Children's Privacy (COPPA)

Lovakid is a service designed to create personalized storybooks for children ages 2–10, used by their parents or legal guardians. We take children's privacy exceptionally seriously. This page explains our practices in compliance with the Children's Online Privacy Protection Act (COPPA), the EU General Data Protection Regulation (GDPR), and equivalent children's privacy laws worldwide.

Lovakid accounts are created and managed by adults (parents or guardians). We do not knowingly allow children under 13 to create accounts or interact with the Service directly.

Children are the subject of the stories — their names, ages, and interests are provided by the parent or guardian solely to personalize the storybook experience.

When a parent creates a story, they may provide:

• Child's first name — used inside the story text and on the cover.
• Child's age — used to calibrate story length and vocabulary complexity.
• Interests and details — used to personalize the story theme and plot.
• Child's photo (optional) — used to generate Pixar-style illustrations of the child as the story's hero.

We collect the minimum information necessary to generate the story. We do not ask for a child's surname, school, location, contact details, or any other information beyond what is listed above.

• To generate and render the personalized storybook.
• To display the child's name on the story cover and within the narrative.
• To tailor the story's reading level, vocabulary, and complexity to the child's age.

A child's photo is an input we discard, not an asset we keep:

• Photos are transmitted over an encrypted (TLS) connection and held in encrypted storage only while the story is being illustrated.
• They are used for a single purpose: drawing the child as an illustrated character for that specific story.
• The photo is permanently deleted as soon as the story preview is complete — typically within five minutes of upload, and never more than two hours, even if the story is abandoned or fails.
• Photos are never used to train AI models.
• Photos are never shared with any third party except the single illustration pipeline (OpenAI) for that specific story generation request.

Once the photo is deleted, the rest of the book — including any pages illustrated after a purchase — is produced from the illustrated character alone. We keep the drawing; we do not keep the photograph.

By creating a story and uploading a child's photo, the parent or guardian provides verifiable parental consent for the processing described in this policy. If you are creating a story for a child who is not your own, you must have the permission of that child's parent or legal guardian before uploading any photo.

We do not collect consent directly from children and do not direct any part of our Service to children for their independent use.

As a parent or guardian you have the right to:

• Review — request a summary of the personal information associated with your child that we hold.
• Delete — request deletion of your child's information and all associated stories. Stories are permanently deleted and cannot be recovered.
• Refuse further collection — close your account at any time to stop all further data collection.
• Correct — request that we correct inaccurate information.

To exercise any of these rights, email hola@lovakid.com with the subject line “COPPA Request”. We will verify your identity as the account holder and respond within 10 business days.

We do not sell, rent, or share children's personal information with third parties for their own marketing or commercial purposes.

The following service providers process children's data solely to deliver the story:

• OpenAI — generates the story text. Under our API agreement, data is not used for training.
• OpenAI — generates the illustrations from the uploaded photo (photo deleted once the preview is complete, within two hours at the latest). Data is not used for training under our API agreement.
• OpenAI — generates the audio narration from story text (TTS). No child images or photos are sent for audio generation.
• Supabase — stores the finished story (text and illustrations) in an encrypted database.

All providers are contractually bound to process data only as instructed, maintain appropriate security, and comply with applicable law.

We implement industry-standard security measures: TLS encryption for all data in transit, AES-256 encryption at rest, strict access controls, and regular security reviews. Only authorized personnel can access personal data and only for legitimate operational purposes.

For users in the European Economic Area (EEA), the United Kingdom, and other regions with enhanced children's data protection laws: we process children's personal data based on the lawful basis of contract performance (to deliver the story the parent purchased) and legitimate interests (service improvement, security). We apply age-appropriate design principles and do not subject children's data to profiling, behavioral advertising, or automated decision-making.

For any questions or concerns about how we handle children's data, or to submit a COPPA request, contact our privacy team:

Email: hola@lovakid.com (subject: “COPPA Request”)
Response time: Within 10 business days.