS. Passwords are hashed. Card entry is described in Transaction Security. Cookies are described in the Cookie Policy. The banner offers necessary or all; analytics do not load without consent.

10. Billing fields for the bank

Under the acquirer contract we keep the cardholder name, address, phone and email linked to the order for at least 6 months and give them to the bank on a dispute. That is not “we store the card”. The full PAN does not live on our servers.

11. Hosting and the generation queue

Text, images and speech are computed by workers and stored in object storage. A sandbox administrator may see the request to fix a bad frame. That is processing to perform the contract, not a sale of a database. Queue logs hold a story id, not the child’s passport.

12. Changes

A new version is published on this page with a new date. Data questions: hello@taleori.com. If a change alters photo purposes or original-photo retention, new orders will ask for consent again at checkout; an original already deleted is not restored.