Skip to content

TaleLuna legal

Privacy Notice

This notice explains how TaleLuna handles the information parents and caregivers provide when using our personalised bedtime-story service.

Effective date
2026-07-28

1. Who controls your information

TaleLuna is operated by Veres Tamas e.v., Hungarian sole proprietor, of Sziget utca 35, 8000 Szekesfehervar, Hungary. We are the controller of the personal data described in this notice.

Contact us about privacy at info@taleluna.com.

2. Information we collect

We collect the parent or caregiver account details needed to provide the service, including email address, display name where available, authentication records, subscription status and support messages.

For each child profile, we process only the details a parent chooses to provide, such as first name, age, interests, story preferences, boundaries, delivery time, and optional family or pet details. We also store generated stories, illustrations, favourites, feedback and delivery records.

  • Payment card details are handled by Stripe. TaleLuna does not store card numbers.
  • Please do not enter medical, diagnostic, school, safeguarding or other sensitive personal information in profile notes or support messages.

3. Why we use information and our legal bases

We use account and profile information to create, deliver and support the TaleLuna service, including personalised stories, illustrations, story libraries, billing administration and customer support. This processing is necessary to perform our contract with the parent or caregiver.

We use limited technical, security and operational data to prevent abuse, troubleshoot the service, protect accounts and improve reliability. This is based on our legitimate interests in operating a safe and dependable service.

We use marketing contact details only where you have opted in. You can withdraw marketing consent at any time in your account settings.

4. AI generation and service providers

TaleLuna uses AI providers to generate the story and illustration requested by the parent. We also use providers for hosting, authentication, database operations, payment processing, image storage and email delivery. They process data only as needed to provide their service to us.

AI output is generated from the profile details you provide. It is not used to make decisions that produce legal or similarly significant effects about a child or parent.

  • Supabase for authentication and database infrastructure.
  • Stripe for payment processing and subscription management.
  • OpenAI and FAL for story and illustration generation.
  • Our configured hosting, storage and SMTP providers for the website, illustration files and service email.

5. International transfers

Our providers may process information in the European Economic Area and, where necessary, in other countries. Where personal data is transferred outside the EEA, we rely on an adequacy decision, standard contractual clauses or another lawful transfer mechanism made available by the relevant provider.

6. How long we keep information

We keep account, child-profile, story and preference data while the account is active so the service can work. When you delete the account, we remove the account, child profiles, stories, images, favourites and feedback as described in the account-deletion flow.

We retain only the limited records needed for legal, accounting, security or dispute-handling purposes for the period required by applicable law. Support records are anonymised as part of account deletion where possible.

7. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection to processing. You may also withdraw consent where processing is based on consent. Contact us at the address above and we may need to verify your identity before acting on a request.

You may lodge a complaint with your local data-protection authority. As the controller is established in Hungary, you may also contact the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

8. Children and security

TaleLuna is for parents and caregivers, not children acting alone. Children do not receive sign-in links or independent accounts. A parent or caregiver controls the profile, delivery recipients, preferences and account deletion.

We use proportionate technical and organisational measures to protect information. No internet service can guarantee absolute security, but we limit access to authorised systems and do not sell personal information or use it for behavioural advertising.

9. Cookies and changes

TaleLuna uses essential cookies and similar storage needed for sign-in, security and core service operation. We do not use advertising cookies. If we introduce non-essential cookies, we will provide the required notice and choice before using them.

We may update this notice when the service or law changes. We will post the updated version here and, where a material change affects your rights, provide an appropriate additional notice.