Draft for testing. This text has not been reviewed by a lawyer and is not legal advice. Anything in [BRACKETS] is a placeholder or a point to check before Zomli is used by real people.
Privacy Policy
This policy explains what personal data Zomli collects, why, who we share it with, how long we keep it, and what rights you have. It is written for parents, who are the people who use Zomli.
1. Who is responsible
[COMPANY NAME], [ADDRESS], [COUNTRY] ("we", "us") is responsible for your personal data in Zomli. You can reach us at [CONTACT EMAIL].
2. What we collect, and why
| Data | Why | Basis | How long |
|---|---|---|---|
| Your email address | To create your account and send you the one-time code you sign in with | Contract (providing Zomli) | While your account exists |
| An account ID (a random identifier we create for you) | To tell your account and your stories apart from everyone else's | Contract | While your account exists |
| What you write to describe a story, the level you pick, and the story that is written | To write the story, and to keep it in your library so you can read it again | Contract | Until your account is deleted. Backups can hold a deleted story for up to 35 days more |
| Your subscription status (whether you have Zomli Pro) and purchase information from the app store | To know whether you may write more than the free stories | Contract; legal obligations (accounting) | As long as needed for those purposes, under the providers' rules |
| Counters: how many free stories you have used and how many stories you started today | To apply the free-story and daily limits | Contract; our interest in preventing misuse | Free stories used: while your account exists. Daily counts: a few days |
| Your decisions about our terms and consents: which version, your answer and the time | To show which terms you accepted and what you chose | Legal obligation and our interest in being able to show it | [DECIDE how long] |
| Technical logs: time, error codes, how long a request took, the level, the length of a story | To run Zomli, find problems and keep it secure | Our legitimate interest in operating a secure service | 30 days |
Our technical logs do not contain your descriptions or your stories, and the email addresses in them are masked.
[REVIEW: the emails with your sign-in code are sent through Amazon SES and currently contain an image that can tell us whether the email was opened. Either remove it, or keep and explain it here.]
3. Who we share it with
We do not sell your data and Zomli shows no advertising. We use these service providers (processors) to run Zomli, and they may only use your data for that:
- Amazon Web Services hosts Zomli in Ireland (EU), including your account, sign-in emails, stories and this website.
- OpenAI writes the stories. It receives what you wrote to describe the story, the level (as an age to write for) and our safety instructions. It does not receive your email address: we send it only a one-way code derived from your account ID. We switch off the storing of responses on OpenAI's side. [REVIEW: OpenAI may keep requests for a limited time under its own terms, for example to detect abuse, and processes data in the United States.]
- RevenueCat manages subscriptions. It receives your account ID and your purchase information from the app store. [REVIEW: location of processing.]
- Apple and Google handle payments for Zomli Pro under their own privacy policies.
We may also share data if the law requires it, or to protect our rights or the safety of others.
4. Transfers outside the EU
Some of the providers above process data in countries outside the EU/EEA, such as the United States. [REVIEW: the safeguards we rely on, for example the EU–US Data Privacy Framework or standard contractual clauses.]
5. Children
Zomli is for parents. We do not knowingly collect personal data from children, and children should not create accounts or use Zomli on their own. The stories are for your child, but the description you write is yours: please do not include a child's full name, address, school or other details that identify them. If you do, that information is sent to the AI to write the story and is saved in your library like the rest of what you write.
6. How long we keep your data
We keep your data while your account exists, except where the table above says otherwise. At the moment there is no delete button in the app: to have your account and everything in it deleted, email us at [CONTACT EMAIL]. Deleted data can remain in our backups for up to 35 days. [REVIEW: retention of unused accounts.]
7. Your rights
You have the right to ask us for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive the data you gave us in a usable format. Where we rely on your consent (for example for analytics) you can withdraw it at any time, which does not affect what we did before. Email us to use any of these rights. You also have the right to complain to the data protection authority in your country [for Sweden: Integritetsskyddsmyndigheten, IMY].
8. Analytics (optional)
Zomli can measure how the app is used so we can improve it. This is off until you say yes, you can say no, and you can change your mind in the app at any time. [DESCRIBE when the tool is chosen: which tool, which events, whether it can identify you, and where the data goes.] Analytics does not include the content of your descriptions or your stories.
9. Security
Data is encrypted in transit and stored encrypted in the EU. Access to it is limited by technical measures. No system is perfectly secure, so we cannot promise absolute security.
10. Changes to this policy
When we change this policy we publish a new version with a new date, and we will tell you in the app when a change matters for you. The page at /privacy on this site always shows the latest version.
11. Contact
[COMPANY NAME], [ADDRESS] · [CONTACT EMAIL]