StorySpins is a service for parents and guardians. We collect information about your child from you, as the responsible adult. We do not collect data directly from children, and we never sell personal data to third parties.
Who we are
StorySpins is operated by StorySpins, a company registered in England and Wales. Our registered address is available on request. You can contact us at [email protected].
For the purposes of UK GDPR, StorySpins is the data controller for personal data collected through StorySpins.
What data we collect
We collect the following categories of personal data:
- Your email address — to create your account, deliver stories, and communicate with you about your subscription.
- Payment information — handled entirely by Stripe. We never store your card details. Stripe's privacy policy applies to payment processing.
- Your child's profile — including their first name, age, interests, friends' names, pets, and other details you choose to share. This information is used solely to personalise bedtime stories. It is never used for advertising or shared with third parties.
- Story delivery preferences — your chosen delivery time and time zone.
- Usage data — basic technical data such as whether emails were opened, to ensure stories are being delivered correctly.
How we use your data
We use your data for the following purposes:
- To generate and deliver personalised bedtime stories to your inbox
- To manage your subscription and process payments via Stripe
- To send you transactional emails (account confirmations, billing receipts, service updates)
- To improve the quality and relevance of stories over time
- To respond to support requests
We do not use your data for advertising, profiling, or sale to third parties.
Legal basis for processing (UK GDPR)
- Contract performance — processing your email and payment details to deliver the service you've signed up for.
- Legitimate interests — improving story quality and ensuring reliable delivery.
- Consent — where you have explicitly agreed, such as receiving optional marketing emails. You can withdraw consent at any time.
Children's data
StorySpins is designed for children aged 3–12, but used by their parents and guardians. We do not collect data directly from children. All information about a child is provided by the parent or guardian who holds the account.
If you believe a child has provided us with personal data without parental consent, please contact us at [email protected] and we will delete it promptly.
Third-party services
We use a small number of trusted third-party services to operate StorySpins:
- Stripe — payment processing. Stripe is PCI-DSS compliant.
- Brevo (formerly Sendinblue) — email delivery. Your email address is shared with Brevo solely for the purpose of delivering stories and account emails.
- Anthropic / Claude — AI story generation. Story prompts (including your child's profile details) are processed by Anthropic's API to generate personalised stories. Anthropic does not use this data to train their models. See Anthropic's privacy policy.
- Cloudflare — website hosting and security. Cloudflare may process basic traffic data as part of standard web infrastructure.
All third parties are bound by data processing agreements and are not permitted to use your data for their own purposes.
Data retention
- Your account data is retained for as long as your subscription is active.
- If you cancel, we retain your account data (including saved stories) for 90 days, after which it is permanently deleted.
- You can request immediate deletion at any time by emailing [email protected].
- Payment records may be retained for up to 7 years for legal and accounting purposes.
Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you and your child
- Rectification — ask us to correct inaccurate data (or update it yourself in your account profile)
- Erasure — ask us to delete your data ("right to be forgotten")
- Restriction — ask us to stop processing your data in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — for any processing based on consent, at any time
To exercise any of these rights, email [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.
Cookies
StorySpins uses only essential cookies necessary to operate the service (such as keeping you logged in). We do not use advertising or tracking cookies.
Security
We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls, and use of reputable, security-certified third-party providers.
Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by email before the changes take effect. The date at the top of this page will always reflect the most recent version.
Contact us
For any questions about this policy or how we handle your data:
[email protected]