Privacy

Effective date: 5 October 2026

SleepyCuddle is a family bedtime-storytelling service: a parent records their own voice, that voice is cloned with AI, and personalised bedtime stories are narrated to the parent's children in that voice. This policy explains how personal data is handled in the SleepyCuddle mobile app and on the website sleepycuddle.com. The English version of this policy governs; translations are provided for convenience only.

Table of contents

1. Who we are
2. Summary for parents
3. The data we collect
4. Why we use it and our legal bases
5. Children's privacy
6. Your voice is biometric data
7. Who receives your data
8. International transfers
9. How long we keep your data
10. Security and data breaches
11. Your rights
12. Cookies
13. Changes to this policy
14. Contact and complaints

---

1. Who we are

The data controller under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") is:

Given the small scale of the service, we are not required to appoint, and have not appointed, a Data Protection Officer. Our lead supervisory authority is the Spanish Data Protection Agency (AEPD). SleepyCuddle is offered to consumers in the EU/EEA and Ukraine, and is governed by Spanish law.

2. Summary for parents

• Only adults hold accounts. Children never sign in and never give us anything themselves.
• Your voice is biometric data. The recording you make and the voice clone derived from it can identify you, so we process them only with your separate, explicit consent — asked for in the app before you record — and you can withdraw that consent at any time.
• We keep child data minimal: a first name, an approximate age, story preferences and an illustrated avatar you pick from our set. The first name only labels the profile so you can tell your children apart — it is not inserted into story text. Stories are personalised through themes, preferences and age.
• No advertising, no profiling, no sale of data. Ever.
• Payments happen in the app stores. Subscriptions and top-ups are bought through the Apple App Store or Google Play; we never see your card details.
• You are in control. In the app you can delete your entire account at any time — and delete an individual voice or child profile too; every other data request works by e-mailing support@sleepycuddle.com.

3. The data we collect

• Account data — your name and e-mail address; if you choose social sign-in, the e-mail address and account identifier we receive from the authentication (social sign-in) provider.
• Family profile data provided by the parent — the first name, approximate age, story preferences and chosen illustrated avatar of each child you add. The avatar is always an illustration we provide, never a photo. Please do not enter sensitive information (health, exact birth date, address, school) in the free-text preference fields.
• Voice data (biometric) — your voice recording and the voiceprint / voice clone derived from it. See Section 6.
• Generated content — the story text and narrated audio created for your family, together with the personalisation inputs used to create them.
• Purchase data — the subscription or purchase status, product identifier and store transaction references we receive from the app-store operator to verify your purchase. We never receive your card or bank details.
• Technical data — device type and operating system, IP address, push-notification token, and basic usage events (for example, that a story was generated or played), used to run and secure the service.
• Usage analytics data — pseudonymous events about how the app and the website are used (for example: which screens or pages are opened, that a story was generated, approved or played, subscription status, and error and performance signals). In the app these events are linked to your account identifier once you have one; screens you open before you sign in are collected against the pseudonymous on-device identifiers described in Section 12, and are joined to your account when you sign in. On the website they are not linked to any persistent identifier and nothing is stored on your device. Usage analytics never include story text or titles, your child's name or birth date, your voice recording or voice clone, or the content of your free-text notes.

You are not obliged to provide any of this data, but without account data we cannot provide the service, and without a child profile we cannot personalise stories. Recording your voice is entirely optional.

Accounts are created and managed in the mobile app — the website offers no sign-in. The only personal data the website itself processes directly are your e-mail address, a one-time token and (on reset) your new password, when you use a password-reset or e-mail-verification link we send you, plus the technical data above.

4. Why we use it and our legal bases

You may object to processing based on legitimate interests, and you may withdraw any consent at any time without affecting the lawfulness of earlier processing. You can switch usage analytics off in the app yourself at any time, under Profile → Privacy → Share usage data, or e-mail support@sleepycuddle.com to object. Telling the app store how much of a purchase you used is off unless you turn it on, in the same place, and switching it off stops it immediately.

AI transparency. Story text is produced by AI language models from the inputs you provide; audio is produced from that text with your cloned voice. Narration is created only when you request it, and you can read a story in the app before playing it to your child. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR).

5. Children's privacy

• Children do not hold accounts, never sign in, and never provide data to us. Everything we know about a child is entered by you, the adult account holder, under your parental responsibility, and processed to perform our contract with you.
• Because we never rely on a child's own consent, the Spanish digital age of consent (14 — Art. 7 of Ley Orgánica 3/2018) is not engaged.
• A child's first name is used only to label the profile; it is not inserted into story text. One story can be played to more than one child.
• We show no advertising, build no profiles of children, and make no automated decisions about them — their data shapes their stories and does nothing else.
• We never record or clone a child's voice.

6. Your voice is biometric data

Your voice recording and the voiceprint / voice clone derived from it can uniquely identify you, so they are biometric data — a special category of personal data under Article 9 GDPR. We process them only with your explicit consent under Article 9(2)(a), which the app asks for separately, before you record. The full consent text is at sleepycuddle.com/voice-consent.

• Record only your own voice — never a child's and never another person's.
• Your voice data is used for one purpose: narrating your own family's stories. It is never sold, never used to identify anyone, never shared with other users, and never used for advertising.
• Withdraw consent at any time: delete the voice in the app, delete your entire account (either permanently erases the recording and the clone), or e-mail support@sleepycuddle.com. Erasure, including at the providers that process voice on our behalf, completes within 30 days.

7. Who receives your data

We disclose recipients by category, as Articles 13–14 GDPR permit. Each processor in the table below is bound by a data-processing agreement under Article 28 GDPR and may use the data only on our instructions. Companies that act as independent controllers — the app stores and the sign-in providers — are not in that table; they are listed after it.

Separately, two kinds of company handle your data as independent controllers, under their own privacy policies rather than on our instructions:

• The app-store operators (billing) — the Apple App Store and Google Play — process your payment when you buy a subscription or top-up. We receive only purchase status and transaction references from them, never card details. If you ask a store for a refund and you have turned on the refund setting under Profile → Privacy, we also tell that store, for that request alone: whether the purchase was delivered, how much of it you had used, that a free trial is offered, and whether we would prefer the refund to be granted or declined. Nothing else goes with it — no story text or titles, no voice data, no family profile data, no name and no e-mail address. The store decides the refund; we do not. With the setting off we answer nothing, and switching it off takes effect at once.
• The sign-in providers — Google and Apple — authenticate you when you choose “Continue with Google” or “Sign in with Apple”. The sign-in happens between you and the provider under its own terms, and the provider learns that you use SleepyCuddle. From the provider we receive only your e-mail address, a stable account identifier and, where you allow it, your name; from that point on we are responsible for that data. We send the provider nothing else about you. If you use Apple’s option to hide your e-mail address, we only ever see the relay address Apple gives us.

We disclose personal data to public authorities only where the law requires it. We never sell personal data.

8. International transfers

Application data at rest is hosted in the EU (Frankfurt, Germany), and usage analytics events are likewise processed in the EU. Generated audio is stored in that same EU region and is delivered to your device through our own servers there — it is not served from a content-delivery network. Voice cloning, text-to-speech and story generation take place partly outside the EEA, in the United States. Every transfer outside the EEA is protected by the safeguards of Chapter V GDPR — the European Commission's Standard Contractual Clauses, or the EU–US Data Privacy Framework where the recipient is certified under it. You can request a copy of the relevant safeguards at support@sleepycuddle.com. Signing in with Google or Apple, and paying through the app stores, are carried out by those companies under their own terms: we do not transfer your data to them for those purposes.

9. How long we keep your data

10. Security and data breaches

We protect personal data with encryption in transit, access controls, EU hosting of application data, data-processing agreements with every processor, and by collecting only what the service needs — with particular care for voice data and child profiles. If a breach occurs that is likely to put your rights and freedoms at risk, we will notify the AEPD without undue delay and where feasible within 72 hours (Art. 33 GDPR), and inform you without undue delay where the risk to you is high (Art. 34 GDPR).

11. Your rights

You have the GDPR rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time.

How to exercise them:

• In the app: you can delete your entire account — permanently erasing your account, child profiles, stories, voice recording and voice clone, subject only to the legal retention in Section 9 — and you can also delete an individual voice or child profile.
• By e-mail: every other request — correcting data, erasing other specific data, restriction, portability, objection — goes to support@sleepycuddle.com.

Requests are free of charge and answered within one month (extendable by two further months for complex requests, in which case we tell you). We may need to verify your identity first.

You also have the right to lodge a complaint with the AEPD (see Section 14) or with the supervisory authority of your EU/EEA country of residence.

12. Cookies

sleepycuddle.com sets no advertising cookies and stores no analytics identifiers on your device. We measure how the site is used with a cookieless analytics method: it sets no cookie and neither stores nor reads anything on your equipment, so consent under Article 22.2 of the Spanish LSSI-CE (Ley 34/2002) is not required — which is why the site still shows no cookie banner. Accounts are created and managed in the mobile app, so the website sets no authentication cookie either. The only cookie the site sets remains the functional one that remembers the language the site is shown in, exempt from consent under the same provision. If we ever introduce a cookie that requires consent, we will ask for it before setting it. The mobile app uses on-device storage for your session, and separately stores two pseudonymous analytics identifiers: one tied to your session, and one that identifies the app installation itself. The installation identifier is not linked to your session — it remains if you sign out and is deleted when you uninstall the app, or as soon as you turn usage analytics off. It tells us nothing about who you are; it only lets us count installations and see how the app is used before an account exists. See Section 4 for how to turn usage analytics off. The app does not use cookies.

13. Changes to this policy

We will update this policy when the service or the law changes, revise the effective date above, and notify you of material changes by e-mail or an in-app notice.

14. Contact and complaints

Data controller: Sergii Cherniavskyi (autónomo), NIF (NIE) Z0589427B, Av. de les Corts Valencianes 26, 46015 Valencia, Spain — support@sleepycuddle.com

Supervisory authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es