Privacy Policy

Information you provide

• Account information: your email address, account identifier and information needed to sign in. Authentication is handled through Supabase.
• Child profiles: the name, gender, date of birth or age, and preferred language you enter for a child.
• Story choices: themes, goals, preferences, descriptions, participant details and feedback you provide to personalize stories.
• Generated content: stories, illustrations, narration, digital books and associated history and progress.
• Subscriptions and usage: Google Play purchase tokens, subscription status, renewal and expiry information, and story allowance and consumption records. Payment card details are handled by Google Play; BRAIVORY does not receive your full card number.
• Support messages: information you choose to send when contacting us.

Use a nickname where possible. Do not enter a child’s address, school, contact information, medical records or other sensitive details into story descriptions.

How information is used

We use information to manage accounts and child profiles, personalize and generate stories and books, provide narration, restore saved content, manage subscription entitlements and story allowances, respond to support requests, and maintain security and reliability.

Our services also process technical request information, such as IP addresses, timestamps, request paths and error information, when providing the website and app services and investigating problems.

Legal bases and information needed to provide the service

Account administration and subscription services for adult account holders involve processing needed to provide the requested service (GDPR Article 6(1)(b)). Security and proportionate troubleshooting serve the legitimate interests of protecting accounts, preventing misuse and keeping the service reliable (Article 6(1)(f)). Where a specific law requires records to be kept, the relevant processing is based on that legal obligation (Article 6(1)(c)).

These bases are purpose-specific. A parent’s contract does not automatically establish a basis for every use of a child’s or another participant’s information. Where processing relies on consent, you can withdraw that consent by contacting us. Withdrawal does not affect processing that was lawful before withdrawal.

An email address and authentication information are needed for an account. The current app requires a child’s name, gender, date of birth and preferred language to create a profile; without these fields the profile cannot currently be created. Additional participant details and free-text story choices are optional. These are product requirements, not a statement that providing this information is required by law.

AI generation and service providers

BRAIVORY sends the information needed for story, illustration and narration generation to OpenAI through its API. This can include names or nicknames, age information, story choices, participant descriptions and generated story content. Generated illustrations may also be supplied as references for further illustrations.

We use Supabase for authentication and database or storage services, and Google Cloud for server hosting, operational logs and subscription notifications. Google Play processes purchases and provides subscription verification. Providers process information under their applicable terms and privacy arrangements. Processing may take place outside your country, including outside the European Economic Area.

This website does not currently include advertising trackers or third-party analytics scripts. Future changes to data practices will be reflected in this policy.

The providers’ data-processing terms describe their processing obligations and international-transfer arrangements. These include the European Commission’s Standard Contractual Clauses or applicable adequacy arrangements, depending on the provider and transfer. You can read the Supabase DPA, OpenAI DPA and Google Cloud DPA. Contact us to request information about the safeguards relevant to your data. This policy does not promise that all processing takes place within the EEA.

Sharing stories

When you choose Share, you make the shared story and its associated content available to people who receive the link. Content can include names and details you entered. Recipients may forward links or keep copies. Only share content you are comfortable making available to those recipients.

Children’s information

BRAIVORY accounts and app operation are intended for adult parents and guardians aged 18 or older. The adult manages registration, profile information, story creation, purchases and sharing. Children listen to or read stories with the adult's supervision; they should not register or operate accounts independently.

Child profiles are associated with the account that creates them. Parents or guardians should manage the account, the information entered about children and any sharing of stories. Contact us if you believe a child’s information has been provided without appropriate authorization or you want that information removed.

Only provide information about children for whom you have appropriate authority, and do not enter other people’s personal information without the necessary authorization. Where information about a child or participant is supplied by someone else, it comes from the account holder’s profile and story inputs, rather than directly from that individual. Contact us if information about you or a child in your care has been entered by someone else and you want to exercise your rights.

Storage and retention

Account, profile and story information is stored on our service infrastructure to provide the app and restore content. The app also stores downloaded stories, audio, images and digital books on your device.

There is currently no automatic deletion schedule for account and saved story records. They remain stored until removed or deleted in response to a verified request. Uninstalling the app or signing out does not by itself delete server records. Technical logs and backups have separate provider retention settings. Records needed for legal obligations, subscription disputes or security may be retained where necessary; if this affects a deletion request, we will explain it in our response.

Access, correction and deletion

Open Account → Request account deletion in the app, or visit our account deletion page without signing in. Requests are handled after ownership verification; opening the page does not delete your account.

To request access to, correction of, or deletion of your BRAIVORY account and associated information, email andrecher@hotmail.com from the email address used for your account. For deletion, use the subject “BRAIVORY account deletion”. You can request deletion of a particular child profile instead of the whole account.

We may need to verify account ownership before acting. Do not send your password or payment card details. Account deletion requests cover associated child profiles, stories, generated assets and usage records, subject to any necessary retention explained above. Copies already downloaded or shared with other people may remain on their devices.

Deleting your BRAIVORY account does not automatically cancel your Google Play subscription. Manage or cancel it separately in Google Play’s Subscriptions section.

Depending on your location, you may also have rights to restrict or object to processing, receive a portable copy of your information, withdraw consent where processing relies on consent, or complain to your local data protection authority. Contact us to discuss a request.

For people covered by the GDPR, these rights include access, rectification, erasure, restriction, and, where applicable, portability and objection. Where consent is the basis, withdrawing it does not affect the lawfulness of processing before withdrawal. Applicable exceptions may limit a right; any refusal must be explained. GDPR requests must be handled without undue delay and normally within one month. Where a lawful extension is necessary, the reason and extension must be communicated within the initial month.

You can complain to the Cyprus Commissioner for Personal Data Protection, or the relevant supervisory authority in your EU country of habitual residence, place of work or the alleged infringement.

Automated processing

AI automatically generates story text, illustrations and narration from the information supplied. The storytelling features described here do not make automated decisions producing legal or similarly significant effects under GDPR Article 22. Generated stories are creative content, not medical diagnoses or professional assessments of a child.

Security and updates

Connections to our app services use HTTPS. We use account authentication and access controls to protect stored information. No online service can guarantee absolute security.

We may update this policy as BRAIVORY changes. The date above identifies the latest revision. For questions about this policy or your information, contact Andreas Tserkezos at andrecher@hotmail.com.