Privacy Policy

Effective date: [TODO: effective date, e.g. 1 August 2026] · Data fiduciary: [TODO: legal/business name].

This Privacy Policy explains how MoonBell ("we", "us") handles personal data when you use our service to create personalized, AI-generated children's storybooks. We have designed MoonBell to be privacy-first and to align with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). The parent or guardian is our point of contact and is the data principal interface for any child's data we process.

The short version: We do not collect photos of children. We never send a child's real name to our AI vendors, and your child's details are never used to train AI. Children do not have accounts and are not tracked, profiled, or advertised to. You can export or delete everything at any time.

1. What we collect

About the child

We collect only the minimum information needed to create a personalised story.

Nickname — never a legal name.
Age band — never a full date of birth.
Reading level.
Gender (optional) — used only to choose the pronouns in the story. If you leave it blank, we write with they/them.
Appearance (optional) — skin tone, hair length, hair texture, how the hair is worn, hair colour, eye colour, whether they wear glasses, and any distinguishing features you choose to add.
Favourite things / interests — up to three.
Personality (optional) — up to three traits (such as curious, brave or kind) that shape how the hero behaves in the story.
Story goal — the gentle lesson you want the story to carry.
Dedication (optional) — a short line you write, printed on its own page at the front of the book.
Birth month (optional) — used only for birthday reminders. The day and year are never collected.

About the parent

Email— yours, not your child's. We ask for it before we build the preview so we can send it to you, and we use it for order and delivery updates if you buy.
Consent preferences — the version of the Terms and Privacy Policy you accepted and when, plus your optional consent to marketing email.
Shipping details — collected only when you order a printed book: recipient name, phone number, address, city, state, and pincode.
Payments — securely processed by Razorpay. MoonBell never stores card or UPI details.
Operational data — limited technical information used to prevent fraud, abuse and spam; your book and order history; and anonymous product analytics that contain no personal data.

2. What we do NOT collect

No photographs or images of any child.
No legal name, full date of birth, school, home address, or phone number of the child.
We do not send a child's real name to any AI vendor (see "Tokenization" below).
We do not build advertising profiles of children or track children across the web.

3. Our privacy principles

Collect the minimum data required to create and deliver the product.
Never collect a child's legal name or full date of birth.
Store only the birth month when it is provided.
Collect shipping information only for printed books.
Delete temporary image inputs immediately after generation.
Never use customer stories, photos or personal data to train AI models.
Explain clearly, in plain language, why each piece of information is collected.

4. Why we use this data (purposes)

To generate the personalized story text and illustrations you request.
To moderate content for safety and to prevent misuse.
To process your free preview, payment, and delivery of the finished book.
To provide support, respond to grievances, and meet legal obligations.

We practice data minimization — we ask only for what a story needs, and nothing more.

5. Verifiable parental consent and children's data

Because MoonBell processes data relating to children, we treat that data with special care under the DPDP Act. Before creating a book featuring a child, we obtain the verifiable consent of the child's parent or guardian, and we record the consent version. Children do not have accounts and are not the users of the service — the parent or guardian is. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. You may withdraw consent at any time, which removes the associated child data and generated assets.

6. Tokenization — the child's name is protected

The child's name is tokenized (replaced with a placeholder) before any request is sent to an AI vendor, and it is reinserted only within our own systems when the finished book is assembled. Your child's details are never used to train AI models.

7. AI vendors and sub-processors

We use the following service providers to operate MoonBell:

OpenAI — generation of story text and safety moderation.
Google (Gemini) — generation of illustrations.
ElevenLabs — optional audio narration (only if you choose an audio product).
Supabase — authentication, database, and storage of your account and books.
Razorpay — payment processing (INR).
Resend — transactional email (such as sending you your book link).
Vercel — hosting and delivery of the web application.

8. Cross-border transfer

Some of these providers process data outside India, including in the United States. By using MoonBell you understand that limited data needed to generate and deliver your book may be processed outside India. We share only the minimum required, and the child's real name is tokenized before any AI vendor receives the request. We rely on appropriate safeguards and our agreements with these providers.

9. How long we keep data (retention)

Unpurchased previews: automatically purged after a retention window (approximately 30 days, configurable).
Purchased books: kept available to you so you can re-download them, until you delete them or close your account.
Records we must retain: certain order, tax, and legal records may be retained as required by law.

10. Security

We use reasonable technical and organizational measures to protect personal data, including authenticated access, owner-scoped data, expiring download links, and encryption in transit. No system is perfectly secure, but we work to safeguard your information and to handle any incident responsibly.

11. Your rights

As a data principal under the DPDP Act, you have the right to:

Access and export the data we hold about you and your child's book.
Correct inaccurate or incomplete details.
Erase your data and the child's data, and withdraw consent.
Nominate another person to exercise your rights in the event of death or incapacity.
Grievance redressal — raise a complaint and receive a response.

You can exercise access, export, and erasure yourself from your account page(Download my data and Delete my account & data). You may also email us at [TODO: support email, e.g. support@moonbell.com].

12. Grievance officer

Grievance Officer: [TODO: grievance officer name] · [TODO: grievance officer email] ·[TODO: registered address]. See our Contact & Grievance Redressal page for the process and timelines.

13. Cookies

We use essential cookies for authentication and security. See our Cookie Policy for details.

14. Changes to this policy

We may update this Privacy Policy. If we make material changes, we will take reasonable steps to notify you and, where required, seek fresh consent.