Privacy Policy

Last Updated: October 7, 2026

1. Introduction

Welcome to ZunoTales, a platform operated by Galactic Matrix - Unipessoal Lda ("we", "us", or "our"). This Privacy Policy explains how we collect, use, and protect your information when you use our website, applications, and services (collectively, the 'Services'). Your privacy and the safety of your children are critically important to us.

By using ZunoTales, you agree to the collection and use of information in accordance with this policy.

2. App Store Transparency (Guideline 2.1 Compliance)

3. Information We Collect

We collect information to provide and improve our Service to you. The types of information we collect depend on how you use our Services.

A. Information You Provide to Us

• Account Information: When you create an account, we collect your name, email address, country, and chosen role (Parent or Educator).
• Child Profile Information: For parents, you provide your child's name, age, gender, and interests. This is used solely to personalize the story-generation experience. This information is considered highly sensitive.
• Student Information (Educators): For educators, you provide student names and ages to manage your class roster. You are responsible for obtaining any necessary parental consent to provide this information.
• User Content: We collect the prompts, text (from 'Young Author Mode'), and other content you submit when creating stories.
• Child Photos (Optional): You may optionally upload a photo of your child to personalize their story illustrations. The photo is sent to our AI provider, Google Cloud (Vertex AI), solely to create the artwork; the photo itself is not stored after that request or used for any other purpose. The illustrations made from it — such as your child's profile picture and story pages — are kept with your account until you change or delete them.
• Story Dictation (Optional): When a child uses the microphone to tell a story (for example in Young Author), the recording is sent to Google Cloud (Vertex AI) solely to turn it into text. We keep only the text, which the child can change; the recording is not stored beyond the request.
• Communications: If you contact us directly, we may receive additional information about you such as your name, email address, and the contents of your message.

B. Information We Collect Automatically

• Usage Data: We collect information about your interactions with our Services, such as stories created, viewed, or liked, games played, and features used.
• Device and Log Information: We collect log information when you use our Services, including your IP address, browser type, and operating system. For anonymous users, we may use the IP address to enforce story view limits.
• How You Found Us: When you create an account, we record the website that sent you to ZunoTales (its name only, such as google.com — never the full address or what you searched for), any campaign tag in the link you followed, and the first ZunoTales page you visited. This tells us which channels bring families and schools to ZunoTales. It is stored with your account, and it is not saved on your device unless you accept analytics cookies.
• Educator Activity (School Accounts): For accounts managed by a school or institution, we record which educator created each story, the student profile it was created for, and the date and time it was created. This is used to produce the teaching activity report described in the “Educator and School Accounts” section below.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our Services.
• Personalize and improve your experience, including generating stories, providing reading activity insights, and suggesting story ideas.
• Communicate with you, including responding to your comments, questions, and requests.
• Process transactions for any paid services via Apple StoreKit or Stripe.
• Monitor and analyze trends, usage, and activities in connection with our Services.
• Enforce our Terms of Service and other policies.

Magic Buddy & Talk Time (Guided AI Conversation)

Magic Buddy is an optional, parent-controlled feature where a child can have short, guided conversations with an animated AI character. It is designed as a learning companion — not an open chatbot — and operates under strict limits:

• Off by default. Talk Time only works after the parent who owns the account explicitly enables it, and it can be turned off again at any time. We record the date and time of this consent.
• Full parent visibility. Every conversation is recorded in full and available to the parent inside the app. Children cannot delete or hide conversations.
• Limited, reviewable memory. The buddy may remember small, non-identifying fun facts (such as a favourite animal) to personalise conversations. Parents can view this list at any time and erase it with one tap. The buddy is instructed never to store names of real people, schools, addresses, or any identifying details.
• Voice input. When a child speaks to the buddy, the speech-to-text conversion is performed by the browser or device (e.g. Google or Apple speech services). We store only the resulting text, never the audio recording.
• Automatic deletion. Conversation transcripts are automatically deleted after 12 months, and immediately if the child profile or account is deleted.
• Disabled for schools. Talk Time is not available on school-managed (institution) profiles.

Educator and School Accounts

When ZunoTales is used under a school or institution account, the administrator of that institution can view a report of teaching activity within their own school. We believe you should know exactly what this does and does not include:

• What the administrator can see. Stories created within the institution — including the story title, subject, grade, curriculum, the student profile it was created for, the date it was created, and whether it completed successfully — together with a per-educator summary (number of stories, subjects and grades covered, students taught, and the date of last activity).
• Why we process it. Schools are accountable for the teaching materials produced on their account and for the safety of their students' data. We process this information on the basis of the school's and our legitimate interests in curriculum oversight, safeguarding, and account administration (Article 6(1)(f) GDPR). Where the school is the controller of student data, we act as its processor under our Data Processing Agreement.
• What we do NOT collect. We do not track an educator's location, keystrokes, screen contents, private messages, browsing, or any activity outside ZunoTales. We do not record login times or session durations. Educator activity data is never used for advertising and is never sold.
• Scope. Activity is visible only to the administrator of the same institution. Educators cannot view one another's activity, and activity data is never shared across institutions.
• Transparency to educators. Educators are told, at the moment they accept a school invitation, that the stories they create are visible to their school administrator.
• Retention and your rights. Educator activity data is retained for as long as the institution account is active, and is deleted with the account. Educators may request access to, correction of, or deletion of their personal data at any time (see “Your Data Rights and Choices”).

Legal Bases for Processing (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: to create and run your account, generate and store your stories, and process payments (Article 6(1)(b)).
• Consent: for optional features such as uploading a child's photo, Magic Buddy, making a story public, and analytics cookies. You can withdraw consent at any time; this does not affect processing that took place before you withdrew it (Article 6(1)(a)).
• Legitimate interests: to keep the Services safe and secure, prevent abuse, understand how the Services are used so we can improve them, and send service messages about your account. You can object to this processing (Article 6(1)(f)).
• Legal obligation: to keep invoices and accounting records and to respond to lawful requests from authorities (Article 6(1)(c)).

5. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

• With Your Consent: We may share your information with your consent, for example, when you choose to make a story public, which makes it viewable by other users.
• Service Providers: We work with service providers that process data on our behalf, under contracts that limit them to providing their service to us: Google Cloud and Firebase (hosting, data storage and sign-in), Google Cloud Vertex AI (generating story text, illustrations, narration and music), Google Analytics (usage statistics, subject to your cookie choices), Stripe (payments) and Resend (sending emails). Story prompts, child names, ages and optionally uploaded photos are sent to Google Cloud Vertex AI solely to generate story content and artwork; under the Google Cloud Data Processing Addendum, Google processes this data only to provide the service to us.

6. Data Security

We use a combination of technical, administrative, and physical controls to maintain the security of your data. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

Data Retention

We keep personal information, including children's information, only for as long as it is needed for the purposes described in this policy:

• Account, child-profile and story data are kept while your account is active and are deleted when you delete the profile or the account.
• Deleted data can remain in our encrypted database backups for up to 10 days, until those backups expire.
• Server logs, which include IP addresses, are kept for 30 days.
• Uploaded photos and dictation recordings are not stored after the request that uses them. Magic Buddy conversations are deleted after 12 months.
• Payment and invoice records are kept for as long as tax law requires (in Portugal, up to 10 years).

7. Your Data Rights and Choices

You have rights over your personal information. Through your account settings, you can access, edit, or delete your profile information and your children's profiles. Galactic Matrix - Unipessoal Lda is committed to ensuring you remain in control of your data.

You can delete your account at any time. When you delete your account, we will permanently delete your profile and all associated stories and data.

Depending on where you live, you also have the right to request access to your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given. To exercise these rights, email contact@zunotales.com. You can also lodge a complaint with a data protection supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt) — or with the authority in the country where you live or work.

8. Children's Privacy (COPPA)

We are committed to complying with the Children's Online Privacy Protection Act (COPPA). We do not permit children under 13 to create their own accounts. A parent or legal guardian must provide verifiable consent and create any child profiles. Parents can review and delete their child's data at any time.

9. International Data Transfers

We are based in Portugal, in the European Union. Some of our service providers process data outside the European Economic Area, including in the United States, and AI requests are handled on Google Cloud's global infrastructure. When personal data is transferred outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and their UK equivalent) in our providers' data processing terms and, where a provider is certified, the EU–U.S. Data Privacy Framework.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at contact@zunotales.com.