🔒 Privacy Policy

1. Who We Are (Data Controller)

The data controller responsible for your personal information is:

Animolux Ltd acts as the data controller for all personal data processed via the Vivid Fables platform in compliance with the Data Protection Act 2018.

2. What Data We Collect

We are committed to transparency. Here is an honest account of what data our platform processes:

2.1 Account & Session Data

When you use Vivid Fables, we assign you a unique user identifier (userId) stored in your browser's local storage and linked to a server-side session in our database. This session has a 7-day rolling duration.

• Pseudonymous user ID (randomly generated)
• Session token and expiry timestamp
• Wonderful Stars balance (daily free credits + purchased credits)

2.2 Story Content

When you generate a story, the following is processed and stored:

• Your story prompt and preferences (age group, style, characters) — sent to our AI provider to generate content
• Generated story text — stored securely on our servers
• Generated images — stored securely on our servers
• Story metadata (title, creation date, style)

2.3 Payment Data

If you purchase Wonderful Stars, payment is processed by Stripe. We do not store your full card details. Stripe provides us with:

• Payment confirmation and transaction reference
• Number of Stars purchased and amount paid
• Your billing country (for tax/compliance records)

Your email address and billing address are collected by Stripe directly and governed by Stripe's Privacy Policy.

2.4 Technical Data

As with all websites, our hosting provider (Cloudflare) automatically processes:

• Your IP address (used for security and rate limiting)
• Browser type and device type
• Country of origin (derived from IP)

2.5 Data We Do NOT Collect

• We do not collect your name, email, or phone number to use the story generator
• We do not build behavioural profiles for our own marketing
• We do not sell your personal data to third parties

3. How and Why We Use Your Data (Lawful Basis)

Under UK GDPR Article 6, we must have a lawful basis for each processing activity:

Processing Activity	Lawful Basis	Detail
Generating and storing your stories	Contract	Necessary to provide the core service you requested
Managing your Stars balance and session	Contract	Necessary to deliver the credits system you purchased
Processing payments via Stripe	Contract	Necessary to complete your purchase transaction
Sending story prompts to Google Gemini AI	Contract	Necessary to generate AI stories — core service function
Cloudflare IP/technical logging	Legitimate Interests	Security, fraud prevention, service reliability
Keeping payment/transaction records	Legal Obligation	UK financial record-keeping requirements (Companies Act 2006)

4. Third-Party Processors & International Transfers

We use the following third-party service providers who may process your data. We have data processing agreements in place with each where required by UK GDPR:

Provider	Purpose	Data Transferred	Location / Safeguard
Cloudflare Inc.	Hosting, CDN, database, object storage	Story content, images, session data, IP address	🇺🇸 USA (SCCs)
Google LLC (Gemini AI)	AI story generation	Story prompts, age group, style preferences	🇺🇸 USA (SCCs)
Stripe Inc.	Payment processing	Card details, billing address, email	🇺🇸 USA / 🇮🇪 Ireland (SCCs)

5. How Long We Keep Your Data

Data Category	Retention Period
Session tokens	7 days (rolling, deleted on logout)
Generated stories and images	Until you delete them, or 12 months of inactivity
Stars balance and transaction records	7 years from transaction date (Legal Obligation)
Cloudflare server logs (IP, access)	Up to 30 days (Security)
Local storage data (your device)	Until you clear your browser storage

6. Cookies & Local Storage (PECR 2003)

Vivid Fables uses minimal data storage technologies to ensure the service functions correctly. Under the Privacy and Electronic Communications Regulations 2003 (PECR), we do not require prior consent for the following items because they are "Strictly Necessary" for the service you requested:

Name	Type	Purpose	Duration
vivid_session	Cookie	Maintains your login session and Wonderful Stars balance.	7 days
vivid_user_id	LocalStorage	Stores your pseudonymous identifier to manage your story library.	Until cleared
vf_draft_*	LocalStorage	Saves your story drafts locally to prevent data loss.	Until saved

7. Children's Privacy & UK Age Appropriate Design Code

Our Commitments

• Privacy by Default: Stories are private to each session.
• No Profiling of Children: We do not create profiles of children or use data from stories for targeted advertising.
• Data Minimisation: We only collect the minimum data needed to provide the service.
• No Advertising: We do not display personalized third-party advertisements.

COPPA (US Users)

For users accessing Vivid Fables from the United States, we comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13.

8. Your Rights Under UK GDPR

Under UK GDPR, you have rights regarding your personal data:

To exercise any of these rights, email us at support@vividfables.uk with the subject line "Data Rights Request". We will respond within one calendar month.

9. Security

We take appropriate technical and organisational measures to protect your personal data, including HTTPS encryption (TLS 1.2+), Secure session cookies, and enterprise-grade firewall protection via Cloudflare.

10. Contact Us & ICO Complaints

Right to Lodge a Complaint with the ICO

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113