Privacy Policy

This Privacy Policy explains how Littale LLC ("Littale," "we," "us," or "our"), a New Mexico limited liability company, collects, uses, discloses, and protects information when you access or use our website at littale.com and our web application at app.littale.com (together, the "Service"). Please read this Policy carefully, in particular Section 7 (Children's Privacy), because our Service involves the creation of personalized content using photographs and information about children.

By accessing or using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree with this Policy, please do not use the Service. This Policy does not constitute legal advice and is provided for informational purposes to describe our actual data practices.

1. Who We Are

Littale LLC is a Domestic Limited Liability Company organized under the laws of the State of New Mexico, USA. For the purposes of applicable data protection law, Littale LLC is the data controller (or "business"/"processor," as those terms are used in your jurisdiction) responsible for the personal information described in this Policy, except where we act on behalf of another party as noted below. You may contact us at support@littale.com.

2. Scope of This Policy

This Policy applies to all information collected through littale.com (our public landing and marketing site) and app.littale.com (our core application), including the Open Library, storybook creation tools, Learning Quests, community features, subscription and billing management, and any related customer support communications. It does not apply to third-party websites, applications, or services that we do not own or control, even if linked from or integrated with our Service (see Section 9).

3. Information We Collect

3.1 Account Registration Data.

• Direct email sign-up: full name, email address, and a password. Your password is transmitted over an encrypted (HTTPS) connection and is immediately converted into a secure, non-reversible cryptographic hash before storage — we never store your password in plain text and cannot see it. We verify your email address using a one-time password (OTP) sent to the address you provide.
• Google OAuth sign-up/login: if you choose to register or log in with Google, we receive your full name and email address from Google, in accordance with Google's authorization scopes and your Google Account settings.
• IP-derived location data: we capture your IP address at sign-up and use it to derive coarse, country-level location information.

3.2 Content You Create.

• Uploaded reference photographs used to generate a stylized, cartoonized "hero" character (see Section 7 for critical rules governing this data).
• Child profile metadata you provide to personalize a story: a child's name, age, and gender; the names and relationship (e.g., parent, sibling, friend, grandparent) of any additional characters; and household pet details (type and name).
• Story customization choices: story title, storyline theme selections, and any edits you make to AI-generated titles, summaries, or the personalized foreword message.
• Comments, star ratings (1–5), and reviews you post on storybooks.

3.3 Learning Quest & Activity Data.

• Quest responses, scores (out of 100), and completion status across all five quest types (Read Aloud, True or False, Rearrange, Multiple Choice, Fill in the Blanks).
• Read Aloud voice recordings: audio submitted by a child reading a story passage aloud, processed by our AI service provider to generate a text-based, color-coded pronunciation breakdown. See Section 7.4 for strict access limitations on this audio.
• Leaderboard data: your display name, country flag, and rank on a given storybook's dedicated leaderboard.

3.4 Payment & Transaction Metadata.

We do not directly process payments and never receive, view, or store your full payment card number, bank credentials, or CVV. All checkout, recurring billing, currency conversion, and tax handling is performed by our Merchant of Record, Stripe, Inc. ("Stripe"), acting as an independent controller/processor of your payment details under its own privacy policy. From Stripe, we receive and store limited transaction metadata necessary to administer your account: your internal user ID, the item purchased, transaction ID, transaction amount, payment method type (e.g., "card"), timestamp, transaction status, and Stripe-generated invoices.

3.5 Shipping & Physical Order Data.

When you place an order for a physical printed storybook, we collect and store the following shipping information in our database: full name, email address, phone number, address line 1, address line 2, city, state/province, zip/postal code, country, and whether the address is a home or office (via a checkbox at checkout). This information is transmitted to our print-on-demand fulfillment partner, Lulu Press, Inc. ("Lulu.com"), solely to produce and ship your order. Lulu.com processes this data under its own privacy policy as an independent controller/processor for fulfillment purposes.

3.6 Technical, Device & Analytics Data.

When you visit littale.com or app.littale.com, we and our analytics providers automatically collect: IP address, device model and name, browser type and version, general internet connection attributes, pages visited and time spent (dwell time), entry and exit URLs, referring pages, UTM campaign parameters, session and visitor identifiers, and IP-derived geolocation information (such as country, region, city, postal code, approximate coordinates, timezone, and network/ISP details). We use this information for analytics, fraud prevention, and to improve the Service, and it is aggregated via our own systems as well as our analytics providers' pipelines.

3.7 Advertising Data.

Littale displays third-party advertisements served through Google AdSense and/or other third-party advertising networks. These providers may collect and use technical identifiers (such as cookies or advertising IDs) to serve and measure ads, subject to their own privacy policies. See Section 9 and Section 7.5 regarding advertising directed at children.

4. Legal Bases for Processing (EEA, UK & Similar Jurisdictions)

If you are located in the European Economic Area, United Kingdom, or another jurisdiction that requires a documented legal basis for processing personal data, we rely on the following bases:

• Consent — for uploading reference photographs, processing child profile data, Read Aloud audio processing, marketing emails, and non-essential cookies. You may withdraw consent at any time (see Section 12).
• Performance of a contract — to create your account, generate the storybooks and features you request, process subscriptions, and provide customer support.
• Legitimate interests — to secure the Service against fraud and abuse, maintain and improve platform performance, and operate core analytics, balanced against your rights and interests.
• Legal obligation — to retain transaction records for tax, accounting, and financial dispute purposes, and to respond to lawful requests from public authorities.

5. How We Use Your Information

• To create and administer your account, authenticate you, and provide the core storybook generation, reading, and Learning Quest features.
• To process subscription payments, add-on credit purchases, and physical print orders via our payment and fulfillment partners.
• To generate AI-based story content, illustrations, and quest evaluations via our AI service provider.
• To operate leaderboards, community comments, ratings, and group/classroom sharing features.
• To send mandatory transactional communications (OTP codes, password resets, security notices, billing receipts) and, where you have not opted out, promotional communications.
• To detect, investigate, and prevent fraud, abuse, unauthorized access, copyright infringement, and violations of our Terms and Conditions.
• To analyze aggregate usage trends and improve the performance, safety, and design of the Service.
• To comply with applicable law, respond to legal process, and enforce our agreements.

We do not sell children's personal information. We do not use children's personal information to serve behaviorally-targeted advertising to children (see Section 7.5).

6. Public vs. Private Storybook Visibility

You control the visibility of each storybook you create:

• Public storybooks: making a storybook public on the Open Library requires your explicit, separate consent, because it will publicly display the child's cartoonized character, name, narrative text, and page illustrations. Once public, any visitor or registered user may read the story, complete its Learning Quests, submit comments and ratings, and appear on its dedicated leaderboard. Any user may also download the story or, once the feature is live, order a printed copy.
• Private storybooks: every storybook is also assigned a unique, complex 32-character link. When the storybook's "Allow Private Access" toggle is switched On, anyone who obtains this specific link can read the flipbook, complete quests, comment, rate, and appear on that story's leaderboard. Reading via the private link does not require an account; registration is only required to access the Learning Quest in order to save quest progress. Treat this link as sensitive and only share it with people you trust, since we cannot restrict access based on identity once the link is shared. If the "Allow Private Access" toggle is switched Off, the link will not grant access to the storybook.

7. Children's Privacy

We are committed to complying with the U.S. Children's Online Privacy Protection Act ("COPPA"), the child-specific provisions of the EU General Data Protection Regulation ("GDPR"), and the UK Information Commissioner's Office Age Appropriate Design Code. This section governs any personal information relating to a child under the age of 13 (or the relevant age of digital consent in your jurisdiction, which may be up to 16 in some EU member states).

7.1 Who May Provide a Child's Information.

Photographs, names, ages, and other personal details of a child may only be submitted by a verified adult who is the child's parent, legal guardian, teacher, or another adult with legal authority over the child (an "Authorized Adult"). By submitting a child's information or photograph, you represent and warrant that you are an Authorized Adult for that child and that you have the legal right to provide their information for the purposes described in this Policy. We reserve the right to request additional verification of this status and to suspend or remove content and account where we have reason to doubt it.

7.2 Photograph Handling & Deletion.

• Original, uploaded reference photographs are never displayed on the public website, application front-end, generated storybooks, or shared with other users at any time.
• Uploaded photographs are used solely to generate a stylized, non-photorealistic cartoon character and are stored only in secure backend infrastructure for that limited purpose.
• Original photographs are permanently deleted no later than thirty (30) calendar days after upload. Only the resulting cartoonized character image is retained thereafter, unless you delete the character sooner via the "My Character" panel (see Section 11).
• We do not perform facial recognition, biometric identification, or automated categorization of any uploaded photograph, and we do not use uploaded photographs to train third-party or public AI models.

7.3 Child Profile Metadata.

To personalize a storybook, we collect a child's name, age, and gender, along with the names and relationships of any additional characters (family, friends) and household pets that the Authorized Adult chooses to include. This information is used exclusively to generate the requested story content and, where the storybook is made public or shared via link, to display the character's name and story content as described in Section 6.

7.4 Read Aloud Audio & Voice Privacy.

• When a child completes a "Read Aloud" quest, their voice recording is processed by our AI service provider to generate a text-based pronunciation evaluation.
• The storybook creator (e.g., a teacher or parent distributing the book) can never listen to a participant's raw audio recording submitted while completing a Learning Quest linked to the creator's storybook, unless that raw audio was recorded and submitted using the creator's own account. Creators receive only anonymized, text-based diagnostics showing which words were pronounced correctly or incorrectly.
• A child may only listen to their own recorded audio; recordings are not accessible to other participants.
• Raw recorded voice for a Read Aloud quest can only be listened to using the account that was used to record and submit that audio; recordings are not accessible to other participants of the same Learning Quest.

7.5 No Behavioral Advertising to Children.

Advertisements shown on the Service are intended to be age-appropriate and contextual. We do not knowingly permit behaviorally-targeted advertising based on a child's personal information, and we do not knowingly collect precise geolocation, persistent advertising identifiers, or cross-site tracking data from users we know to be children, for advertising purposes.

7.6 Classroom / Group Use.

A student accessing a storybook via a private link distributed by a teacher may read the story and complete Learning Quests without creating an account or disclosing any personal identifier. If a student chooses to register their own free account to save quest progress, standard account registration data (Section 3.1) applies to that account, and the creator of the linked storybook may view that participant's quest answers, scores, and leaderboard rank for pedagogical evaluation purposes, but not their raw Read Aloud audio (Section 7.4).

7.7 Parental Rights.

If you are a parent or legal guardian, you have the right at any time to: (a) review the personal information we have collected about your child; (b) request that we delete your child's personal information and any associated character or storybook; (c) refuse to permit further collection or use of your child's information; and (d) request a description of the types of information we have collected. To exercise any of these rights, contact support@littale.com from the email address associated with the relevant account, or with sufficient information for us to locate the relevant content if no account exists. We will respond within the timeframe required by applicable law.

7.8 Third-Party Processing of Children's Data.

Child metadata and uploaded reference images are transmitted to one or more of our third-party AI service providers (see Section 9) solely to generate story and character content, and to physical print vendors (see Section 9) only if and when you place a physical print order.

8. Automated Safety Filters & Content Moderation

We employ automated safety filters, including built-in moderation tools operating at the AI provider's API layer, to screen text inputs and uploaded media for inappropriate content before generation. Users are strictly prohibited from uploading media or generating content for which they do not hold legal rights. Violations may result in immediate content removal and permanent account termination. We maintain a dedicated moderation and takedown process for copyright and inappropriate-content complaints submitted to support@littale.com, and we aim to investigate and act on verified complaints within 72 hours.

9. Third-Party Service Providers

We share limited categories of information with the following service providers, each of which processes data under its own privacy policy and, where required, a data processing agreement with us:

• Stripe, Inc. (Merchant of Record): processes all payments, subscription billing, currency conversion, tax handling, and add-on purchases. We never receive your full card details.
• Third-Party AI Service Providers: we use one or more established third-party artificial intelligence providers to process story prompts, child profile metadata, and uploaded reference images, in order to generate narrative text, illustrations, and quest content, and to provide automated content-safety filtering. For security and operational reasons, we do not publicly disclose which specific provider(s) — which may include, without limitation, Google LLC, OpenAI, L.L.C., Anthropic PBC, or other similarly established providers — process any given request at any particular time, and this may change without notice. Each provider we use is contractually and/or by policy restricted from using your submitted data to train their own publicly available models, where such terms are made available to us.
• Google LLC (Google OAuth): provides optional sign-up/login authentication.
• Google Analytics & Vercel Analytics: provide aggregated, pseudonymous website and application performance and traffic analytics.
• Google AdSense / third-party advertising networks: serve advertisements on the Service (see Section 7.5 for children-specific limits).
• Vercel, Inc.: hosts our frontend application and provides content delivery and edge infrastructure.
• Amazon Web Services, Inc. (AWS): hosts our backend application servers, databases, and encrypted file storage.
• Cloudflare, Inc.: provides content delivery network (CDN), DNS, and security/DDoS protection services across our domains.
• Hostinger: provides email delivery infrastructure for our transactional and support email communications.
• Lulu Press, Inc. (Lulu.com): our print-on-demand and shipping fulfillment partner for physical storybook orders. When you place a physical print order, we transmit your shipping details (name, email, phone, address lines 1 and 2, city, state, zip code, country, and home/office designation) along with your storybook files to Lulu.com to produce and ship your order. Lulu.com processes this data under its own privacy policy.

We do not sell your personal information to third parties for their own independent marketing purposes. Where required by CCPA/CPRA or similar law, our use of advertising cookies may be considered a "share" for cross-context behavioral advertising purposes — see Section 13 for your opt-out rights.

10. Cookies & Similar Technologies

We use cookies, local storage, and similar technologies for authentication, security, performance analytics, and (where applicable) advertising. Full detail on individual cookies, their purpose, duration, and how to manage your preferences is provided in our separate Cookie Policy. Where required by applicable law (including the EU/UK cookie rules), we obtain your consent before setting non-essential cookies via our cookie consent banner.

11. Data Retention

• Reference photographs: deleted no later than 30 days after upload (Section 7.2).
• Deleted storybooks: deletion via the storybook settings panel (with OTP verification) is immediate, permanent, and unrecoverable.
• Deleted characters: unused characters may be permanently deleted at any time; a character in use by an active storybook cannot be deleted until that storybook is removed first.
• Deleted accounts: account deletion (OTP-verified) may be reversed within a 30-calendar-day recovery window by contacting support@littale.com from the registered email; after 30 days, deletion becomes permanent. Deletion immediately and irreversibly forfeits any remaining subscription time, Book Credits, or Image Credits, even if the account is later restored within the window.
• Quest data, leaderboard data, ratings, and comments: retained indefinitely unless the associated storybook or account is deleted.
• Transaction and billing metadata: retained for as long as necessary to comply with applicable tax, accounting, and financial recordkeeping obligations (typically several years after the transaction).
• Shipping address data: retained in our records for as long as necessary to fulfill your order, handle delivery issues or defect claims (Section 9 of our Cancellation & Refund Policy), and comply with applicable tax/accounting recordkeeping obligations, or until you request its deletion via support@littale.com, subject to Section 11 retention needs for financial records.

12. Withdrawing Consent

Where our processing of your (or your child's) information relies on consent, you may withdraw that consent at any time by deleting the relevant character, storybook, or account, or by contacting support@littale.com. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, and may limit or disable your ability to use certain features of the Service. Please note that while Littale will remove your content and data from our own systems upon deletion or withdrawal of consent, we have no control over, and no responsibility for, copies of your content or data that you have already shared with others or made public — for example, storybooks downloaded, screenshotted, or redistributed by another user before deletion, or content accessed via a private link or the Open Library prior to removal. Removing such copies, if desired, is your responsibility as between you and the third party who holds them.

13. Your Privacy Rights

13.1 For users in the EEA, UK, and similar jurisdictions (GDPR/UK GDPR):

You have the right to request access to, rectification or erasure of, restriction of or objection to processing of, and portability of your personal data, and the right to lodge a complaint with your local data protection supervisory authority. Where processing is based on consent, you have the right to withdraw it at any time (Section 12).

13.2 For California residents (CCPA/CPRA):

You have the right to know what personal information we collect, use, disclose, and (where applicable) "share" or "sell"; the right to request deletion; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising; the right to limit the use of sensitive personal information; and the right not to receive discriminatory treatment for exercising these rights. Because we use advertising technologies that may constitute a "share" under CPRA, you may opt out via the cookie preference controls described in our Cookie Policy or by contacting us directly.

13.3 For residents of other U.S. states (including Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws), you may have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, subject to the specific terms of your state's law.

13.4 Exercising your rights.

To exercise any of the above rights, contact us at support@littale.com from the email address associated with your account (or, for a parent/guardian acting on behalf of a child, with sufficient identifying information for us to locate the relevant content). We may need to verify your identity before fulfilling your request. We will respond within the timeframe required by applicable law, and in any event no later than 45 days from a verified request, except where a shorter or longer period is legally required.

14. International Data Transfers

Littale LLC is based in the United States, and our infrastructure and service providers may process and store data in the United States and other countries. If you are located in the EEA, UK, or another jurisdiction with data transfer restrictions, we take steps required by applicable law to ensure an adequate level of protection for your data when it is transferred internationally, including reliance on Standard Contractual Clauses or equivalent safeguards with our service providers where applicable.

15. Data Security

We implement technical and organizational measures designed to protect personal information, including encryption of data in transit and industry-standard password hashing. However, no method of transmission over the internet or electronic storage is 100% secure. While we work to protect your information, we cannot guarantee its absolute security, and you use the Service at your own risk. We are not liable for unauthorized access, security breaches, or data loss that occurs despite our reasonable security measures, except as required by applicable law.

16. Email Communications

• Transactional emails — OTP codes, password resets, security notices, billing receipts, and essential account/support correspondence — are sent to your registered email address and are a mandatory condition of maintaining an account; you cannot opt out of these while retaining an active account.
• Marketing emails — promotional updates, feature announcements, and educational offers — are optional. You may unsubscribe at any time using the link included in each marketing email.

17. Do Not Track

Some browsers offer a "Do Not Track" signal. Because there is not yet a common industry standard for how to interpret this signal, our Service does not currently respond differently based on a detected Do Not Track signal. You can still control cookies and tracking through the mechanisms described in our Cookie Policy and your browser settings.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the updated Policy on this page with a revised "Last Updated" date, and for material changes affecting children's data or your rights, we will provide additional notice, such as an email to your registered address or a prominent notice on the Service, before the change takes effect.

19. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices — including requests from parents or guardians regarding a child's information — please contact:

Littale LLC
Privacy & Compliance
Email: support@littale.com
Registered Address: 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA