← Back to Nana Cuentos
Privacy policy
Last updated: 4 August 2026 · Version 2026-08-04
Nana Cuentos is an app for parents and guardians that creates personalized bedtime stories. This policy explains what data we process, what for, with whom, and what rights you have. The app is for adults: the account always belongs to the adult, and it is the adult who decides what information to provide about their children. Together with the terms of use, it forms the agreement you accept when you create an account.
The Spanish version is the binding one; this translation is provided for convenience.
1. Data controller
2. What data we process
- Account data (the adult’s): email, password (stored as a secure hash) and language.
- Children’s profiles (provided by the adult): first name or nickname, age, and optionally traits used to personalize stories and illustrations (appearance, favourite animal, cuddly toy, preferences). We never ask for surnames, exact date of birth, school or the child’s location.
- Content you create: the context of the day you write, the generated stories, their covers and, where applicable, their narration.
- Usage data: internal counters (e.g. stories created per day) and product events (e.g. story finished) to operate plan limits and improve the service. No advertising and no third-party trackers.
- Story memory: traits the storyteller learns about each child (recurring characters, places, themes they like or avoid) so stories keep continuity. You can review, edit and delete them one by one in the app.
- Share links: if you share a story we store the link’s secret identifier and the date, so we can serve that page and so you can withdraw it.
- Reminders: the bedtime reminder is scheduled on your own device; we do not store that time on our servers.
- Acceptance of the terms: which version you accepted and when, as evidence of consent.
- Subscription: handled by the App Store / Google Play and RevenueCat. We never see or store your card.
3. Purposes and legal bases
- Providing the service (creating and storing the stories): performance of the contract.
- Personalizing stories with children’s data: provided and consented to by the adult account holder (Art. 6(1)(a)/(b) GDPR). In Spain, processing children’s data provided by their guardians relies on that consent (LOPDGDD).
- Security and abuse prevention (content moderation, limits): legitimate interest.
4. Providers (processors)
- OpenAI — generation of the story text and illustration, and safety filters. Receives the story context (including the child’s name and traits you provided). Via the API: not used to train models.
- Microsoft Azure (AI Speech) — voice narration of the stories, if your plan includes it.
- OVHcloud — server hosting and storage (EU).
- RevenueCat — subscription management (user identifier and purchase status).
- Resend — sending the service emails (password reset and account notices). Receives your email address and the message text.
Each provider’s data processing agreement (DPA) applies. We do not sell data and do not share it with third parties for advertising.
5. How long we keep data
- For as long as your account exists, so you can re-read the stories.
- If you delete a child’s profile, their data and associated memories are deleted.
- If you delete your account, the account, profiles, stories and their images and audio are deleted. Remnants in backups disappear as those rotate.
- Password reset links expire after 60 minutes and are single use.
6. Your rights
You can exercise them straight from the app, without writing to us:
- Access and portability: Account → "Export my data" downloads a copy in a machine-readable format.
- Erasure: Account → "Delete my account" removes everything, or delete individual profiles and stories.
- Rectification: edit profiles and preferences at any time.
You can also write to soporte@nanacuentos.com and lodge a complaint with the Spanish data protection authority, AEPD (aepd.es), or your local authority, if you believe we have not honoured your rights.
7. Security
- Encrypted communications (HTTPS) and the session kept in the device’s secure store.
- Hashed passwords (bcrypt); signed access tokens with an expiry.
- Moderation filters on the text you provide and on generated images, designed for a children’s product.
8. Children
The app is not directed to children: they cannot create an account or purchase. Children’s data is provided voluntarily by their parent or guardian, who can correct or delete it at any time. Purchase areas are protected by an adult check.
9. Changes
If we make a significant change to this policy we will announce it in the app or by email before it takes effect.
Other languages: EspañolFrançaisDeutschPortuguêsItalianoCatalà