Privacy Notice

1The path of the first name

When you tap "Create story", the following happens.

1. You enter the details. First name, birthday, gender and the selected traits are stored in our database. It is located in Frankfurt am Main, Germany.
2. Your account stays with us. What we pass on contains neither your name nor your email address nor any identifier of your account. The requests come from our server, not from your device. OpenAI and Google therefore cannot readily link a story to your account or your family. We cannot rule this out entirely, for example where a rare first name coincides with other details from the story.
3. The text is created. OpenAI receives your child's first name, age, gender and traits, the first names, roles and traits of the other characters and the chosen topic card, and writes the text from this in the USA. We do not pass on the date of birth, only the age. The transfer is encrypted.
4. The voice is created. For the audio version, the finished text goes to Google, including in the USA, where it is turned into speech. Your child's first name is spoken in the process, so this text contains the names.
5. You decide what your child hears. The text and the audio file are then stored in our database in Frankfurt again. Your child can only hear the audio version once you have read the story and confirmed that it suits your child.
6. Everything is deleted again. You can delete any story individually. If you delete your account, everything is deleted from our systems within 30 days, including backups, unless we are legally required to retain something (Section 8). What OpenAI and Google keep for a short time for abuse monitoring, they delete within the periods set out in Section 9.

2All content is created with artificial intelligence

This is the core of Poquito, and we say it expressly here once more.

The text. Each personalised story is generated anew at the moment you request it — by a language model from OpenAI, based on the details you have entered. Personalised stories are not templates with a gap for the name: each one is written anew for you. That is why each one reads differently. And that is why a story may also contain linguistic inaccuracies or factual errors.

The series. The ready-made stories in our series were created with the help of artificial intelligence. We read and approved each of them before publication. They contain no details about you or your child.

The voice. The read-aloud version is speech synthesis, not a recording of a human. It is created by Google. We use a ready-made voice provided by the vendor — we do not clone voices and never ask you for a voice recording of yourself or your child.

The illustrations. The images in the app were also created with AI tools. We made them in advance: they are not generated from your details, and they never show your child.

We label this. Every story is labelled in the app as generated with artificial intelligence. The audio files also carry a machine-readable label.

Artificial intelligence makes mistakes. A story may be linguistically inaccurate or factually wrong. That is why the app only releases a personalised story for your child once you have read it and confirmed that it is suitable.

You can report content. If you find something in a story that is not suitable for children, report it to us using the "Report content" button or at report@poquito.ai. We review every report.

Nobody at our end reads along. Before a story reaches you, we check it automatically for unsuitable content (Section 4). This check is carried out by machine. Otherwise we do not look at your stories — unless you report one or ask us for help with a particular story. Our software developer has access to the database, but only to operate the app and fix errors, not to read stories.

Your details serve only your story. OpenAI and Google process what we send them on our behalf and only to create the story. They do not use it to train or improve their language or voice models, and not for advertising. There is one exception, and we name it: both providers keep requests in order to detect misuse of their services — OpenAI generally for up to 30 days, Google for 55 days. If a violation of their usage rules is suspected, an authorised person at the provider may review the content concerned. Google may also use this data to improve its systems for detecting misuse. The providers may keep the data for longer if they are legally required to; under its terms, OpenAI also reserves the right to keep it for longer where reasonably necessary to protect its services or third parties from harm, for example where content is flagged as a possible violation. This data is not used for any other purpose, unless a provider is legally required to disclose it. Poquito uses OpenAI's standard API terms; no different arrangement is currently in place. We have applied to exclude this retention at OpenAI as well (zero data retention); as soon as OpenAI enables it for us, we will use it and update this notice. We do not train any models with your details either.

Nothing decides about you. The artificial intelligence generates a text. It does not assess you or your child, makes no decision about you and creates no profile.

3Who is responsible

Poquito Media UG (haftungsbeschränkt), Langhansstraße 86, 13086 Berlin, Germany, registered in the commercial register of the Local Court of Charlottenburg under HRB 278401.

We answer questions about data protection at legal@poquito.ai.

4What data we process

Your account

Your first name and email address, plus a password that we store only as a hash. We need these details to maintain your account and sign you in. Without them we cannot set up an account for you.

If you sign in with your Google or Apple account instead, we receive from there your email address, the name stored there and an identifier with which we recognise you next time. In that case we do not store a password. If you choose "Hide My Email" with Apple, we only receive a forwarding address and never your real one. Google and Apple learn that you have signed in with us; they are themselves responsible for this processing (see Section 6).

Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR.

We also store which version of our terms and which consents and confirmations you agreed to, and when. This allows us to prove what was agreed.

Legal basis: our obligation to demonstrate consent, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, and our legitimate interest in being able to prove the content of the contract, Art. 6(1)(f) GDPR.

Details about your child

First name, birthday, gender and the traits you select from a fixed list. These details determine how the story is told and for which age group it is written.

We do not collect this data from your child but from you. It is nevertheless personal data of your child, and we treat it accordingly. Because we cannot inform your child ourselves, this notice is addressed to you as the person acting for your child. If you create a profile for a child for whom you do not have parental responsibility — for example as a grandparent or godparent — you need the agreement of the child's parents or guardians.

Before the first story is created, we show you in the app that the stories are created with AI and which details go to OpenAI and to Google for this, including the first names, and ask whether you agree. Without your okay, we do not create a story. This step serves transparency and is not consent within the meaning of the GDPR; the legal basis remains our legitimate interest (below). You can object under Section 11.

Why the exact date of birth: your child's age changes between two birthdays, and the story should match it. That is why we show you in the profile how old your child is right now and write the story in language that suits that age. On the birthday, both change automatically without you having to do anything. We pass only the age to OpenAI, not the date of birth.

Please no sensitive details. The app does not ask about health, religion or similarly sensitive topics. Please do not enter such information through names or other details either.

Legal basis: our legitimate interest, and yours, in delivering the story you ordered, Art. 6(1)(f) GDPR. We know that children's interests weigh particularly heavily here, and we have weighed them: the details are limited to what is necessary, come only from you, are not analysed, are not passed on to third parties for their own purposes — apart from the providers' abuse monitoring (Section 2) — and are deleted together with your account. We pass on neither a surname nor an address, an email address or an identifier of your account to OpenAI and Google, and your child only hears a personalised story once you have released it. Without these details we cannot generate a personalised story — that is the core of the service you order from us.

Other characters in the story

You can create other people — parents, siblings, friends, pets — each with a name, traits and their relationship to your child.

Please only create people who agree to this, and use first names. For people outside your family, a made-up name is best. We cannot inform these people ourselves because we do not know them and have no contact with them. This notice is therefore publicly available so that they can inform themselves here.

Legal basis: Art. 6(1)(b) GDPR insofar as your own details are concerned; for the details about other people, our legitimate interest, and yours, in delivering the story you ordered, Art. 6(1)(f) GDPR. The details are limited to first names and a few traits and are difficult to attribute to any person without your account; we do not pass on any identifier of your account to OpenAI and Google.

Stories and audio files

We store the generated texts and audio recordings in your account so that you can listen to them again. We also store whether you have released a story for your child.

Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR; insofar as stories and audio files contain details about your child or other characters, our legitimate interest under Art. 6(1)(f) GDPR (see above).

Series and listening progress

If you listen to stories from our series, we store in your account which episodes you have already heard, so that you can continue where you left off. We also count how often an episode is played in total — without any link to your account — to decide which series to continue.

Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR. The count without any link to your account contains no personal data.

Automated content check

Before a story reaches you, we check it automatically for content that is unsuitable for children. To do this, the generated text is analysed by machine. No person reads along.

Legal basis: our legitimate interest in ensuring that no unsuitable content appears in an app whose stories are intended for children, Art. 6(1)(f) GDPR.

Subscription, credit and purchases

You buy subscriptions and credit exclusively via the App Store or Google Play. From there we receive the information whether your subscription is active, what it includes and which credit you have bought. We do not see your payment details when you buy.

We store which subscription you have, how many stories are still available to you in the current month, how much credit you have and when you last created a story. We need this to reflect your subscription and your credit.

We use the RevenueCat service to manage subscriptions and purchases. It matches which purchase from the store belongs to which account with us. Your name is not transmitted, but an identifier that only we can attribute to your account, plus a device identifier, your purchase history, your country and the app version used.

Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR.

When we refund credit to you

If we refund unused purchased credit to you, for example after a withdrawal or a termination by us (sections 12.3 and 19 of the terms), we process your name, the bank account we transfer the money to and the purchase receipt from the store. The transfer goes through our bank; the records go to our accounting and to our tax advisor.

Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR; for keeping the records, our legal obligation, Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

Notifications

Reminders of your reading time. If you switch them on, the app reminds you of your reading time at the set time in the evening. The app schedules and creates these reminders directly on your device. They do not pass through any server — neither ours nor that of any other provider.

Notice that an audio version is ready. We send this notice from our server as soon as the audio version of a story is ready. For this we store an identifier of your device through which it is delivered: on iPhone and iPad via Apple's notification service, on Android devices via Google's Firebase Cloud Messaging.

No notification mentions names, neither yours nor your child's. You can switch both off at any time in the app or in your device settings. We obtain your consent in the app, separately for the reminders; your device's system prompt alone is not enough for us.

Legal basis: for the reminders and for storing and reading the device identifier, your consent, Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can withdraw it at any time with effect for the future. We send the notice that an audio version is ready to perform our contract, Art. 6(1)(b) GDPR.

When you write to us or call us

If you send us an email or call us (the number is in the legal notice), we process your details to answer your enquiry. If you ask us for help with a particular story, we look at that story for this purpose.

Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR, or our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR. We delete the enquiry once it has been dealt with and no retention obligation applies.

When you report content

If you report a story that is unsuitable for children or unlawful, we process your report, the story concerned and the information from which account the report comes. In this case a person at our end looks at the reported story — that is the purpose of the report. Once the report has been dealt with, we remove the names and the link to your account and keep only the case and its outcome in order to improve our automated checks.

Legal basis: our legitimate interest in ensuring that no unsuitable content appears in an app whose stories are intended for children, Art. 6(1)(f) GDPR.

When you delete your account via our website

If you use the page poquito.ai/delete-account, we process the email address you enter there and your browser's connection data in order to match your request to your account, confirm it and carry out the deletion. The page does not load any analytics or advertising tools.

Legal basis: compliance with our legal obligation to erase, Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR.

If you withdraw from the contract

If you withdraw from the usage contract, for example via the "Vertrag widerrufen" ("Withdraw from contract") button in the app or via poquito.ai/withdrawal, we process your name, your account's email address, the content of your declaration and the time it was received. We use this to match the withdrawal to your account, send you the acknowledgement of receipt by email and then delete your account. The page poquito.ai/withdrawal loads no analytics or advertising tools.

Legal basis: Compliance with our legal obligations on withdrawal, Art. 6(1)(c) GDPR in conjunction with Sections 355 and 356a of the German Civil Code (BGB). We keep the record of the withdrawal on the basis of our legitimate interest in being able to show that we handled it properly, Art. 6(1)(f) GDPR.

Technical data

When the app calls our interface, connection data is generated, including your IP address. It is processed at Supabase. We need it to provide the app and to fend off attacks.

Legal basis: our legitimate interest in secure operation, Art. 6(1)(f) GDPR.

5What is stored on your device

The app stores information on your device and reads it again: your sign-in, your settings, your credit balance and the stories you opened most recently. Without this you would have to sign in again every time you start the app. The integrated RevenueCat module reads a device identifier to match your purchases; the modules for signing in with Google or Apple only access your device if you choose that sign-in.

These accesses are technically necessary to provide the functions you requested, Section 25(2) No. 2 TDDDG. For the reminders the app schedules on your device and for the device identifier through which we deliver notices that an audio version is ready, we ask for your consent (Section 4, "Notifications"). We store nothing on your device that serves advertising or measuring your behaviour.

6Who we pass data to

We do not sell data and pass nothing from the app to advertising networks.

These service providers work on our behalf

We have concluded contracts with them under Art. 28 GDPR; they may process the data only for us and only on our instructions — apart from abuse monitoring at OpenAI and Google (Section 2).

These companies decide on the processing themselves

They are controllers in their own right, not our processors. We have no influence on their processing.

Authorities. If we are legally obliged to do so, we disclose data to authorities, Art. 6(1)(c) GDPR. We examine every such request and disclose only what may lawfully be requested.

7Transfers to countries outside the EU

Some of our service providers process data outside the European Union:

• USA: OpenAI, Google, RevenueCat, Vercel and Firebase Cloud Messaging. At OpenAI and Google this also concerns the first names of your child and the other characters, but not any identifier of your account. At Vercel it concerns the audio files, in which the first name is spoken, and your device's IP address when the app loads an audio file.
• Other countries where Google operates data centres: Google may also generate the audio version there.
• Singapore and USA: Supabase accesses the data in Frankfurt from there for maintenance and support.
• Uruguay: our software developer works from there.

For Uruguay, the European Commission has decided that it ensures an adequate level of data protection (Art. 45 GDPR). All other transfers are based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which we have concluded with the service provider or which the service provider has concluded with its sub-processors. You can find a copy of the standard contractual clauses on the European Commission's website; we will send you one on request.

Please note that in the USA, government authorities may access data under certain conditions and that the legal remedies available against this are weaker than in the European Union.

8How to delete your data

You can delete your account at any time. There are two ways:

• In the app under "Settings", item "Delete account".
• Via the page poquito.ai/delete-account. You don't need the app for this.

When you delete your account, we remove your account, the details about your child and all other characters, your stories and the associated audio files, your listening progress, as well as your data at RevenueCat. There is no mere deactivation with us.

After we receive the request, complete deletion from our systems takes up to 30 days, because our backups also have to be overwritten in rotation.

We keep individual details for longer if we are legally obliged to do so. We restrict such data and use it only for the purpose for which we must retain it. If you withdraw from the contract, we also keep the record of your withdrawal for twelve months (section 4).

You can delete individual stories at any time without giving up your account.

Your subscription with the App Store or Google Play does not end when you delete your account. You must cancel it there separately. Credit lapses on deletion, purchased credit as well as credit given to you (Section 3.8 of the terms).

9How long we store data

10What we don't do

11Your rights

You can at any time request access to the data we have stored about you and your child (Art. 15 GDPR), have it rectified (Art. 16) or erased (Art. 17), restrict processing (Art. 18) and receive your data in a portable format (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

These rights also belong to your child. If your child is old and mature enough, they can exercise them themselves; otherwise the persons with parental responsibility exercise them as legal representatives. If you do not have parental responsibility yourself, the persons who do, or the child, can contact us.

A message to legal@poquito.ai is enough. We reply within one month.

12How we protect your data

Transmission between the app, our servers and our service providers is encrypted. We store passwords only as a hash. Each account sees only its own data; access to the database is limited to what is necessary for operation. We do not pass any identifier of your account to OpenAI or Google; the requests come from our server, not from your device. We select service providers according to whether they also meet these requirements.

13Complaints

You can lodge a complaint with a supervisory authority if you believe that we are violating data protection law. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.

You can also contact the supervisory authority where you live.

14Changes to this notice

We update this notice when our processing changes. The date of the current version is shown at the top. We will point out significant changes to you in the app. This notice is also available in German.