Legal
Privacy Policy
Last updated 20 July 2026
1.Who we are
Storyteller is operated by AI Explorers, registration number 2025/460302/07, a company incorporated in the Republic of South Africa (“we”, “us”, “our”). We are the responsible party for the personal information described in this policy, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).
- Registered address: [registered street address]
- Information Officer: [Information Officer full name]
- Email: support@thestoryteller.co.za
- Website: thestoryteller.co.za
2.What this policy covers
This policy applies to the Storyteller website, the story creation studio, the public Library, printed book orders and the emails we send you. It explains what we collect, why, who we share it with, how long we keep it, and the rights POPIA gives you over it.
3.The information we collect
3.1 Information you give us
- Account details — your email address and display name. Passwords are handled by our authentication provider and stored only as cryptographic hashes; we never see them.
- Photographs you upload to build a cast of characters — commonly photographs of your children, family and pets.
- Character details — the names, ages, personality traits and relationships you enter for each character in a story.
- Story content — the wishes, lessons and settings you choose, the messages you exchange with the story assistant, and the finished stories, illustrations and narration.
- Voice recordings, if you choose to narrate a book in a cloned voice.
- Order details for printed books — recipient name, delivery address, telephone number and email address.
3.2 Face data — special personal information
To recognise the same person across several photographs, your browser detects the faces in each photograph and computes a face embedding: a list of numbers describing the geometry of that face. We store the embedding, the position of the face in the photograph, and a cropped thumbnail of it.
Face embeddings are biometric information, which POPIA classifies as special personal information and protects more strictly than ordinary data. We process it only with your express consent, given when you upload photographs, and only for the single purpose of grouping faces into characters so that the same child looks like the same child on every page. We do not use it to identify anyone outside your own account, we do not match it against any external database, and we do not sell or share it for any other purpose.
You may withdraw that consent at any time by deleting the photograph, the project, or your account. The embedding is destroyed with the photograph it came from.
3.3 Information we collect automatically
- Technical data— IP address, browser type and pages requested, recorded in our hosting provider’s server logs for security and troubleshooting.
- Reading statistics — when a published book is opened from the Library we record that a read took place. This beacon is anonymous: it is not linked to an account, a name or an IP address, and it exists so authors can see how often their book has been read.
- Cookies — see section 9.
4.Children’s information
Storyteller accounts are for adults. You must be 18 or older to create one.
Section 35 of POPIA prohibits the processing of a child’s personal information unless it is consented to by a competent person— a parent, guardian or other person legally authorised to act for that child. By uploading a photograph of a child, or entering a child’s name and age, you confirm that you are that child’s parent or legal guardian, or that you have their parent or guardian’s permission, and you give that consent on the child’s behalf.
Children’s photographs and face data are never made public by us. A story you publish to the Library is published under the settings described in section 7, and remains under your control.
If you believe a child’s information has been uploaded without the right consent, write to support@thestoryteller.co.za and we will remove it.
5.Why we process it, and on what legal basis
| Purpose | Lawful basis under POPIA |
|---|---|
| Creating and running your account | Performance of our contract with you |
| Detecting and grouping faces so characters stay consistent | Your express consent (special personal information) |
| Generating stories, illustrations and narration you ask for | Performance of our contract with you |
| Cloning a voice for narration, where you choose it | Your express consent |
| Taking payment and fulfilling printed book orders | Performance of our contract with you |
| Sending service emails about your account and orders | Performance of our contract; our legitimate interests |
| Keeping the service secure and preventing abuse | Our legitimate interests |
| Keeping accounting and tax records | Compliance with a legal obligation |
We do notsell your personal information, and we do not use your photographs, stories or children’s details for advertising.
6.Who we share it with
We share personal information only with the operators we need to run the service. Each acts as our operator under POPIA, is bound by contract to process the information only on our instructions, and may not use it for its own purposes.
| Operator | What it does | Where it processes |
|---|---|---|
| Supabase | Accounts, database, file storage for photos, illustrations and audio | European Union |
| Vercel | Website and application hosting, request logs | United States / global edge |
| OpenAI | Story writing, page rewriting and illustration generation | United States |
| Google (Gemini) | Illustration generation | United States |
| ElevenLabs | Narration audio and, where you choose it, temporary voice cloning | United States |
| Resend | Transactional email (sign-in, order and account notices) | United States |
| Ozow | Payment processing by instant EFT | South Africa |
| Jamendo | Licensed background music for narration | European Union |
| Print & courier partners | Manufacture and delivery of printed books | South Africa |
6.1 Artificial intelligence providers
To write and illustrate a story we send the relevant material — your character descriptions, story choices, and the reference portraits generated from your photographs — to the AI providers listed above. We rely on their commercial API terms, under which submitted content is not used to train their models. We do not grant them any right to use your material for their own purposes.
6.2 Cloned voices
If you narrate a book in a cloned voice, the recording is sent to ElevenLabs to create a temporary voice. That voice is deleted automatically as soon as narration has been generated, and in any event within 15 minutes. It is not retained or reused.
6.3 Payments
Payments are processed by Ozowby instant EFT. You enter your banking credentials on Ozow’s own secure pages — we never see, receive or store them. Ozow tells us only whether a payment succeeded, and the reference and amount.
6.4 Other disclosures
We may disclose information where the law requires it, to establish or defend a legal claim, or to protect the safety of a person. If our business is sold or restructured, information may transfer to the acquirer under the same protections.
7.Publishing to the Library
Stories are private by default. Nothing you make is visible to anyone else unless you choose to publish it.
If you publish a book to the Library, the following becomes publicly visible to anyone on the internet, including people who are not signed in: the book’s title, cover, illustrations, full text, the first names of the characters as you entered them, and your display name as the author. The photographs you uploaded are never published, and neither is face data.
Think carefully before publishing a book that names a child. You can unpublish at any time from the book’s reader page, which removes it from the Library — though copies already downloaded or cached by others cannot be recalled.
8.Cross-border transfers
Several of our operators process information outside South Africa, as set out in section 6. Section 72 of POPIA permits this where the recipient is subject to laws or binding agreements that uphold principles for lawful processing substantially similar to POPIA. We rely on the data processing agreements we have in place with each operator, which impose those standards contractually.
9.Cookies
We use a small number of cookies, all of them necessary for the site to work. They keep you signed in, maintain your session securely, and remember your light or dark theme preference. We do not use advertising cookies, and we do not run third-party tracking or analytics scripts that profile you across other websites.
You can block cookies in your browser, but you will not be able to sign in or create stories without them.
10.How long we keep it
| Information | Retention |
|---|---|
| Account and profile | Until you delete your account, then removed within 30 days |
| Photographs you upload | Until you delete the photo, the project, or your account |
| Face data (see 3.2) | Deleted together with the photograph it was derived from |
| Stories, illustrations, narration | Until you delete them or your account |
| Cloned voices | Deleted automatically once narration is generated, and in any event within 15 minutes |
| Order and payment records | 5 years from the end of the tax year, as required by South African tax and company law |
| Anonymous reading statistics | Retained indefinitely in aggregate; contains no identifying information |
Deleting a project deletes its photographs, face data, characters, stories, illustrations and audio. Closing your account — by asking us at support@thestoryteller.co.za — deletes all of it. Backups are overwritten on a rolling cycle and purge deleted material within 30 days.
11.How we protect it
All traffic is encrypted in transit. Photographs, illustrations and audio are held in private storage and served only through short-lived signed links; they are not publicly addressable. Access to your data is enforced at the database level by row-level security, so one account cannot read another’s. Access by our staff is limited to those who need it to support you.
No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as section 22 of POPIA requires.
12.Your rights
Under POPIA you have the right to:
- ask what personal information we hold about you, and receive a copy of it;
- have inaccurate or incomplete information corrected;
- have information deleted where we no longer have grounds to keep it;
- object to processing based on our legitimate interests;
- withdraw a consent you have given — including consent to process face data — at any time;
- complain to the Information Regulator.
You can delete individual photographs and whole projects yourself, at any time, from the studio. To close your account and erase everything we hold, or to exercise any other right above, write to support@thestoryteller.co.za. We will confirm within 7 days and complete the request within 30 days.
The Information Regulator (South Africa)
- Website: inforegulator.org.za
- General enquiries: enquiries@inforegulator.org.za
- Complaints: POPIAComplaints@inforegulator.org.za
13.Changes to this policy
We will post any change on this page and update the date at the top. If a change materially affects how we handle your information — particularly photographs or face data — we will tell you by email before it takes effect.
Questions about this document? Write to support@thestoryteller.co.za.