Privacy Policy

1. Introduction

ToonyStory is operated by Modlific LLC, a Utah limited liability company (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, and protect your personal information when you use our service. By using ToonyStory, you consent to the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

• Account information: your name, email address, and password when you create an account. Passwords are stored securely and are never saved in plain text.
• Google account data: if you sign in with Google, we receive your name, email, and profile picture from Google.
• Content you create: characters, stories, and AI-generated images you create within the app.
• Uploaded photos: reference photos you upload for character creation, which are sent to our AI provider for image generation.
• Usage data: we may collect basic server logs (IP address, browser type, pages visited) for security and performance purposes.
• Payment information: if you make a purchase, our payment processor collects your payment details. We do not store your credit card number or full payment details on our servers.

We do not sell your personal information.

3. How We Use Your Information

We process your information on the following lawful bases:

• To perform our contract with you: providing the ToonyStory service, authenticating your identity, and maintaining your account.
• With your consent: generating AI illustrations from your uploaded photos and sending transactional emails.
• For our legitimate interests: improving the service, ensuring security, and preventing abuse.

4. Uploaded Photos & Likeness Data

When you upload a reference photo for character creation, please be aware of the following:

• Processing: your photo is sent to Google Gemini’s API to generate a stylized illustration. We do not use facial recognition technology or build biometric profiles.
• Model training: your photos are used only to create your characters and illustrations. We never use your photos, characters, or generated images to train AI models, and content submitted through the Google Gemini API is not used by Google to train its models under the API terms we operate on.
• Storage: uploaded reference photos are stored alongside your character data for the purpose of regenerating or editing illustrations. They are not shared with other users or third parties beyond our AI provider.
• Consent responsibility: by uploading a photo of another person, you confirm that you have that person’s consent (or parental/guardian consent for minors) to use their likeness in AI-generated illustrations.
• Deletion: when you delete a character or your account, the associated reference photos and generated images are permanently removed.

5. Cookies & Tracking

ToonyStory uses the following cookies and tracking technologies:

Essential Cookies

• Session cookie: a secure cookie required to keep you logged in. This cookie is essential for the service to function and cannot be disabled.

Analytics & Advertising Cookies (Consent Required)

The following are loaded only after you consent via our cookie banner. You may decline these cookies and still use the service.

• Google Analytics: we use Google Analytics to understand how visitors use our site, including page views, session duration, and feature usage. Data is processed by Google under their Privacy Policy.
• Meta Pixel: we use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram. This shares data about your activity on our site (such as page views, sign-ups, and purchases) with Meta. Data is processed by Meta under their Privacy Policy.

Managing Your Preferences: You can change your cookie preferences at any time on our Cookie Preferences page or via the link in our website footer. You can also disable cookies in your browser settings.

Do Not Track: If you decline analytics cookies via our consent banner, no tracking scripts are loaded.

6. Third-Party Services

We use the following third-party services to operate ToonyStory:

• Google Gemini: for AI story generation and image creation. Your prompts and uploaded reference photos are sent to Google’s API.
• Google Analytics: for website analytics and usage measurement (loaded only with your consent; see Section 5).
• Meta Pixel: for advertising measurement and conversion tracking (loaded only with your consent; see Section 5).
• Stripe: for payment processing, subscriptions, and billing. Your payment information is sent directly to Stripe and is never stored on our servers.
• Lulu Direct & Printful: for printing and shipping physical books and merchandise. Your shipping address is shared with these providers to fulfill orders.
• Google: for optional social sign-in (Google OAuth).
• SendGrid: for sending transactional emails.
• Infrastructure providers: we use third-party providers for database hosting and application hosting.

Each provider processes data in accordance with their own privacy policies. We select providers that maintain appropriate security standards and data protection practices.

The full list of providers that process personal data for us, including our database and hosting providers (Neon and Vercel), Sign in with Apple, push notifications and video generation, with what each one receives and where it is processed, is on our Sub-processors page.

7. International Data Transfers

ToonyStory is operated from the United States. Our third-party service providers may process data in the United States and other countries. If you are accessing the Service from outside the United States, please be aware that your data may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to such transfers.

Where we store your data: our database (Neon), file storage and application servers (Vercel) are located in the United States. Google processes AI requests, and our print partners make and ship orders, in the countries where they operate; Lulu prints each book close to its delivery address.

Safeguards: every provider that handles personal data for us is bound by data processing terms that require it to protect that data and use it only to provide its service to us. For data from the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum) or the provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, as applicable.

New Zealand: if you are in New Zealand, the Privacy Act 2020 applies to how we handle your personal information, including when it is sent overseas. We only send it to providers that are bound to protect it with safeguards comparable to those in the Privacy Act. You can ask to access or correct your information at privacy@toonystory.com. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner.

EEA, UK and Switzerland: your rights, and the lawful bases we rely on, are set out in Sections 11 and 14. You can also complain to your local data protection authority (in the UK, the Information Commissioner’s Office).

8. Data Storage & Security

Your data is stored in a secure, encrypted database. Passwords are securely hashed and are never stored in plain text. We use HTTPS for all data transmission and secure cookies for session management. While we implement industry-standard security measures, no method of transmission or storage is 100% secure.

The measures we take include:

• Encryption in transit: every connection to ToonyStory uses HTTPS (TLS), and our providers encrypt data moving between their systems.
• Encryption at rest: our database and file storage providers encrypt stored data at rest.
• Hashed passwords: passwords are hashed with bcrypt before they are stored, so no one at ToonyStory can read them.
• Two-step verification: you can turn on two-step verification for your account, so signing in needs a second check as well as your password.
• Limited access: only staff who need it to run the service or answer your support requests can access customer data.
• Payment card data: card details go straight to Stripe and never reach our servers.

9. Data Retention

We retain your account data and created content for as long as your account is active. If you delete your account, your personal data and associated content (including uploaded photos, characters, stories, and generated images) will be permanently removed from our active systems within 30 days. Residual copies in backups may persist for up to 90 days before automatic deletion.

10. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach. We will also notify relevant authorities as required by applicable law.

For users in New Zealand, if we have a notifiable privacy breach under the Privacy Act 2020 (one that has caused, or is likely to cause, serious harm), we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable. In the EEA and UK, we notify the competent supervisory authority within 72 hours where the law requires it. If a breach affects books made through a partner, we also tell that partner promptly so it can meet its own obligations.

11. Your Rights

Regardless of your location, you have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@toonystory.com. We will respond within 30 days.

• Right to access: request a copy of all personal data we hold about you.
• Right to rectification: request correction of inaccurate personal data.
• Right to deletion: request deletion of your account and all associated data. You can delete your account directly from the Account Settings page, or by contacting us.
• Right to data portability: request an export of your data in a commonly used, machine-readable format.
• Right to restrict processing: request that we limit how we use your data while a concern is being resolved.
• Right to object: object to processing of your data based on our legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: you may request details about the categories and specific pieces of personal information we have collected about you.
• Right to delete: you may request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.
• No sale of data: we do not sell your personal information. With your consent, we share limited activity data with Meta for advertising measurement (see Section 5). You may opt out of this sharing at any time via our cookie consent banner.
• Right to opt out of sharing: you can opt out of data sharing for advertising purposes by declining cookies via our cookie banner or using the “Cookie Preferences” link in our footer.

To exercise these rights, contact us at privacy@toonystory.com. We will verify your identity before processing your request.

13. Utah Consumer Privacy Act (UCPA)

ToonyStory is operated from the State of Utah. If you are a Utah resident, you have rights under the Utah Consumer Privacy Act (UCPA):

• Right to access: you may request confirmation of whether we are processing your personal data and access to that data.
• Right to delete: you may request deletion of your personal data.
• Right to data portability: you may request a copy of your personal data in a portable format.
• Right to opt out: you may opt out of the processing of your personal data for targeted advertising or the sale of personal data. You can exercise this right via our cookie consent banner or the “Cookie Preferences” link in our footer.

To exercise these rights, contact us at privacy@toonystory.com. We will respond within 45 days. If we are unable to fulfill your request, we will explain why.

14. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• All rights listed in Section 11 above apply, along with the right to lodge a complaint with your local data protection authority.
• Lawful basis: we process your data based on contract performance (providing the Service), consent (photo uploads, email), and legitimate interests (security, service improvement).
• Data transfers: data is transferred to the United States as described in Section 7. We rely on standard contractual clauses and provider certifications where applicable.

For GDPR-related inquiries, contact our privacy team at privacy@toonystory.com.

15. Children’s Privacy

ToonyStory is designed for use by families to create children’s storybooks. While the stories are intended for children, account creation and use of the service requires a parent or guardian. We do not knowingly collect personal information from children under 13 without parental consent. If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. If you believe a child has provided us personal information without consent, please contact us at privacy@toonystory.com.

16. Books Made Through a Partner

Some retailers and resellers (our “partners”) give their customers a code or link to make a ToonyStory book. If you make a book this way:

• Who is responsible: the partner is responsible for its own customer data, such as its sales records and mailing lists, under its own privacy policy. ToonyStory processes the information you enter when you redeem the code on the partner’s behalf, to make and deliver your book.
• What we collect: your name and email address, the photos and details you provide for the characters and story, and a shipping address if your book is printed.
• What the partner can see: your name, email address and order status, and, if the partner checks books before they are sent, the finished book.
• Partner tags: on a partner’s pages, the partner’s own analytics or advertising tags may load after you accept cookies. Those tags belong to the partner and are covered by its privacy policy.
• How long we keep it: customer data from a partner book is deleted when the partner’s retention period ends, by default 365 days after the book is delivered. You can ask for it to be deleted sooner, through the partner or by contacting us. If you also have your own ToonyStory account, Section 9 applies to that account.
• Who to contact: for questions about how the partner uses your data, contact the partner. For questions about your book, or to exercise your rights over the data we hold, write to privacy@toonystory.com and we will work with the partner where needed.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page and reflected in the “Last updated” date at the top. It is your responsibility to review this policy periodically. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

18. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights: