Privacy Policy

At JJH Solutions Ltd (trading as StoryWisp), accessible from https://storywisp.app, protecting children's privacy is our highest priority. This Privacy Policy explains how we collect, use, and protect information when families use our AI-powered storytelling platform.

Definitions

“StoryWisp” refers to JJH Solutions Ltd (trading as StoryWisp), a UK company providing AI storytelling services for children.

“Services” means our AI-powered storytelling platform, including story generation, character creation, and educational features.

“User” means any parent, guardian, or family member using our Services.

“Child” means any person under the age of 18 for whom a parent or guardian has provided verifiable consent to use our Services.

“Content” refers to stories, characters, and educational materials generated through our Services.

“Personal Information” means any information that can identify an individual, including children's data.

Information We Collect

Account Information

• Parent/guardian name and email address
• Account preferences and settings
• Subscription status and payment history (processed securely through Stripe)
• Communication preferences

Child Profile Information

• Child's first name and age group (e.g., “4-6 years”)
• Character preferences and story themes
• Educational progress and reading level
• Story preferences and favorite characters

Usage Information

• Stories created and characters generated
• Educational progress and phonics achievements
• App usage patterns (anonymized)
• Feature preferences and settings

Technical Information

• Device type and operating system
• Browser type and version
• IP address (anonymized)
• App performance and error logs

Photo Uploads for Character Creation

Our Service allows parents to upload photos to create personalized character caricatures. When you upload a photo:

• Photos are processed through our AI systems to generate cartoon-style character artwork
• Original photos are deleted immediately after processing; we do not retain any original images
• Only the AI-generated cartoon artwork is retained
• You can request deletion of character images at any time
• Photo upload is optional - you can create characters without photos

What We DON'T Collect

• Children's full names, addresses, or phone numbers
• Voice recordings or audio data
• Location or GPS information
• Unprocessed photos of children (only AI-generated cartoon artwork is retained)
• School information or academic records
• Social media profiles or online activity outside our platform
• We do not sell, rent, or share children's personal information with third parties for their marketing purposes

Legal Basis for Processing (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we process personal data based on the following lawful bases:

• Consent (Article 6(1)(a)): You have given clear, informed consent for us to process your data for specified purposes
• Contract (Article 6(1)(b)): Processing is necessary for the performance of our subscription agreement with you
• Legitimate Interests (Article 6(1)(f)): We have legitimate interests in improving our Services and ensuring platform security, balanced against your rights

For children's data, we rely on verifiable parental consent in accordance with Article 8 of UK GDPR, which requires parental authorisation for processing personal data of children under 13.

How We Use Your Information

Service Provision

• Generate personalized stories based on child's preferences
• Create custom characters and educational content
• Provide age-appropriate educational features
• Track reading progress and learning achievements

Communication

• Send important updates about our services
• Provide customer support and technical assistance
• Share educational tips and reading resources
• Notify about new features and improvements

Platform Improvement

• Analyze usage patterns to improve our AI storytelling
• Develop new educational features and content
• Ensure platform security and prevent abuse
• Conduct research to enhance child learning outcomes

UK Data Protection Compliance

StoryWisp is fully compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our practices are also aligned with the principles of the Children's Online Privacy Protection Act (COPPA), ensuring robust protection for children's privacy and safety.

Parental Consent

• We collect only minimal information necessary for our Services
• All processing of children's data requires verifiable parental consent
• We do not share children's personal information with third parties except as necessary to provide our Services

Data Minimization

• We collect only the minimum information needed to provide our services
• No unnecessary data collection or tracking
• All data is stored securely and encrypted
• Regular audits ensure compliance with privacy standards

Cookie Policy

We use cookies and similar technologies to enhance your experience on our platform:

Essential Cookies

These cookies are necessary for the website to function properly. They enable basic functions like page navigation, access to secure areas, and remembering your preferences. These cookies cannot be disabled.

Analytics Cookies

We use Google Analytics with IP anonymisation enabled (anonymize_ip) to understand how families use our platform. All data is anonymized and cannot be linked to individual users. You can opt out of analytics cookies via our cookie consent preferences or your browser settings.

Preference Cookies

These cookies remember your settings and preferences to provide a personalized experience, such as your sound settings and highlighting preferences.

Cookie Control: You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of our platform.

Data Security

We implement industry-standard security measures to protect your family's information:

• End-to-end encryption for all data transmission
• Secure cloud storage with regular backups
• Access controls and authentication protocols
• Regular security audits and updates
• Staff training on data protection and privacy
• Incident response procedures for any security concerns

Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms:

• We will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware
• We will notify affected users without undue delay if the breach poses a high risk
• We will provide details about the nature of the breach and steps we are taking
• We will provide recommendations for protecting yourself from potential harm

Automated Decision-Making

StoryWisp uses artificial intelligence to automatically generate content including:

• Personalized stories based on your selected preferences
• Character illustrations based on descriptions and uploaded photos
• Age-appropriate content recommendations based on selected age groups
• Educational content aligned with phonics phases

These automated processes do not make legal or similarly significant decisions about you. They are designed to enhance your experience and provide personalized educational content. If you have concerns about automated content, please contact us.

Third-Party Services and Sub-Processors

We work with trusted third-party service providers to deliver our Service. These sub-processors may process your data on our behalf under strict data protection agreements:

Payment Processing

Stripe (United States) - Secure payment processing. Your payment information is processed directly by Stripe under their security protocols and privacy policies. We never store your payment details.

AI Services

• OpenAI (United States) - Story generation and content creation
• FAL.ai (United States) - AI image generation (FLUX) for characters and illustrations
• Google (United States) - AI image generation (Gemini) for characters and illustrations
• Microsoft Azure (United States) - Text-to-speech narration services

Infrastructure and Database

Supabase (United States) - Secure database hosting, authentication, and file storage.

Email Communications

Resend (United States) - Transactional email delivery for account notifications and receipts.

Print Fulfillment

Prodigi (United Kingdom) - Printing and delivery of physical storybooks when ordered.

Analytics

Google Analytics (United States) - Website analytics to understand usage patterns. Data is anonymized where possible. You can opt out via our cookie consent preferences or browser settings.

International Data Transfers

Some of our service providers are located outside the United Kingdom, primarily in the United States. When we transfer your data internationally, we ensure appropriate safeguards are in place:

• We only transfer data to countries or organizations that provide adequate protection
• We use Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office
• Our US-based providers participate in the UK Extension to the EU-US Data Privacy Framework where applicable
• All transfers are subject to our data protection agreements with these providers

If you have questions about international data transfers, please contact us at info@storywisp.app.

Your Rights under UK GDPR

Under UK data protection law, you have the following rights regarding your family's information:

• Right of Access (Article 15): Request a copy of all information we have about your family
• Right to Rectification (Article 16): Update or correct any inaccurate information
• Right to Erasure (Article 17): Request deletion of your account and all associated data
• Right to Data Portability (Article 20): Export your data in a readable format
• Right to Restrict Processing (Article 18): Limit how we use your information
• Right to Object (Article 21): Object to certain types of data processing
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: Contact the Information Commissioner's Office (ICO) if you have concerns

ICO Contact: If you're not satisfied with how we handle your data, you can contact the Information Commissioner's Office at ico.org.uk or call 0303 123 1113.

Data Retention

We retain your information only as long as necessary:

• Account information: Until you delete your account
• Child profiles: Until you delete the profile or account
• Stories and characters: Until you delete them or your account
• Usage data: Anonymized and retained for up to 2 years for platform improvement
• Legal requirements: Financial records and transaction data may be retained for up to 7 years to comply with HMRC and Companies Act requirements

Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, please contact us:

Email: info@storywisp.app

Company: JJH Solutions Ltd (trading as StoryWisp)

Registered Address: England, United Kingdom

Response Time: We typically respond within 24 hours

Data Protection Enquiries: For GDPR-related requests, please email info@storywisp.app with “Data Protection Request” in the subject line.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email and by posting the updated policy on our website. Your continued use of our services after any changes constitutes acceptance of the updated policy.