Privacy Policy

1. Introduction

This Privacy Policy explains how Dreamgoat Limited, a company registered in England and Wales under company number 17275081 (“Dreamgoat,” “we,” “us,” or “our”), collects, uses, stores, and shares personal information when you use Storytime, including:

• Our website at dreamgoat.co.uk
• Our Storytime mobile application, once published on the Apple App Store and/or Google Play Store
• Any related services, features, or communications we refer to this Privacy Policy

(together, the “Services”). This policy also explains the rights you have over your personal information and how to contact us.

Storytime is designed for use by adults (parents, guardians, and educators) who create accounts and enter information, including information about children in their care, in order to use the Services. Children do not directly access, register for, or use Storytime.

2. Who This Policy Applies To

This policy applies to:

• Adults who create a Storytime account (“Account Holders,” “you”)
• Information Account Holders provide about family members, including children, for the purpose of using the Services (“Family Data”)
• Visitors to our website who have not created an account

3. Information We Collect

3.1 Account information

When you create a Storytime account, we collect:

• Name
• Email address
• Password. Stored only as a salted cryptographic hash, never in plain text.

3.2 Family and relationship data

To provide the Storytime experience, Account Holders may enter information about family members, including:

• Children’s names
• Family relationship details (e.g. parent, guardian, or educator relationship to a child)
• Your child’s age
• An avatar of your child, generated from a photo you provide

Where you provide a photo so we can generate your child’s avatar, we delete the original photo once the avatar has been created. We keep the generated avatar, not the photograph it came from.

This information is entered exclusively by the adult Account Holder. Storytime does not collect this information directly from children, and children do not have their own accounts or login credentials.

3.3 Camera and microphone access

With your permission, the Storytime app may request access to your device’s camera and microphone. We use the camera so you can take or choose a photo of your child, which we use to generate their avatar; the original photo is deleted once the avatar has been created. We use the microphone so you can record a voice narration for a story. We only access these features when you actively use the related function, and you can withdraw this permission at any time in your device settings. Where a photo, recording, or other content captured this way relates to a child, it is handled as Family Data (Section 3.2) and, where used to power an AI feature, as described in Section 10 (Do We Offer AI-Based Products?).

3.4 Location and device/usage data

When you use our app or website, we automatically collect certain technical information, which may include:

• Device type, operating system, and browser type
• IP address and approximate location derived from it
• App usage data (e.g. features used, session length, crash logs)
• Precise device location, where you grant location permission

3.5 Information we do not collect

We do not knowingly collect information directly from children, and we do not use Storytime to market products or services to children.

4. How We Collect Information

We collect information:

• Directly from you, when you create an account or enter Family Data
• Automatically, through your use of the app and website (via analytics, see Section 8)
• Once available, from a third-party sign-in provider if you choose to use social login (see Section 5)

5. How We Handle Social Logins

Social sign-in (for example, registering or logging in using your Google, Apple, or Facebook account) is not available during the current beta but is planned for a future production release.

Once enabled, if you choose to register or log in this way, we will receive certain profile information from that provider: typically your name, email address, and profile picture, depending on your settings with that provider. We will update this Privacy Policy with the specific providers and information involved before this feature becomes available. We recommend reviewing the relevant provider’s own privacy policy to understand how they handle your information independently of Storytime.

6. How and Why We Use Your Information

We use the information described above to:

• Create and administer your Storytime account
• Provide the core Storytime service, including AI-powered features such as personalised story or illustration generation (see Section 10)
• Maintain the security and integrity of our Services
• Understand how our Services are used, in aggregate, so we can improve them
• Communicate with you about your account or the Services
• Protect the safety of a child or other individual, where necessary
• Comply with our legal obligations

Where UK GDPR or EU GDPR applies, our legal bases are:

• Contract: processing Account Holder and Family Data is necessary to provide the Storytime service you’ve signed up for
• Legitimate interests: for security, fraud prevention, and service improvement, balanced against your rights
• Consent: for analytics cookies (see Section 8), camera/microphone access, and AI-generated features requiring your opt-in
• Vital interests: where necessary to protect the safety of a child or other individual
• Legal obligation: where we must retain or disclose information to comply with the law

7. Children’s Information

Storytime is intended for use by adults. We require Account Holders to be at least 18 years old to register.

We do not knowingly collect personal information directly from children, and children do not create their own accounts. Where an Account Holder enters a child’s name or family relationship details, that information is provided and controlled by the adult Account Holder, who is responsible for the accuracy of the information and for obtaining any consent required from the child’s other parent or guardian, where applicable.

Where a child’s information is used to power an AI-based feature, see Section 10 for details of the third-party AI providers involved.

If you are a parent or guardian and believe a child has provided us with personal information directly (outside of an Account Holder’s entry on their behalf), please contact us at privacy@dreamgoat.co.uk and we will investigate and delete such information as appropriate.

8. Cookies and Analytics

We use Google Analytics to understand how visitors use our website and app in aggregate, for example which features are used most and how people navigate the Services. We do not use advertising or retargeting cookies, and we do not use cookies or trackers to build advertising profiles.

Google Analytics may set cookies or use similar technologies (such as device identifiers in the app) to distinguish users and sessions. Where required by law (including UK PECR and the EU ePrivacy Directive), we will ask for your consent before setting non-essential analytics cookies, via a cookie/consent banner, and you can withdraw consent at any time.

Google acts as a processor of this data on our behalf. You can find more about how Google handles this data in Google’s own privacy policy.

9. How We Share Your Information

We do not sell, rent, or share your personal information with third parties for their own independent marketing purposes.

We share information only with service providers who process it on our behalf, under contract, and only to the extent necessary to provide the Services:

• Amazon Web Services (AWS): cloud hosting, infrastructure, and email delivery for storing and processing Storytime data, and for sending account and waitlist emails
• Google Analytics: website and app usage analytics (see Section 8)
• Amazon Bedrock and OpenAI: AI providers used to power Storytime’s AI-based features, such as personalised story and/or image generation (see Section 10)
• Apple App Store and Google Play: app distribution and, where applicable, payment processing
• Slack: internal notifications to our team when someone joins the waitlist

We may also disclose information where required to comply with the law, to protect the rights, property, or safety of Dreamgoat, our users, or others, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you as required by law).

10. Do We Offer AI-Based Products?

In Short: Yes. Storytime uses artificial intelligence to power features such as personalised story and/or image generation, provided through third-party AI providers.

Storytime integrates AI-based products, features, or tools (“AI Products”) to enhance your experience. These are: generating personalised story text; generating an avatar of your child from a photo you provide; generating illustrations for your stories; and narrating stories aloud. These AI Products are provided through third-party AI service providers, including Amazon Bedrock and OpenAI (“AI Service Providers”).

To power these features, we may share the following with our AI Service Providers:

• Family Data you’ve entered, such as a child’s name or details used to personalise a story
• Content you submit as an input or prompt to an AI feature
• Images or audio captured via your device’s camera or microphone, where you use a feature that requires this (see Section 3.3)

Our AI Service Providers process this information on our behalf, under contract, solely to generate the output you’ve requested. Neither provider uses this content to train their underlying models: Amazon Bedrock does not use inputs or outputs submitted through it to train Bedrock or the underlying foundation models, and OpenAI’s API, which we access on a paid basis, does not use API data to train its models by default. OpenAI may retain API inputs and outputs for up to 30 days for abuse-monitoring purposes, unless a longer period is required by law or we have Zero Data Retention enabled for eligible use cases.

You should not submit information through an AI feature that you would not want processed by our AI Service Providers under the terms described here.

11. Where We Store Your Information

Storytime data is currently hosted on Amazon Web Services in the AWS eu-west-1 region (Ireland). As we expand into new regions (including the US and Canada, and further afield over time), we plan to host data regionally closer to where our users are located.

Where we transfer personal information outside the UK or European Economic Area (EEA), for example if we introduce hosting in a non-adequate country, or use a service provider based outside the UK/EEA, including our AI Service Providers, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum, or by relying on an applicable adequacy decision.

12. Data Security

We take the security of your information seriously and use administrative, technical, and physical safeguards designed to protect it, including:

• Encryption of data in transit and at rest
• Access controls restricting who within Dreamgoat can access personal information
• Contractual requirements for our service providers, including our AI Service Providers, to maintain appropriate safeguards over any information we share with them
• Encryption at rest using customer-managed keys in AWS Key Management Service (KMS), TLS for data in transit, least-privilege IAM roles scoped per service, and private storage buckets that cannot be reached from the public internet

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and any relevant regulators as required by applicable law.

13. Data Retention

We retain personal information, including Account information and Family Data, for as long as your account remains active, and for 24 months following account deactivation or deletion.

That 24-month period does not apply where you exercise your right to erasure (see Section 14). An erasure request is actioned within the period set by the applicable regulation, normally one month under UK and EU law, rather than held for 24 months first. You can make either request at dreamgoat.co.uk/delete-account.

At the end of this 24-month period (or sooner, where this is technically and operationally feasible), we anonymise your personal information rather than simply deleting the underlying records. Anonymisation means we irreversibly remove or replace identifying details (such as names, email addresses, and any other information that could identify you or the children/family members associated with your account) so the remaining data can no longer be linked back to any individual. Once genuinely anonymised, this data is no longer personal information and we may retain it indefinitely for analytics and service-improvement purposes.

We apply the same 24-month window, followed by anonymisation, to usage and analytics data tied to an identifiable device or user. Aggregated, anonymised statistics that do not identify any individual may be retained indefinitely.

Photographs are an exception to the periods above. Where you provide a photo to generate your child’s avatar, we delete the original photo once the avatar has been created, rather than retaining it for the 24-month period (see Section 3.2).

Retention of information by our AI Service Providers is governed by our agreements with them and their own data handling terms. See Section 10.

Where we are required to retain limited information for longer to comply with legal, tax, or fraud-prevention obligations, we retain only what is necessary for that purpose, for no longer than required.

14. Your Privacy Rights

14.1 UK and EU residents

Under the UK GDPR and EU GDPR, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request erasure of your information (“right to be forgotten”)
• Restrict or object to certain processing
• Receive your information in a portable format
• Withdraw consent at any time, where processing is based on consent
• Not be subject to a decision based solely on automated processing (including AI-generated outputs or profiling) that produces legal or similarly significant effects concerning you, without the ability to request human review
• Lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office: ico.org.uk)

Where we use AI to make a decision that produces legal or similarly significant effects, we will inform you, explain the main factors involved, and offer a simple way to request human review.

14.2 US residents

Depending on your state of residence, you may have rights under applicable US state privacy laws (such as the California Consumer Privacy Act) to know, delete, and correct your personal information, and to opt out of the sale or sharing of personal information. Dreamgoat does not sell or share personal information for cross-context behavioural advertising.

14.3 Canadian residents

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to access and request correction of your personal information, and to know how it is being used and disclosed.

14.4 Exercising your rights

To exercise any of these rights, contact us at privacy@dreamgoat.co.uk. We will respond within the timeframe required by applicable law.

15. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature you can activate to signal your preference not to have your online activities tracked. No uniform technology standard for recognising and implementing DNT signals has been finalised, so we do not currently respond to DNT signals or similar mechanisms. If a standard is adopted that we must follow, we will update this Privacy Policy to reflect that.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or the law. We will post the updated version here with a revised “Last updated” date, and where changes are material, we will notify Account Holders directly (e.g. by email or in-app notice) before the changes take effect.

17. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at:

Dreamgoat Limited
Email: privacy@dreamgoat.co.uk
Website: dreamgoat.co.uk
Registered office: 9 Worton Park, Cassington, Oxfordshire, OX29 4SX, United Kingdom
Company registration number: 17275081 (registered in England and Wales)