Transaction Security

This is Taleori’s transaction-security policy, which the bank and the parent should see before paying.

1. Where the card is entered

The card number, expiry and CVV are entered on the TBC Bank or lava.top page. Taleori forms collect email, consents and, for print, a shipping address — not the PAN. We do not write the full card number into our database or ask for a photo of the card.

This reduces the risk of card data leaking from our systems. PCI duties for card capture sit with the payment processor.

2. Transport and accounts

Taleori is served over HTTPS. The account area requires authentication. Passwords are stored as hashes, not plaintext. Do not post the “another device” link in public chats.

A guest link to the finished story does not contain the child’s original photo and must not be published with passport data.

3. 3-D Secure

If the issuer asks for 3-D Secure (SMS code, banking app), complete it there. We cannot bypass the check and we will not ask you to forward a one-time code to us.

A 3-D Secure failure is a failed payment: the story is not delivered; you may try another card or rail.

4. What we never ask for

Taleori staff will never ask for a CVV, bank password, SMS code, full card number or a passport scan “to process a refund” by chat, email or social media. If someone claiming to be Taleori asks — it is fraud. Write to hello@taleori.com and to your bank.

5. Unrecognised charges

If your statement shows a Taleori charge you do not recognise:

1. Contact your bank immediately (card block, dispute).
2. Write to us: date, amount, masked card, order email. We will check whether an order exists and help the bank with data we are required to keep.

Do not put the full PAN in the email.

6. Account and generation

Account access protects the story and questionnaire. Do not leave a session open on a shared computer. If you suspect a takeover, change the password and tell us.

Photo upload uses the encrypted channel. The original is deleted within 24 hours — see privacy.

7. Liability

We take reasonable measures but cannot guarantee the security of your device, public Wi‑Fi or mailbox. Loss from a compromised inbox that received the book link is limited under the Terms of Service.

8. Phishing and a fake “bank”

A real payment opens from our domain or from TBC / lava.top. A chat page that says “enter your card to collect the story” is not us. Check the browser address bar. We do not call you to read out a 3-D Secure code.

9. Contact

Payments and security: hello@taleori.com, +995 599 251 351, 09:00–18:00 GET, Monday–Friday.