Privacy Notice

TaleLuna is operated by Veres Tamas e.v., Hungarian sole proprietor, of Sziget utca 35, 8000 Szekesfehervar, Hungary. We are the controller of the personal data described in this notice.

Contact us about privacy at info@taleluna.com.

We collect the parent or caregiver account details needed to provide the service, including email address, display name where available, authentication records, subscription status and support messages.

For each child profile, we process only the details a parent chooses to provide, such as first name, age, interests, story preferences, boundaries, delivery time, and optional family or pet details. We also store generated stories, illustrations, favourites, feedback and delivery records.

We use account and profile information to create, deliver and support the TaleLuna service, including personalised stories, illustrations, story libraries, billing administration and customer support. This processing is necessary to perform our contract with the parent or caregiver.

We use limited technical, security and operational data to prevent abuse, troubleshoot the service, protect accounts and improve reliability. This is based on our legitimate interests in operating a safe and dependable service.

On public pages, we keep first-party daily aggregates of the UTC date, public route, approved public call-to-action type, and total page loads or call-to-action clicks to understand demand for the public service. These database records do not include cookies, browser-storage identifiers, IP addresses, account identifiers, referrers, query strings, child-profile data, stories or individual event records. They are separate from optional marketing measurement and are based on our legitimate interests in operating and improving the public service.

We use marketing contact details only where you have opted in. You can withdraw marketing consent at any time in your account settings.

With your explicit Analytics consent, we use Google Analytics, Vercel Web Analytics, Vercel Speed Insights and PostHog on published public pages to measure visits, navigation and performance. With separate Marketing consent, we use the Meta Pixel and limited server-side conversion measurement to understand which advertising campaigns help families discover TaleLuna. We configure Vercel measurement to use public page paths without query strings; Vercel may also process referrer, country or city-level location, browser, operating system, device type, a device identifier, web-performance metrics and a request-derived hash that Vercel says it discards after 24 hours. PostHog is configured with its EU ingestion endpoint and receives only an approved public page path, locale, fixed product label, fixed call-to-action location and a random memory-only technical identifier that is not written to browser storage; when Stripe verifies a trial start or first payment, it may receive only the plan code and, for a payment, currency. We do not send names, email addresses, account identifiers, child-profile data, stories, prompts, preferences, support content, Stripe identifiers, query strings, referrers, full URLs or payment amounts to PostHog. We do not use PostHog identification, alias, person or profile APIs, and configure it not to create person profiles. This measurement is optional, is not needed to use the service, and can be disabled at any time through Cookie settings.

TaleLuna uses AI providers to generate the story and illustration requested by the parent. We also use providers for hosting, authentication, database operations, payment processing, image storage and email delivery. They process data only as needed to provide their service to us.

AI output is generated from the profile details you provide. It is not used to make decisions that produce legal or similarly significant effects about a child or parent.

If you allow Analytics, Google Analytics receives limited browser identifiers and public-page visit and navigation data. Vercel Web Analytics and Vercel Speed Insights receive configured published public page paths without query strings; Speed Insights also receives web-performance metrics, and Vercel may process referrer, country or city-level location, browser, operating system, device type, a device identifier and a short-lived request-derived hash. If you separately allow Marketing, Meta Platforms Ireland Limited receives limited browser identifiers, public-page event data and confirmed trial-start or first-payment conversion data. PostHog receives only the optional, approved anonymous event schema described above plus a random memory-only technical identifier; it is not loaded on private, account, authentication, checkout, administrative or API routes. We do not send child names, child profiles, stories or private account activity to any of these services. We also do not send raw email addresses or payment card details.

On the public TaleLuna Journal, Soro provides the article catalogue and article content. Soro receives the limited request and technical information needed to serve that public content, such as IP address, browser information and the requested page. We do not send child profiles, private account data, generated stories or private-route activity to Soro.

Our providers may process information in the European Economic Area and, where necessary, in other countries. Where personal data is transferred outside the EEA, we rely on an adequacy decision, standard contractual clauses or another lawful transfer mechanism made available by the relevant provider.

Before enabling optional PostHog measurement in production, we will have qualified EU privacy counsel review PostHog's current processor terms, subprocessor list, retention setting and any applicable transfer safeguards. Using an EU ingestion endpoint alone does not establish the complete data-processing or transfer position.

We keep account, child-profile, story and preference data while the account is active so the service can work. When you delete the account, we remove the account, child profiles, stories, images, favourites and feedback as described in the account-deletion flow.

We retain only the limited records needed for legal, accounting, security or dispute-handling purposes for the period required by applicable law. Support records are anonymised as part of account deletion where possible.

PostHog is not enabled until its project-level event-retention setting has been selected, documented and reviewed by qualified EU privacy counsel. Before enablement, we will update this notice if the approved setting requires a more specific retention disclosure.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection to processing. You may also withdraw consent where processing is based on consent. Contact us at the address above and we may need to verify your identity before acting on a request.

You may lodge a complaint with your local data-protection authority. As the controller is established in Hungary, you may also contact the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

TaleLuna is for parents and caregivers, not children acting alone. Children do not receive sign-in links or independent accounts. A parent or caregiver controls the profile, delivery recipients, preferences and account deletion.

We use proportionate technical and organisational measures to protect information. No internet service can guarantee absolute security, but we limit access to authorised systems and do not sell personal information or use child-profile, story or private account data for advertising.

TaleLuna uses essential cookies and similar storage needed for sign-in, security and core service operation. It also records the first-party daily aggregate public-page and approved call-to-action totals described above without cookies or browser storage. With Analytics consent, Google Analytics may place optional measurement cookies and Vercel Web Analytics, Speed Insights and PostHog load on published public pages; PostHog uses a random memory-only technical identifier and receives only the approved event schema. With separate Marketing consent, the Meta Pixel may place optional measurement cookies and TaleLuna may send limited server-side Meta conversion events. Google Consent Mode is initialised with all consent signals denied before the visitor chooses; private parent, admin, authentication and API routes are excluded from browser measurement. With Analytics consent, TaleLuna may send an anonymous PostHog conversion event when Stripe confirms a trial start or first payment.

We may update this notice when the service or law changes. We will post the updated version here and, where a material change affects your rights, provide an appropriate additional notice.