Effective Date: February 4, 2026 | Last Updated: May 28, 2026
Fablino is committed to protecting your privacy and the privacy of your family. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.
The data controller for all personal data processed through fablino.ai is:
Fablino Technologies, Sociedad Limitada
NIF/CIF: B26798041
Calle Pamplona 125, Piso 4, Puerta 3, 08018 Barcelona, Spain
Contact: [email protected]
Fablino is a personalized story generation platform designed for parents and guardians to create age-appropriate, engaging stories for their children.
When you create an account, we collect:
Important: Fablino is designed for parents and guardians. We do not collect data directly from children under 13 (or under 16 in the EU).
When you create child profiles, we collect:
By creating child profiles and generating stories, you certify that:
We collect and store:
We collect anonymous usage data to improve our service:
Payment processing is handled by our secure payment provider (Stripe). We do not store your complete credit card information on our servers.
We use your information to:
Under the EU General Data Protection Regulation (GDPR), we must have a legal basis to process your personal data. Here's our lawful basis for each type of data:
| Data Type | Purpose | Lawful Basis (GDPR) | Article |
|---|---|---|---|
| Email address | Account creation, login, notifications | Contract (necessary to provide service) | 6(1)(b) |
| Password | Authentication | Contract | 6(1)(b) |
| Child name, age, interests | Story personalization | Parental consent (explicit checkbox at signup) | 6(1)(a) |
| Payment information | Subscription billing | Contract (necessary to process payment) | 6(1)(b) |
| Generated stories | Service delivery | Contract (you requested story generation) | 6(1)(b) |
| Analytics data (PostHog) | Product improvement | Consent (cookie banner) | 6(1)(a) |
| Usage logs (errors, API calls) | Security, fraud prevention | Legitimate interest (protect our systems) | 6(1)(f) |
Withdrawing Consent:
Note: If you withdraw consent for data necessary to provide the service (e.g., child name for story generation), we may not be able to fulfill your requests.
We do not sell your data to third parties.
We may share your information only in the following circumstances:
We use trusted third-party services to operate Fablino:
These providers are bound by strict data protection agreements and can only use your data to provide services to us.
We may disclose your information if required by law, court order, or government regulation.
If Fablino is acquired or merged with another company, your information may be transferred as part of that transaction. You will be notified of any such change.
Fablino uses service providers located primarily in the United States and the European Union. While we are committed to protecting your data, the United States does not have an "adequacy decision" from the European Commission under GDPR.
To protect your data during international transfers, we rely on:
| Service Provider | Location | Data Processed | Safeguard |
|---|---|---|---|
| Supabase (database) | EU (Stockholm) | All user and child data | EU-hosted + SCCs |
| OpenAI (AI + TTS fallback) | USA | Story prompts with child name, age, interests, optional character names; story text for TTS fallback | SCCs + Limited use agreement |
| ElevenLabs (primary narration) | USA/UK | Story text containing child name | SCCs |
| Amazon Polly (fallback narration) | EU (Paris - eu-west-3) | Story text containing child name | AWS DPA + SCCs |
| Stripe (payments) | USA/Ireland | Parent email, payment info (NO child data) | SCCs + PCI DSS |
| PostHog (analytics) | EU (Germany) | Anonymous usage events | EU-hosted (no transfer) |
Important:Your child's name, age, and interests are sent to AI providers (OpenAI, ElevenLabs, Amazon) to generate personalized stories.
Your Consent:
Processor Commitments:
If you have concerns about international data transfers, please contact us at [email protected]. We're happy to provide additional details about our safeguards.
When you create a child profile, we process your child's first name, age range, and optional interests solely to personalise story content. This processing is based on your explicit consent as parent or guardian (GDPR Article 6(1)(a)). You may withdraw this consent at any time by deleting the child profile from your account settings.
We do not process children's data for advertising, profiling, or any purpose other than story personalisation.
Additional safeguards for children's data:
You have the following rights regarding your data:
You can view all your data through your dashboard and account settings.
You can update your information at any time through your account settings.
You can delete child profiles, stories, or your entire account. Contact us at [email protected] for complete account deletion.
Request a copy of your data by contacting [email protected].
You can opt out of marketing emails by clicking "unsubscribe" in any email or updating your preferences.
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a data protection supervisory authority.
Find your local supervisory authority: https://edpb.europa.eu/about-edpb/board/members_en
Examples:
Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/
Important: Lodging a complaint does not affect your right to seek judicial remedies.
If you have concerns, we encourage you to contact us first at [email protected] so we can address them directly.
We implement industry-standard security measures:
However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.
We retain your personal data for the following periods:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account Information (email, password hash, name) | Account lifetime + 30 days after deletion request | Grace period for account recovery; then permanently deleted |
| Child Profiles (name, age, interests) | Until manually deleted by user OR account closure + 30 days | Parent control + recovery period |
| Generated Stories (text) | Until manually deleted OR account closure + 90 days | Allow export after cancellation |
| Audio Files (MP3s) | 30 days after story deletion OR account closure | Storage cost optimization |
| Payment Records (Stripe transactions) | 7 years after subscription ends | Tax, accounting, and fraud prevention compliance |
| Analytics Data (anonymized events) | 12 months | Product improvement; cannot identify individual users |
| Usage Logs (API calls, errors) | 90 days | Debugging and security monitoring |
| Backup Copies (encrypted) | 30 days rolling | Disaster recovery only; then auto-deleted |
After Retention Period:
Your Control:
We use cookies for essential functionality and analytics (with your consent).
For detailed information about our cookies, please see our separate Cookie Policy.
Summary:
You can control cookies through:
Our service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites.
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
Your continued use of Fablino after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or your data:
Postal Address:
Fablino Technologies, Sociedad Limitada
CALLE PAMPLONA, 125, Piso 4, Puerta 3
08018, BARCELONA
BARCELONA, CATALUÑA
ESPAÑA
Email: [email protected]
Support: [email protected]
Legal: [email protected]
For data subject requests (access, deletion, correction), please email [email protected] with "Privacy Request" in the subject line.
What we collect about your children:
First name, age (2-12), and optional interests
What we DON'T collect:
Your control:
Our promise:
If you have any concerns about children's privacy, please contact us immediately at [email protected].
This Privacy Policy was last updated on May 28, 2026. Please check back regularly for updates.