Privacy Policy

Last updated [EFFECTIVE DATE] · Great Minds Create, Inc.

1. Who is responsible for your information

Great Minds Create, Inc., a New Jersey corporation, is the controller of the personal information described here.

For your purchase, Paddle.com Market Ltd is a separate controller of your billing information — see §3.

2. This is a service for parents

LullabyMail is sold to, addressed to, and used by adults. It is not directed to children. You must be 18 or over to subscribe.

A child using LullabyMail has:

• no account and no login;
• no inbox on our side — every email goes to the adult account holder's address;
• no profile page they can reach or edit;
• no way to submit anything to us at all.

The intended use is that a parent reads the story aloud. We do not knowingly collect personal information directly from children, and there is no mechanism in the product by which we could. Any detail about a child that we hold was typed in by the adult account holder.

If you believe a child has supplied us information directly, email [PRIVACY EMAIL] and we will delete it promptly.

3. What we collect

Information you give us

Information we generate

• The stories and cover pictures we produce for you, kept in your library.
• A customer identifier — a random string identifying your account internally.
• Delivery records — which story was sent, when, to which address, and whether it succeeded. This is how we can tell you what happened when an email goes missing.
• Reply routing tokens — each story email carries a unique reply address. We store only a one-way hash of its token, never the token itself, so we can verify a reply is genuine without holding the credential.

Information we do NOT collect

• Card numbers or bank details. These never touch our systems — Paddle takes the payment. We see only that a payment succeeded, the plan, and the renewal date.
• Advertising or cross-site tracking cookies. We run no advertising trackers, no analytics profiling, and no third-party ad pixels.
• Location data, beyond the timezone you select yourself.
• Anything about your child collected from your child. See §2.

4. Who processes your information

These are the third parties involved in running LullabyMail. Each receives only what it needs for its part.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so.

We may disclose information if legally required to, or to protect the rights and safety of our users or ourselves. If our business is sold or merged, your information may transfer — we would tell you by email first, and this policy would continue to apply until replaced by one you were notified of.

5. How AI uses what you tell us

To write a story we send OpenAI the preferences relevant to that story: the age, interests, guardrails, story-preference text, any names you chose to include, and — when you ask for a rewrite — the text of your reply.

The cover picture is generated separately, and receives less. We send Replicate only a scene description derived from the finished story — its summary, tone, themes and a broad age band. Your child's name, your interests list, your guardrails and your free-text preferences are not sent to the image provider.

We do not use your information to train AI models, and we use these providers under terms that do not permit them to train their models on our API traffic. We do not build advertising or behavioural profiles.

Stories are machine-generated and are not reviewed by a human before delivery. See Terms §2.

6. Why we are allowed to process this (UK/EU customers)

If you are in the UK or EEA, our lawful bases under the UK GDPR / GDPR are:

• Performance of a contract — your email address, delivery time, timezone and the story preferences you supply. Without these there is no service to deliver.
• Legitimate interests — delivery records and security logging, so we can diagnose failures and prevent abuse. Balanced against your interests; the data is minimal and operational.
• Legal obligation — retaining transaction records where tax or accounting law requires.
• Consent — any optional marketing email, which you can withdraw at any time.

Your information is processed in the United States. Where transferred out of the UK/EEA we rely on the appropriate safeguards our processors maintain, including Standard Contractual Clauses and, where applicable, the EU–US and UK–US Data Privacy Frameworks.

7. How long we keep it

You can ask us to delete everything sooner — see §8.

8. Your rights, and how to use them

Wherever you live, you may ask us to:

• Show you what we hold about you, as a copy;
• Correct anything wrong — most of it you can edit yourself on your preferences page;
• Delete your account and its data;
• Export your data in a portable format;
• Object to or restrict certain processing;
• Withdraw consent for anything based on it.

California residents additionally have rights to know, delete, correct, and to opt out of sale or sharing under the CCPA/CPRA. We do not sell or share personal information, so there is nothing to opt out of — but you may still exercise the other rights, and we will not discriminate against you for doing so.

To exercise any of these, email [PRIVACY EMAIL] from the address on your account. We respond within [RESPONSE TIME, e.g. 30 days]. There is no charge.

If you are unhappy with our response, UK residents may complain to the Information Commissioner's Office, and EEA residents to their national supervisory authority. We would rather you told us first.

9. Security

Our stored data lives in private, non-public Amazon S3 storage, encrypted at rest. All web and API traffic uses TLS. Access is restricted to the operator of the service. Links to your preferences and library pages are time-limited.

Reply tokens are stored only as a one-way hash, so someone reading our storage cannot forge a reply address.

No system is perfectly secure. If a breach affects your information we will notify you and the relevant regulator as the law requires.

10. Cookies

We use no advertising cookies and no third-party analytics trackers.

The site uses only what it needs to work: browser storage to hold your new account identifier during signup, and cookies set by Paddle during checkout for fraud prevention and to complete your payment (governed by Paddle's privacy notice).

11. Emails we send

You receive the nightly story, plus service messages about your account (payment confirmations, renewal notices, delivery problems). Service messages are part of the subscription and are not marketing.

Every story email carries an unsubscribe link, which stops delivery. To close the account and delete the data, see §8.

12. Changes to this policy

We may update this policy. If a change materially affects how we handle your information we will email the address on your account before it takes effect. The date at the top always shows the current version.

13. Contact