ListenStories Privacy Policy

Version effective from: 2026-07-28

1. Data controller

The controller of your personal data is [NAZWA FIRMY], address: [ADRES], Polish tax ID (NIP): [NIP]. Data-protection contact: contact@listenstories.app.

2. Purposes and legal bases of processing

• Performance of the contract (Art. 6(1)(b) GDPR) — operating your Account, generating and storing stories and audio recordings, handling complaints and contact messages.
• Legitimate interest (Art. 6(1)(f) GDPR) — keeping the Service secure, automated content moderation, preventing abuse, establishing and defending legal claims.
• Legal obligation (Art. 6(1)(c) GDPR) — accounting and tax records (once payments launch).

3. Categories of data processed

• Account data: e-mail address, password (stored only as a cryptographic hash), chosen interface language;
• content: story descriptions (prompts), generated stories and their audio recordings;
• messages sent through the contact form;
• usage counters (number of stories generated per month);
• aggregate visit statistics (pages visited, referring page, country, device type and browser) — no cookies, not linked to your Account; see the Cookie Policy for details;
• technical log data (e.g. IP address, security events).

4. Children's data — important warning

Accounts in the Service are for adults only. Please do not enter children's personal data in story prompts — a first name or nickname is entirely sufficient for personalization. Do not provide a child's surname, date of birth, address, image, health information or any other data that could identify the child. Prompt content is passed to the processors listed below.

5. Recipients of data (processors)

We use the following providers:

Transfers of data outside the European Economic Area (to the USA) take place on the basis of Standard Contractual Clauses (SCC) or an adequacy decision — the EU–US Data Privacy Framework [transfer basis to be confirmed separately for each provider — to be completed before commercial launch].

Visit statistics are run by us, on our own infrastructure (the Umami software) — we use no third-party analytics or advertising providers and send them no data.

6. Retention periods

• Account data — until the Account is deleted;
• stories and audio recordings — until deleted by the user or until the Account is deleted;
• stories rejected by moderation — up to 7 days;
• contact messages — for the time needed to handle the matter, then for the limitation period of potential claims;
• technical logs — short-term, for security purposes only;
• billing data (once payments launch) — for the period required by tax and accounting law.

7. Your rights

You have the right to: access your data, rectify it, erase it, restrict processing, data portability, and object to processing based on legitimate interest. In the app settings you can, on your own: change your e-mail and password, export your data (JSON) and delete your Account — deleting the Account permanently erases all data, including stories and audio recordings.

You also have the right to lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

8. Automated decision-making and profiling

Content passes through automated safety moderation, which may result in a story not being generated; however, we do not make automated decisions about you that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR. We do not carry out advertising profiling and we do not use your data for marketing purposes.

9. Cookies

The Service uses only essential cookies and localStorage — see the Cookie Policy for details.

10. Contact and changes

Please direct data-protection questions to contact@listenstories.app. We will announce material changes to this Policy by e-mail or an in-Service notice.