Privacy Policy – Balu Stories

Last updated: 12/10/2025

This Privacy Policy explains how Balu Stories ("App", "Service") collects, uses, stores, and protects users' personal data.

Balu Stories is an app for creating personalized children's stories, intended for parents or legal guardians, and not for children independently.

By using the App, you agree to the practices described in this Policy.

1. Data controller

The personal data controller is:
Balu Stories
Country: Brazil
Contact email: contato@balustories.com

While the legal entity is not yet formally defined, Balu Stories acts as the controller responsible for data processing under applicable law.

2. Target audience and child privacy

Balu Stories is intended exclusively for parents or legal guardians. Children do not create accounts, do not log in, and do not interact with the app on their own.

Data related to children is provided voluntarily by the responsible adult, exclusively for creating personalized stories.

By providing a child's data, you declare that you are the parent or legal guardian, or that you have authorization to do so.

If we identify that a child's data was provided without a legal guardian's consent, we will proceed with immediate deletion of that data.

3. Personal data we collect

3.1 Responsible adult data

  • • Login data via social authentication (e.g., authentication provider identifier)
  • • Basic information associated with the account
  • • Technical device identifiers (for operation and analytics)

3.2 Child data (provided by the responsible adult)

For story personalization purposes, we may collect:

  • • Name
  • • Date of birth
  • • Gender
  • • Physical characteristics (e.g., hair color, fictional traits)
  • • Interests and preferences
  • • Personality traits
  • • City where the child lives (without exact address)

We do not collect:

  • • Photographs
  • • Exact home address
  • • Biometric data
  • • Sensitive data for commercial purposes

4. Purpose of data use

Personal data is used to:

  • • Create and personalize children's stories
  • • Allow the user to manage profiles and stories
  • • Store story history while the account is active
  • • Allow story sharing when the user chooses to do so
  • • Send service-related notifications, such as new stories available (only with consent)
  • • Improve the quality and user experience of the App through aggregated usage analysis
  • • Comply with legal and regulatory obligations

We do not use data for:

  • • Third-party behavioral advertising
  • • Sale or commercial sharing of personal data
  • • Creation of children's profiles for marketing purposes

5. Legal basis for data processing (LGPD)

Data processing is carried out based on the following legal grounds under Brazil's General Data Protection Law (Law No. 13,709/2018):

  • • Consent: for story personalization and optional communications
  • • Contract performance: for operation of the App and delivery of the contracted service
  • • Legitimate interest: for service improvement, security, and fraud prevention
  • • Compliance with legal obligation: when required by law

6. Data sharing

We do not sell, rent, or commercially trade personal data. We may share data only in the following situations:

  • • Service providers: technical partners supporting App operations (e.g., cloud infrastructure, AI story generation, analytics), always under contractual confidentiality obligations and without autonomous use of data
  • • Legal obligation: when required by a competent authority, court order, or applicable law
  • • Protection of rights: to protect the rights, property, or safety of Balu Stories, its users, or third parties

Currently, we use the following types of providers: authentication services (social login), cloud hosting and infrastructure services, usage analysis tools (anonymized analytics), and language models for story generation.

7. Data retention

Data is kept while the user account remains active. After account deletion:

  • • Responsible adult personal data is removed within up to 30 days
  • • Child-related data is removed immediately
  • • Generated stories may be kept in anonymized form for up to 90 days for backup and technical integrity purposes, after which they are permanently deleted

Some data may be retained for longer periods when required by law.

8. Data security

We adopt technical and organizational measures to protect personal data, including:

  • • Encryption in transit (TLS/HTTPS)
  • • Restricted access control to data
  • • Monitoring of access and suspicious activities
  • • Periodic review of security practices

Although no system is 100% secure, we are committed to acting diligently and notifying users and the Brazilian National Data Protection Authority (ANPD) in case of a relevant incident, as required by LGPD.

9. Your rights as a data subject

Under LGPD, you have the right to:

  • • Confirm the existence of processing of your data
  • • Access the data we hold about you
  • • Correct incomplete, inaccurate, or outdated data
  • • Request anonymization, blocking, or deletion of unnecessary data or data processed unlawfully
  • • Request portability of your data to another provider
  • • Withdraw consent at any time, without harming the service in cases where processing has another legal basis
  • • Request full deletion of your account and associated data

To exercise any of these rights, contact: contato@balustories.com. We will respond within up to 15 business days.

10. Cookies and similar technologies

The App may use technical identifiers and analytics tools for performance and user experience improvement purposes.

We do not use cookies for advertising purposes. Information collected through these technologies is processed in aggregated and anonymized form whenever possible.

11. International data transfer

Some of our service providers may be located outside Brazil.

In such cases, we ensure transfers occur in compliance with LGPD, through appropriate contractual clauses or based on recognized adequacy decisions.

12. Changes to this Policy

We may update this Policy periodically. When there are relevant changes, you will be notified through the App or by email.

Continued use of the App after notification implies acceptance of the updated version.

We recommend periodic review of this Policy.

13. Contact

For questions, requests, or complaints related to this Policy or the processing of your data, contact: contato@balustories.com

You may also file complaints with the Brazilian National Data Protection Authority (ANPD): www.gov.br/anpd