Privacy Policy

1. Introduction

Welcome to ZollyBooks. We care deeply about privacy, especially because our platform is designed for children and families. This Privacy Policy explains what information ZollyBooks ("we," "our," or "us") collects, how we use it, and the control parents have over that data.

We operate in compliance with the Children’s Online Privacy Protection Act (COPPA) in the US, and the General Data Protection Regulation (GDPR & GDPR-K) in the UK and EU.

2. Who Is Responsible for Your Data?

• ZollyBooks (based in the United Kingdom) is the "Data Controller."
• The Parent/Guardian: You are the account holder. You provide consent for your child to use the app.
• The Child: The end-user who creates and reads stories. We do not collect personal contact information from children.

3. Information We Collect

3.1. Information Provided by Parents

To set up an account and verify parental consent, we collect:

• Email Address: For login, account recovery, and critical service notifications.
• Password: Encrypted and stored securely.
• Payment Information: We do not store credit card numbers. Transactions are processed by Apple (App Store) or Google (Play Store). We receive only a transaction receipt.
• Parent Zone Settings: PIN codes or security answers used to lock the Parent Zone.

3.2. Information Created by the Child ("User Generated Content")

When a child uses the app, we process:

• Text Prompts: The ideas typed or selected to create a story.
• Uploaded Images (Image-to-Character): If a Parent enables the feature, users may upload an image to generate a custom character. This image is processed transiently. It is scanned for safety, used to generate the character, and then immediately and permanently deleted from our servers. We do not store the original photo.
• Generated Content: The resulting stories, characters, and images created by the AI.
• Reading History: Books read, duration, and streaks.

3.3. Technical Data

• Device Information: Device model, OS version, and language settings.
• Identifiers: A unique, anonymous User ID (e.g., User-12345) to track Spark balances.
• Crash Logs: Anonymous data sent if the app crashes.

3.4. What We Do NOT Collect

• Biometric ID Data: While we process uploaded photos to create cartoon characters, we do not scan faces for the purpose of identification (e.g., FaceID) or build biometric templates.
• Precise Location: We do not track GPS location.
• Chat Logs: The app does not feature free-form chat.

4. How We Use Your Information

We use this data solely to operate and improve ZollyBooks:

• To Provide the Service: Using your prompts to generate stories via our AI partners.
• To Maintain Your Account: Syncing your books, Sparks balance, and reading streaks across devices.
• To Ensure Safety: Scanning prompts and content to detect and block harmful language or PII.
• To Communicate: Sending parents emails about subscription updates or policy changes. We never email children.

5. Artificial Intelligence & Third Parties

5.1. Google Gemini (The AI Provider)

ZollyBooks uses Google Gemini (via Vertex AI) to generate stories and images.

• How it works: We send the text prompt and style settings to Google.
• Privacy Protection: We do not send personal user details to the AI model.
• No Training: Google does not use your data to train their AI models.

5.2. Image Processing (Custom Characters)

When you upload a photo to create a character:

• The image is sent to our AI provider via a secure, encrypted connection.
• The AI analyzes the visual features to generate a stylized cartoon version.
• The original image is not saved. Once the cartoon is generated, the original photo is discarded by both ZollyBooks and our AI provider.

We do NOT sell your data or your child’s data to advertisers. There are NO ads in ZollyBooks.

6. Public Sharing and "Viral Links"

• Private Books: By default, books are private.
• Public Library: If a Parent authorizes a book to be "Published," it becomes visible to all ZollyBooks users globally.
• Web Viewer: If a Parent shares a link to a book, that book becomes accessible on the public web via our Web Viewer.
• Anonymity: Published books display the "Author Name" chosen in the profile. We advise parents not to use the child's real full name.

7. Children’s Privacy (COPPA & GDPR-K)

We do not knowingly collect personal information from children without verified parental consent. Consent is obtained via the Parent Gate, which requires a Parent to sign in and (for critical features) perform a verified action.

Parental Rights:

• Review the information we have collected from your child.
• Revoke consent and refuse further collection.
• Request the deletion of your child’s account.

To exercise these rights, use the "Delete Account" button in the Parent Zone or contact support@zollybooks.com.

8. Data Retention

• Active Accounts: Data retained while account is open.
• Inactive Accounts: Books archived after 12 months. Account deleted after 24 months of inactivity.
• Public Content: If you delete your account, published books may be anonymized and retained to ensure the library and Remixes remain functional.

9. Security

We use industry-standard encryption (HTTPS/TLS) to protect data. Access to user data is restricted to authorized employees. However, no method of transmission over the internet is 100% secure.

10. International Data Transfers

ZollyBooks is available globally. Your information may be transferred to and processed in the United States (where our cloud providers maintain servers). We ensure these transfers comply with GDPR via Standard Contractual Clauses (SCCs).

11. Your Rights (GDPR/CCPA)

Depending on your location, you may have the right to Access, Rectify, Erase, or Port your data. Contact us to exercise these rights.

12. Contact Us