Privacy at Tellunia

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

Tellunia creates personalised children's books with AI. To do that I need an account, I store your characters, stories and images, and I send your input to an AI provider that generates text and images. You can optionally upload a photo, including one of a child; the special rules in the section “Photos and children” apply.

The site sets no cookies, shows no ads and contains no analytics script. Fonts come from the site's own server. There is no profiling and no automated decision with legal effect.

When you open the site

When you open the site, your browser sends data without which the page cannot be delivered: IP address, date and time, the requested address, the referrer and the browser identifier. The site is hosted by Netlify, which processes this data in server logs.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest: delivering the site securely and reliably. Netlify decides how long it keeps its logs.

Netlify, Inc.

101 2nd Street, San Francisco, CA 94105, USA

Data may be transferred to the USA. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Account and sign-in

You sign in with a code I send by email, or with your Google account. I process your email address; with Google also the name and profile picture Google passes on. I do not store a password. Account and sign-in run through Supabase; with “Continue with Google” you briefly leave Tellunia and sign in at Google.

The legal basis is Art. 6(1)(b) GDPR (using the service). I keep the data until you delete your account.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Your characters, stories and images

Characters, story plans, page images, book settings and your credit balance are stored at Supabase. Images sit in private storage and can only be retrieved with your account; other users have no access. The PDF of a book is created in your browser.

The legal basis is Art. 6(1)(b) GDPR. I keep the content until you delete it or your account.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

AI: what goes to OpenAI

For stories and images, Tellunia sends your input to the OpenAI API: story idea, character descriptions, scene descriptions and reference images already generated for your character. The call runs through my server; your browser does not talk to OpenAI directly.

Under the OpenAI API terms, data sent through the API is not used to train the models by default. Do not enter names or details that do not belong in a children's book.

The legal basis is Art. 6(1)(b) GDPR.

OpenAI Ireland Limited

1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Photos and children

Uploading a photo is voluntary; you can describe any character with text alone. A photo may be up to 8 MB. If you upload one, there are two kinds of processing, and the box “I am allowed to use this photo” decides which one runs:

Without the tick, the photo goes to OpenAI for analysis. That produces a description and a freely designed, loosely inspired character. With the tick, the photo goes to OpenAI as an image template, and the book pages show the person recognisably, in every art style. This processes facial features in a way that makes a person recognisable. The style “Original (photorealistic)” is only available with a photo and the tick.

I do not store the photo permanently; it exists only while the image is generated. What is stored are the resulting characters and images in your account.

The legal basis for the recognisable likeness is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR); for the inspired character it is Art. 6(1)(b) GDPR. You can withdraw consent at any time with effect for the future by deleting the character or your account, or by writing to me.

If the photo shows a child or another person, you need their consent, for children that of the parents or guardians. You confirm this with the tick on your own responsibility. If you publish AI-generated images, you must label them as such.

OpenAI Ireland Limited

1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Buying credits

You buy credits on a payment page run by Stripe. You enter your payment details there; I do not receive them. When you go to Stripe, I pass on your internal user ID so the credits are added to your account. Stripe reports the purchase (package, amount) back to my server.

Before each purchase I store your consent to the immediate start of performance, with wording and time, to be able to prove that the right of withdrawal lapsed. The legal basis is Art. 6(1)(b) GDPR, for the proof Art. 6(1)(c) and (f) GDPR. The consent is deleted with your account; retention duties for invoice data are not affected.

Stripe Payments Europe, Ltd.

1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Storage in your browser

Tellunia keeps data in your browser that the app needs to work: your sign-in, drafts of character and story, the area you last opened, the ID of a running job (so you can continue after a reload), light/dark mode and language. During a purchase the browser briefly remembers the selected package. These are not cookies for recognising you and not tracking.

The legal basis is § 25(2) no. 2 TDDDG, because the access is strictly necessary, and Art. 6(1)(b) GDPR. The entries stay until you clear the browser storage or sign out.

Deleting your account

The account menu has “Delete account”. It removes your images from storage, your characters, story plans, jobs, balance and the stored purchase consent, and then your sign-in account. It cannot be undone. Data held at OpenAI, Stripe or Netlify under their own rules is not deleted by this action; contact the provider or me for that.

Tellunia on Instagram and TikTok

Tellunia has a profile on Instagram and on TikTok. When you visit a profile there, follow it or comment, Meta (Instagram) and TikTok process your data under their own terms; I have no influence on that. I see what you post publicly there and aggregated statistics the platforms show me. For these statistics the platforms and I may be joint controllers (Art. 26 GDPR); you can exercise your rights most effectively with the platform directly.

Messages you send me there are read and answered there. The legal basis is Art. 6(1)(f) GDPR: my legitimate interest is making Tellunia known and staying in touch with you. Links to the profiles are ordinary links; your browser only connects to the platform when you click.

Meta Platforms Ireland Limited

Serpentine Avenue, Block J, Dublin 4, Ireland

Provider’s privacy policy

TikTok Technology Limited

10 Earlsfort Terrace, Dublin, D02 T380, Ireland

Provider’s privacy policy

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.