Privacy Policy

Who we are

NightlyTale is a children's bedtime-story subscription service, operated from South Africa. We are the party responsible for your personal information (the “responsible party” or “data controller”, depending on where you live). We handle your information in line with the data-protection laws that apply to you, including the Protection of Personal Information Act (POPIA) in South Africa, the UK and EU GDPR in the United Kingdom and Europe, and the Privacy Act 1988 and Australian Privacy Principles in Australia.

What we collect

• Parent/guardian email address and hashed password (required to create an account)
• Child's first name (optional), age (1 to 12), favourite animal, story category, and preferred story language
• Payment token from our payment provider (we never store your full card details, they do)
• Story history (title and body) to personalise future stories and avoid repeats

Why we collect it

Primarily to generate and deliver personalised bedtime stories to your child each night. We never sell your personal information. We also use a small number of analytics and advertising tools to understand how people find NightlyTale and to measure our marketing, as described under “Cookies and advertising” below. We never use your child's information for advertising.

Children's data

We collect minimal data about children with the explicit consent of the parent or legal guardian. A child's first name is entirely optional. We do not collect any other personal details about children.

Your rights

• Access: view all data we hold about you from your dashboard
• Correction: edit your child's details at any time from your dashboard
• Deletion: delete your account and all associated data from your dashboard. This is immediate and permanent
• Portability: request a copy of your data in a portable format
• Withdraw consent: decline non-essential cookies at any time, and object to any processing by contacting us at support@nightlytale.com

Depending on where you live, you may also lodge a complaint with your data-protection regulator: the Information Regulator (South Africa), the Information Commissioner's Office (UK), your local authority such as the Autoriteit Persoonsgegevens (EU/Netherlands), or the Office of the Australian Information Commissioner (Australia).

International data transfers

Because we operate from South Africa and rely on trusted global providers, your information may be processed in South Africa, the European Union, the United Kingdom and the United States. Where personal data is transferred across borders, we use providers that offer appropriate safeguards (such as standard contractual clauses) and that meet the transfer requirements of POPIA, the UK GDPR and the EU GDPR.

Third-party services

• Supabase: secure cloud database (EU/US data centres with SA-compliant contracts)
• Anthropic: AI story generation (data is not used to train their models under our API agreement)
• Resend: transactional email delivery
• PayFast: PCI-DSS compliant payment processing (South Africa, ZAR)
• Vercel: web hosting
• Meta (Facebook): website analytics and advertising measurement via the Meta Pixel (any personal data is securely hashed before it is sent)

Cookies and advertising

We use the Meta (Facebook) Pixel on our website to measure how well our advertising works and to show relevant ads to people who have visited NightlyTale. When you submit a form on our site (such as your email address at signup), the Pixel may send a securely hashed version of that information (scrambled so it cannot be read) to Meta to help match your visit to your Meta account. This is called Automatic Advanced Matching. We never send Meta your card details or any information about your child. Where the law requires it (for example in the UK and EU), these non-essential cookies load only if you accept them in the cookie banner shown on your first visit, and you can decline there. Wherever you are, you can also control this tracking through your Meta ad preferences, your Google Analytics opt-out, and your browser or device settings.

Data retention

We retain your data while your account is active. When you delete your account all data is permanently removed within 24 hours. Anonymised story counts (no names, no email) may be retained for 12 months for service quality purposes.

Contact

For any privacy queries: support@nightlytale.com