Privacy Policy

Moonlit Tales is operated by Moonlit Tales Ltd ("we", "us", "our"). This policy explains what personal data we collect, why we collect it, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who we are

Moonlit Tales is a UK-based subscription service providing AI-generated personalised bedtime stories for families. Our data controller contact is: support@moonlittales.co.

2. What we collect and why

Parent/guardian account data — your name and email address. Used to create and manage your account and send you story notifications. Lawful basis: performance of a contract.

Child profile data — your child's first name, approximate age, and story interests (e.g. dragons, space, animals). Used solely to personalise bedtime stories. We do not collect your child's surname, date of birth, contact details, photographs, or location. Lawful basis: performance of a contract; legitimate interests (personalisation).

Payment data — billing is handled entirely by Stripe. We do not store your card number, CVV, or bank details. We store only your Stripe customer ID as a reference.

Usage data — story read counts, favourites, and milestones. Used to provide features like the annual storybook summary. Lawful basis: legitimate interests.

3. Children's data

Moonlit Tales is a service for parents and guardians, not for children directly. Children do not create accounts or interact with the platform. All child profile data is entered by an adult. We collect only a child's first name and age range — the minimum needed to personalise a story. We do not share this data with any third party for any purpose other than story generation.

4. Who we share data with

• Anthropic (AI story generation) — child first name and age range are included in story prompts. Anthropic processes this under a data processing agreement.
• Stripe (payment processing) — parent email and billing details only.
• Resend (transactional email) — parent email address and first name only.
• Replit (hosting infrastructure) — our application runs on Replit's servers.

We do not sell your data. We do not use your data for advertising.

5. How long we keep your data

Account and subscription data is retained for the duration of your account and for up to 2 years after cancellation (for legal and accounting purposes). Story content is retained indefinitely while your account is active, so you can access your archive. You may request earlier deletion at any time.

6. Your rights

Under UK GDPR you have the right to: access your data, correct inaccurate data, request deletion, object to processing, and request a copy in a portable format. To exercise any of these rights, email us at support@moonlittales.co. We will respond within 30 days.

7. Cookies and local storage

We use a JWT authentication token stored in your browser's localStorage to keep you logged in. This is essential for the service to function and is not used for tracking or advertising. See our Cookie Policy for full details.

8. Changes to this policy

We will notify you by email of any material changes to this policy at least 14 days before they take effect.

9. Contact and complaints

To contact us: support@moonlittales.co. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.