Privacy Policy

1. Who We Are

Tellah is the data controller for personal information processed under this policy. References to "Tellah", "we", "us", or "our" in this policy refer to the operator of the Service.

2. Information We Collect

We collect the following categories of personal information:

3. How We Use Your Information

We use your personal information to:

• Provide, operate, and improve the Service;
• Verify your identity and eligibility;
• Generate AI stories and illustrations based on your inputs;
• Process payments and manage subscriptions;
• Enforce age-appropriate content restrictions;
• Send service-related communications (account notices, billing receipts, important updates);
• Send marketing emails, where you have opted in or where we have a legitimate interest — with an easy opt-out in every message;
• Use anonymised or aggregated information about how people use Tellah to inform and measure advertising campaigns;
• Where you have given consent, use information you provide — such as age range, plan type, and general usage — to serve or target relevant advertising, including through third-party advertising platforms. You can withdraw this consent at any time through your account notification preferences.
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with our legal obligations.

4. Legal Bases for Processing (UK & EU GDPR)

For users in the UK and EEA, we process your personal data under the following legal bases:

• Contract: processing necessary to provide the Service you have signed up for;
• Legitimate interests: improving the Service, fraud prevention, security, and direct marketing to existing customers (balanced against your rights);
• Legal obligation: where we are required to process data by law;
• Consent: for optional marketing communications, targeted advertising, and cookies where consent is required. You may withdraw consent at any time — this does not affect processing carried out before withdrawal.

5. Children's Privacy

Protecting children's privacy is a priority for us. Family Members on the Tellah Family plan may be under 18. For child Family Members:

• The Family Owner (a parent or guardian) is responsible for adding children and managing their access;
• We collect only the minimum data necessary for children: first name, surname, date of birth, and content settings;
• Children's stories are not made public without the Family Owner enabling sharing;
• We do not send marketing communications directly to children;
• We do not knowingly allow children under 13 to register for any Tellah account. Users aged 13–17 may register for a standard account independently. The Family plan requires the account holder to be 18 or over.

If you believe we have inadvertently collected data from a child under 13 without appropriate consent, please contact us immediately at hello@tellahstory.com and we will delete it promptly.

For users in the United States, we comply with the Children's Online Privacy Protection Act (COPPA). For UK users, we adhere to the ICO's Age Appropriate Design Code.

6. Sharing Your Information

We do not sell your personal data. We share it only in the following circumstances:

6.1 Service providers

• OpenAI: Your story prompts and character descriptions are sent to OpenAI to generate story text and images. OpenAI processes this data under its own privacy policy. We use the API, and OpenAI does not use API inputs to train their models by default.
• Stripe: Payment processing. Stripe receives your billing information and is subject to its own privacy policy.
• Hosting & infrastructure providers: Our servers and associated services that store and process your data on our behalf, under data processing agreements.

6.2 Legal requirements

We may disclose your data if required to do so by law, court order, or in response to a valid request from a government authority.

6.3 Business transfers

If Tellah is acquired, merged, or its assets transferred, your data may form part of that transfer. We will notify you before your data becomes subject to a different privacy policy.

7. Advertising

We may in the future use certain information to deliver or improve advertising — including on third-party platforms such as social media networks. Where we do this, we will only use data in ways that are consistent with the consent you have given us or our legitimate interests, and we will never use the content of your stories or your children's data for advertising purposes.

The types of information that may be used for advertising purposes include:

• General account attributes such as age range, subscription plan, and account tenure;
• Broad usage patterns, such as how often stories are created (never the story content itself);
• Email address, used to create custom or lookalike audiences on advertising platforms — only where you have consented.

We will never sell your personal data to advertisers. Any advertising use will be disclosed to you, and you can opt out through your account notification preferences or by emailing hello@tellahstory.com.

9. International Data Transfers

Your data may be processed outside the UK or EEA — including in the United States — by our service providers (OpenAI, Stripe). Where we transfer data internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), or the UK/EU–US Data Privacy Framework where applicable.

10. Data Retention

We retain your personal data for as long as your account is active, or as needed to provide the Service. When you delete your account:

• Your profile data and stories are deleted within 30 days;
• Billing records are retained for up to 7 years as required by financial regulations;
• Anonymised usage data may be retained indefinitely for analytics.

You can request earlier deletion of specific data — see Your Rights below.

11. Cookies & Tracking

We use cookies and similar technologies to:

• Keep you logged in (essential session cookies);
• Remember your preferences (e.g. dark/light mode);
• Understand how the Service is used (analytics);
• Prevent fraud and abuse.

Essential cookies are necessary for the Service to function and do not require your consent. For non-essential cookies, we will ask for your consent where required by law. You can manage cookie preferences through our cookie banner or your browser settings.

12. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you;
• Correction: request that inaccurate data be corrected;
• Erasure: request deletion of your personal data ("right to be forgotten");
• Portability: receive your data in a structured, machine-readable format;
• Restriction: request that we limit processing of your data in certain circumstances;
• Objection: object to processing based on legitimate interests or for direct marketing;
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email hello@tellahstory.com. We will respond within 30 days. We may ask you to verify your identity before processing a request.

If you are in the UK or EU and are unhappy with how we handle your data, you have the right to lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner's Office (ICO).

13. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Know: the categories and specific pieces of personal information we collect and how we use them (see Section 2 above);
• Delete: request deletion of your personal information, subject to certain exceptions;
• Correct: request correction of inaccurate personal information;
• Opt out of sale or sharing: we do not sell or share personal information for cross-context behavioural advertising;
• Non-discrimination: we will not discriminate against you for exercising any CCPA right.

To submit a California privacy request, email hello@tellahstory.com with "California Privacy Request" in the subject line.

14. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration. These include encrypted connections (HTTPS), hashed passwords, and access controls. No system is completely secure, and we cannot guarantee absolute security, but we take our obligations seriously and will notify you and the relevant authorities of any breach as required by law.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email or a prominent notice on the Service. The date at the top of this page always reflects the most recent update. We encourage you to review this policy periodically.

16. Contact Us

For any privacy questions, data requests, or concerns:

• Email: hello@tellahstory.com

We aim to respond to all enquiries within 5 business days.