Children's Privacy

DRAFT — pending review by qualified Spanish/EU counsel. Bracketed [PLACEHOLDERS] must be completed before this document is relied upon in production. The English version governs; other languages are provided for convenience only.

Effective date: [EFFECTIVE DATE] Last updated: [EFFECTIVE DATE]

---

This notice is written for parents. It explains, in plain language, how SleepyCuddle handles the small amount of information you give us about your child so that we can create bedtime stories personalised for them. It is a companion to our main Privacy Policy (https://sleepycuddle.com/privacy), which explains our data practices in full. Where this notice and the Privacy Policy overlap, please read them together; where a detail is not covered here, the Privacy Policy applies.

---

Table of contents

1. The short version
2. Who we are
3. Children do not have accounts
4. What information about your child we process
5. Why we process it, and our legal basis
6. How stories are made safe: you approve the text first
7. No advertising, no profiling, no automated decisions about your child
8. The Spanish digital age of consent (14) and why it is not triggered here
9. Your voice recording is separate — and about you, not your child
10. Deleting your data and exercising your rights
11. Who helps us run the service
12. How long we keep children's data
13. Cookies and similar technologies
14. If something goes wrong: data breaches
15. Your rights and how to complain
16. Contact us
17. Changes to this notice

---

1. The short version

• Only adults hold accounts. Your child never signs in, never creates an account, and never interacts with us directly.
• You are in control. As the parent or legal guardian, you provide and manage all of your child's information under your parental responsibility.
• We collect very little about your child — only a first name, an approximate age, a few preferences, and an illustrated avatar you choose — and we use it only to personalise that child's stories. The stories we then create for your child are built around the themes and preferences you choose (see sections 4 and 12).
• You see every story as text and approve it before it is ever read aloud. Every story also passes automated safety checks.
• No advertising. No ads at all. No behavioural profiling of your child, and no automated decisions made about them.
• You can delete your entire account at any time from the app, which permanently erases all associated personal data — your voice recording and voice clone, your children's profile information, and the stories generated for them (subject to the limited legal retention described in section 12). To withdraw consent for the voice, or to erase or correct particular data without deleting your whole account, contact us at [CONTACT EMAIL] (see section 10).

---

2. Who we are

SleepyCuddle is operated by [OPERATOR FULL NAME], a self-employed individual (autónomo) established in Spain, acting as the data controller for the personal data described in this notice.

SleepyCuddle is offered only to users in the European Union / European Economic Area, and is available only through our website (sleepycuddle.com). The service is governed by Spanish law.

Given the small scale of the service, we are not required to appoint, and have not appointed, a Data Protection Officer. You can reach us directly using the contact details above for any data-protection question.

---

3. Children do not have accounts

This is the single most important thing to understand about how SleepyCuddle works.

• Children do not have accounts and never sign in. There is no login, password, or profile that belongs to a child.
• Children never interact with us directly. They do not fill in forms, send us messages, or make any choices in the app.
• You, the parent, are the account holder. You act under your parental responsibility for your own children. Everything about your child that reaches us is information you chose to provide, and information you can change or remove.

Because a child never becomes a "user" in their own right, the child-related data we hold is limited to the information you enter to personalise their stories, plus the personalised stories we then generate from it — both described in the next sections.

---

4. What information about your child we process

To create stories that feel personal to your child, you can provide:

Besides this, the personalised story text and audio we generate for your child are built around the themes and preferences you choose, because that is what makes each story feel like it was made just for them. The first name is used only to label that child's profile so you can tell your children apart; it is not inserted into the story text. How long we keep those stories is explained in section 12.

We do not ask for and do not want: your child's surname, exact date of birth, home address, a photograph or video of your child, your child's own voice, health information, school details, location data, or any government identifier. Please do not enter this kind of information in the free-text preference fields.

The avatar is an illustration we provide — never an uploaded picture of a real child.

---

5. Why we process it, and our legal basis

We process your child's limited information for one purpose only: to generate and narrate personalised bedtime stories for that child, within the service you have signed up for.

Under the EU General Data Protection Regulation (GDPR), our legal bases are:

• Performance of the contract (Art. 6(1)(b) GDPR). Personalising and delivering the stories is the service you asked us to provide. The contract is with you, the adult account holder; the child's details are used as inputs to deliver that service.
• Legitimate interests (Art. 6(1)(f) GDPR) for keeping the service secure, preventing fraud and abuse, and protecting the integrity of the product. We have weighed these interests against your and your child's rights and limited our processing accordingly.
• Legal obligation (Art. 6(1)(c) GDPR) where we must keep certain records (for example, for tax and accounting) or respond to lawful requests from authorities.

We do not rely on the child's own consent for anything, because the child is not a party to the service and provides nothing to us themselves (see section 8).

---

6. How stories are made safe: you approve the text first

SleepyCuddle is built so that a parent is always in the loop before a child ever hears a story. Two safeguards always apply:

• You see every story as text and approve it before anything is read aloud. Nothing is voiced until you have read it and approved it.
• Automated safety checks screen every story for unsuitable content.

Only after a story has been approved by you is it voiced and made available to play for your child. You are always the gatekeeper: a story your child hears is a story you have read and approved.

---

7. No advertising, no profiling, no automated decisions about your child

• There is no advertising in SleepyCuddle — none at all.
• We do not show ads to children and do not direct any advertising at children.
• We do not build behavioural or advertising profiles of your child.
• We do not track your child across other apps or websites, and we do not sell or share your child's data for marketing.
• We do not use your child's information to make automated decisions that produce legal or similarly significant effects about them. The automated safety checks only screen the content of a story; they do not evaluate, score, or make decisions about your child.

Your child's information is used to shape their stories and for nothing else.

---

8. The Spanish digital age of consent (14) and why it is not triggered here

Under Spanish data-protection law, the age at which a minor can validly give their own consent for information-society services is 14 (Article 7 of Ley Orgánica 3/2018, LOPDGDD, read together with Article 8 GDPR). Below that age, a service that relies on the child's consent must obtain and verify the consent of the holder of parental responsibility.

This threshold is not triggered by SleepyCuddle, for a simple reason: we never ask a child to consent to anything, and a child never provides data to us. Specifically:

• Children do not create accounts and never sign in.
• Children do not provide their own data — you do.
• We do not rely on a child's consent as a legal basis for any processing (see section 5).

Because all data is provided and controlled by you, the adult account holder, acting under your parental responsibility, there is no child-given consent for us to verify. This is a deliberate design choice: keeping children entirely out of the account and consent flow is how we avoid processing children's data on a basis that would require age verification of a minor.

---

9. Your voice recording is separate — and about you, not your child

To narrate stories in a familiar voice, you may record your own voice, which is turned into a voice clone by our specialist providers. Please note:

• The voice recording and the derived voiceprint are your data, not your child's. We do not record or clone children's voices.
• Because a voiceprint can uniquely identify a person, it is treated as biometric data (special-category data) under Article 9 GDPR, and we process it only on the basis of your explicit consent (Art. 9(2)(a)), given separately from the general Terms.
• You can withdraw that consent at any time — by deleting your account, or by contacting us at [CONTACT EMAIL] — and doing so deletes the recording and voice clone, without affecting processing already carried out.

Full details are in our Privacy Policy (https://sleepycuddle.com/privacy).

---

10. Deleting your data and exercising your rights

You remain in control of your child's information at all times.

• Delete your entire account — at any time from the app. Deleting your account permanently erases all associated personal data: your voice recording and voice clone, your children's profile information (first name, approximate age, preferences, avatar), and the stories generated for them — subject to the limited retention described in section 12.
• Withdraw consent, or erase or correct particular data without deleting your whole account — contact us at [CONTACT EMAIL] and we will action your request. This includes withdrawing your consent for the voice recording and voice clone, and rectifying or erasing specific information (for example, a single child's profile details) while keeping the rest of your account.

If you would like help exercising any of these rights, contact us at [CONTACT EMAIL].

---

11. Who helps us run the service

We use a small number of trusted providers (subprocessors) to operate SleepyCuddle. Where they process personal data on our behalf, they are bound by data-processing agreements. Providers outside the EU/EEA are covered by appropriate safeguards, principally the EU Standard Contractual Clauses (SCCs). You can ask us for a copy of these safeguards by writing to [CONTACT EMAIL].

In the context of your child's data specifically, the most relevant providers are:

Other providers (our third-party payment processor for payment and tax, a third-party authentication provider (when you choose social sign-in), and the mobile platform's push-notification service for push notifications) process your account, billing or device data rather than your child's. The complete, current list of subprocessors and the data they handle is maintained in our Privacy Policy (https://sleepycuddle.com/privacy). We notify users of material changes to our subprocessors.

---

12. How long we keep children's data

• We keep a child's personalisation data (first name, approximate age, preferences, avatar) for as long as that child's profile remains in your account.
• We keep the stories generated for a child (the story text and narrated audio, built around the themes and preferences you choose) so that you can replay them, for as long as the profile or account exists.
• When you delete your account, the associated child personalisation data and generated stories are removed from our active systems, and from backups within our normal backup-rotation cycle. If you ask us to erase particular data without deleting your whole account (see section 10), we action that request and remove it in the same way.
• We may retain limited records for longer only where a legal obligation requires it (for example, billing and tax records relating to your account) — but such records concern the account holder, not the child's personalisation data or stories.

More detail on our retention periods is in the Privacy Policy (https://sleepycuddle.com/privacy).

---

13. Cookies and similar technologies

SleepyCuddle uses cookies and similar technologies on sleepycuddle.com. Where a cookie is not strictly necessary to provide the service, we rely on your consent, in line with Spanish law (Article 22 of Ley 34/2002, LSSI-CE). Full information about the cookies we use and how to manage them is in our Cookie Policy (https://sleepycuddle.com/cookies) and our Privacy Policy (https://sleepycuddle.com/privacy). These cookies are not used to profile or advertise to your child.

---

14. If something goes wrong: data breaches

We take the security of your child's information seriously. If a personal-data breach ever affects your child's information and is likely to result in a high risk to their rights and freedoms, we will inform you without undue delay, and we will notify the Spanish Data Protection Agency (AEPD) where the law requires it. Our breach-handling process is described further in our Privacy Policy (https://sleepycuddle.com/privacy).

---

15. Your rights and how to complain

As the account holder, and in respect of your child's data, you may exercise the rights available under the GDPR, including the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent where processing is based on consent (such as the voice recording). You can action erasure of all your data by deleting your account (see section 10); for anything else — including rectifying or erasing particular data without deleting your whole account, or withdrawing consent for the voice recording — contact us at [CONTACT EMAIL].

Exercising these rights is free of charge, and we will respond within one month of your request, as required by law. If a request is especially complex we may extend this by up to two further months, and we will tell you if that is the case.

If you believe we have not handled your child's data properly, you have the right to lodge a complaint with the Spanish supervisory authority:

Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan 6, 28001 Madrid, Spain www.aepd.es

You may also contact the AEPD before contacting us, though we hope you will give us the chance to help first.

---

16. Contact us

Questions about this notice or about your child's data? We are happy to help.

• Controller: [OPERATOR FULL NAME] (autónomo), NIF [NIF]
• Address: Av. de les Corts Valencianes 26, 46015 Valencia, Spain
• E-mail: [CONTACT EMAIL]

---

17. Changes to this notice

We may update this Children's Privacy Notice from time to time — for example, if we add a feature or change a provider. When we make a material change, we will update the "Last updated" date above and notify account holders in line with our Privacy Policy (https://sleepycuddle.com/privacy). The English version of this notice governs; translations are provided for convenience only.