Privacy Policy

Introduction

Welcome to Alo Stories Inc. ("we," "our," or "us"). At Alo Stories Inc., we create personalized children's books and stories through our product, Storywish, using artificial intelligence while respecting your privacy. This Privacy Policy explains how we collect, use, protect, and share information when you use our website, mobile applications, and services (collectively, the "Services").

We understand the sensitive nature of creating content for children and take our privacy obligations seriously. By accessing or using our Services, you agree to this Privacy Policy. If you disagree with any part of this policy, please discontinue use of our Services.

1. Information We Collect

1.1 Information You Provide to Us

When you use Storywish, we may collect:

• Account Information: Your name, email address, and password when you create an account
• Character Information: Names and descriptions of story characters you create, which may include children's names
• Photo Uploads: Images you upload to create personalized story characters
• Story Preferences: Story prompts, themes, and preferences you provide for generating content
• Payment Information: When you purchase from us, payment details are processed by our secure payment processors (we never store complete payment details)
• Communication Data: Information you provide in customer service interactions

1.2 Information Collected Automatically

When you use our Services, we automatically collect:

• Usage Data: Information about how you interact with our Services, including pages visited and features used
• Activity History: A record of the actions you take in the app (for example opening a story, adding a character to a story idea, or starting a print order), so our support team can help you and so we can see where the product gets confusing. It can include the name of a character or the title of a story you worked on. It never includes your story text or what you typed into a prompt, it stays on our own servers, and it is not shared with any analytics provider. Retained for 90 days and then deleted automatically
• Product Events: A short record from our servers that something happened in your account, such as an account being created, a story being generated, or an order being placed. It carries the fact and the time, never your story text, your prompt, your photos, or your child's name. These are processed by PostHog under a data processing agreement. Unlike the Activity History above, they are how we count what the product does, so in the United States they continue even if you decline analytics. Outside the United States they only start if you choose Allow. Section 8.3 explains the difference
• Session Recordings: Masked replays of screen interactions (pages viewed, taps, scrolling) that help us find bugs and confusing spots. All text is masked and all photos and images are blocked before a recording leaves your browser. See Section 8.3 for details, defaults by region, and how to turn recording off
• Device Information: IP address, browser type, operating system, and device identifiers
• Cookies and Similar Technologies: Data collected through cookies and similar tracking technologies (see our Cookie Policy section for more details)

2. How We Use Your Information

We use your information for the following purposes:

• Provide and Improve Our Services: Create personalized children's stories through Storywish, process transactions, and enhance our offerings
• Character and Story Creation: Generate AI-based personalized stories and illustrations based on your inputs
• Customer Support: Respond to your requests and provide assistance
• Communications: Send service-related notifications and, with your consent, marketing communications
• Analytics and Research: Understand user behavior to improve our Services, including reviewing masked session recordings (Section 8.3)
• Security and Fraud Prevention: Protect our users and Services from unauthorized access or fraudulent activity
• Legal Compliance: Fulfill our legal obligations

3. Sharing Your Information

We respect your privacy and limit sharing of your information.

3.1 Service Providers

We may share information with third-party service providers who help us operate our business:

• AI model providers to generate content
• Cloud storage providers to store your data securely
• Payment processors to handle transactions
• Analytics providers (PostHog) to help us improve our Services, including processing masked session recordings and the Product Events described in Section 1.2, under a data processing agreement

3.2 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request.

3.3 Business Transfers

If Alo Stories Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

3.4 With Your Consent

We may share information for purposes disclosed to you and with your consent.

4. Children's Privacy

Storywish is designed as a tool for parents and guardians to create content for children. Our Services are not intended for direct use by children under 13 years of age, and we do not knowingly collect personal information directly from children.

Parents or guardians control what information about children is shared through our platform. If we discover we have collected personal information from a child without parental consent, we will promptly delete that information.

We comply with the Children's Online Privacy Protection Act (COPPA). If you believe we have inadvertently collected information from a child under 13, please contact us immediately at seth@storywish.ai.

Session recording (Section 8.3) stops entirely while the minigame arcade is open, and surfaces that show uploaded photos, webcam previews, or drawing canvases are always excluded from recordings.

5. Data Retention and Deletion

We retain your personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law.

You may request deletion of your account and associated data at any time by contacting seth@storywish.ai. We will delete your data within 30 days of your request, except where we have a legal obligation to retain certain information.

Masked session recordings (Section 8.3) are retained for 30 days and then deleted automatically. Activity history (Section 1.2) is retained for 90 days and then deleted automatically, and is removed with your account if you delete it.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. However, no method of electronic storage or Internet transmission is 100% secure, and we cannot guarantee absolute security.

7. Your Privacy Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Receive your information in a structured, commonly used format
• Opt-out: Unsubscribe from marketing communications via the link in our emails
• Cookie Preferences: Manage cookie settings through your browser

For users in specific regions like the European Union or California, additional rights may apply as detailed in Sections 9 and 10 of this policy.

To exercise these rights, please contact us at seth@storywish.ai.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyze usage patterns, and deliver personalized content.

8.1 Types of Cookies We Use

• Essential Cookies: Required for the basic functionality of our Services
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with our Services
• Marketing Cookies: Used to deliver relevant advertisements and track marketing campaign performance

You can control cookies through your browser settings, though this may limit your ability to use some features of our Services.

8.2 Global Privacy Control

We honor the Global Privacy Control (GPC) browser signal. When your browser sends GPC, we treat it as a request to opt out of the sharing of your personal information for advertising and turn off ad-related tracking automatically.

Your browser is sending a Global Privacy Control signal right now. Your opt-out request has been honored.

8.3 Session Recording

To find bugs and understand where our Services are confusing, we use session recording. A session recording is a replay of screen interactions during a visit: the pages viewed, taps and clicks, scrolling, and time spent.

Recordings are masked before they leave your browser. All text on the page (including anything you type) is replaced with placeholder characters, and all photos, videos, and images (including uploaded photos, generated character portraits, and story artwork) are replaced with blank placeholders. A recording shows how the app was used, never what you wrote, uploaded, or created.

• Visitors in the United States: Masked recording is on by default. Turn it off any time with the "Turn it off" option on the analytics banner, or by contacting us.
• Visitors outside the United States: Recording and analytics are off, and start only if you choose "Allow" on the analytics banner.
• Children's surfaces: Recording stops entirely while the minigame arcade is open. Surfaces that show uploaded photos, webcam previews, or drawing canvases are always excluded from recordings.

Recordings are processed by PostHog, our analytics provider, under a data processing agreement, and are deleted automatically after 30 days.

Declining stops session recording and stops the analytics your browser collects, both straight away. What continues is the short record our own servers keep of things that happened in your account, described under Product Events in Section 1.2: an account created, a story generated, an order placed. That record carries the fact and the time. It never carries your story text, your prompt, your photos, or your child's name, and it is processed by PostHog under the same data processing agreement. We keep it because it is how we know the product works and how many families it worked for.

Outside the United States this is different. Nothing is collected until you choose Allow, and that includes the server-side record above. If you never answer the banner, nothing is collected at all.

9. International Data Transfers and GDPR

Alo Stories Inc. is based in the United States. If you access our Services from outside the U.S., your information may be transferred to, stored, and processed in the U.S. or other countries where our servers are located.

By using our Services, you consent to the transfer of information to countries that may have different data protection rules than your country. We take appropriate safeguards to ensure your information remains protected.

9.1 European Economic Area (EEA) Users: GDPR Rights

If you are located in the European Economic Area (EEA), you have certain rights under the General Data Protection Regulation (GDPR):

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct inaccurate or incomplete personal data.
• Right to Erasure: You can request that we delete your personal data in certain circumstances.
• Right to Restrict Processing: You can request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: You can request to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You can object to our processing of your personal data in certain circumstances.
• Rights Related to Automated Decision-Making: You can request human intervention in automated decision-making when this has legal or similarly significant effects.

To exercise these rights, please contact our Data Protection Officer at seth@storywish.ai.

9.2 Legal Basis for Processing

Under GDPR, we process your personal data on the following legal bases:

• Contract: Processing necessary for the performance of our contract with you to provide our Services.
• Legitimate Interests: Processing necessary for our legitimate interests, provided these interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your specific consent, such as for marketing communications.
• Legal Obligation: Processing necessary to comply with our legal obligations.

9.3 Data Protection Officer

For privacy questions or concerns specific to GDPR compliance, you can contact our Data Protection Officer at seth@storywish.ai.

10. California Privacy Rights

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect and how we use it
• The right to request deletion of your personal information
• The right to opt-out of the sale of your personal information (though we do not sell personal information)
• The right to non-discrimination for exercising these rights

To exercise these rights, please contact us at seth@storywish.ai.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by posting the revised policy on our website with an updated effective date and, where appropriate, by sending you a notification.

We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Sub-processors

Storywish relies on a small set of vendors to power the Services. Each vendor below is bound by a Data Processing Addendum (DPA). We commit to notifying users by email at least 15 days before adding a new sub-processor that materially changes data flows.