Privacy Policy

Lovakid (“we”, “our”, or “us”) is committed to protecting your privacy and the privacy of your children. This Privacy Policy explains what information we collect when you use our service at lovakid.com, how we use it, and the choices you have. By using Lovakid you agree to the practices described here.

Account information: When you sign up we collect your email address and a hashed password.

Child information: To generate a personalized story you provide your child's first name, age, and interests. You may optionally upload a photo of your child to be used for illustration reference.

Payment information: Payments are processed by Paddle.com Market Ltd, our Merchant of Record. We never receive or store your credit card number, bank details, or billing address. Paddle provides us only with a transaction ID and subscription status.

Usage data: We collect standard server logs (IP address, browser type, pages visited, timestamps) to operate and improve the service.

• Generate and deliver your personalized illustrated storybook.
• Manage your account, authentication, and subscription status.
• Send transactional emails (order confirmations, story ready notifications).
• Improve the quality and safety of our service.
• Comply with legal obligations including COPPA and GDPR.

A photo you upload is held in encrypted storage only while your story is being illustrated, and is sent to our image generation provider (OpenAI) over an encrypted connection. It is permanently deleted as soon as the story preview is complete — typically within five minutes, and never more than two hours, even if the story is abandoned or fails. From that point the rest of the book is produced from the illustrated character alone: we keep the drawing, not the photograph. Photos are never used to train AI models and never shared with any third party other than the image generation pipeline.

Generated illustrations are stored in your story for you to view and download. We do not use those illustrations for any purpose other than delivering your story.

We use the following sub-processors to deliver our service. Each is contractually bound to process your data only as instructed:

• Supabase (AWS us-east-1) — user accounts and story storage.
• OpenAI — story text generation. Data is not used for model training under our API agreement.
• OpenAI — illustration generation. Photos are transient and deleted once the preview is complete, within two hours at the latest. Data is not used for model training under our API agreement.
• OpenAI — bedtime audio narration (TTS). No photos or personal data are sent for audio generation.
• Paddle — payment processing and subscription management.
• Vercel — application hosting and CDN.

We do not sell, rent, or share your personal data with any third party for their own marketing purposes.

Photos: Deleted as soon as the story preview is complete — typically within five minutes of upload, and never retained longer than two hours.

Stories and account data: Retained while your account is active. You may request deletion at any time by emailing hola@lovakid.com.

Payment records: Retained by Paddle for up to 7 years as required by financial regulations.

Server logs: Retained for up to 90 days.

Depending on your location you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request that we delete your account and all associated data.
• Portability — receive your data in a machine-readable format.
• Objection — object to certain types of processing.

To exercise any of these rights, email hola@lovakid.com. We will respond within 30 days.

Your data may be processed in the United States and other countries where our service providers operate. When we transfer data outside the EEA we rely on Standard Contractual Clauses or equivalent safeguards approved by the European Commission.

We use industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest for sensitive fields, and row-level security policies in our database. Despite these measures no system is 100% secure; we encourage you to use a strong, unique password for your account.

We may update this Privacy Policy from time to time. When we do we will update the “Last updated” date above and, for material changes, notify you by email or an in-app banner at least 14 days before the change takes effect.

If you have questions or concerns about this policy, please contact us at hola@lovakid.com. For COPPA-related requests regarding your child's data, see our Children's Privacy (COPPA) page.