Privacy Policy

The data controller is Arkadiusz Rosiak, conducting business under the name Vartari Arkadiusz Rosiak, ul. Wawrzyńca Engeströma 10, 60-571 Poznań, NIP (tax ID): 7822891454, REGON: 387891967 (hereinafter: "Controller").

Contact for data protection matters:

1. email: contact@fablele.com
2. post: ul. Wawrzyńca Engeströma 10, 60-571 Poznań
3. phone: +48 575 820 965

The Controller has not appointed a Data Protection Officer.

2.1. Account Data

When you register, we collect:

1. your email address,
2. your password (stored exclusively as a cryptographic hash).

We do not collect names, postal addresses, phone numbers or identity document details.

2.2. User Content

When using the Application, you create and store:

1. world settings (name, description, parameters),
2. characters (names, appearance and trait descriptions),
3. stories (titles, plots, page text),
4. AI-generated illustrations.

This content may contain personal data of third parties (e.g. names of children for whom stories are created). The Controller processes this data solely for the purpose of providing the Service and does not analyse its content.

2.3. Technical and Analytics Data

We automatically collect:

1. IP address,
2. browser type and version,
3. operating system,
4. data about your interactions with the Application (pages visited, elements clicked, time spent on pages),
5. device identifiers.

Analytics data is collected using PostHog (see section 5), only after you have consented to analytics cookies.

With the same consent, PostHog records the course of your session in the Application (movements and clicks on the page) so that we can detect errors and places where the Application is unclear. Text typed into form fields and character portraits drawn from a photo are masked in the recording. Recording stops once you withdraw your consent.

We use the same tool to show short in-app surveys (for example, a question about how you rate a generated story). Answering is voluntary, and the surveys have no free-text field — you pick one of the ready-made options. The option you pick is processed by PostHog and linked to the same analytics profile as the rest of your interaction data. Surveys are shown only after you have consented to analytics cookies.

2.4. Data Transmitted to AI Providers

In order to generate content and illustrations, the following data is transmitted to AI model providers:

1. character descriptions,
2. story plots and parameters,
3. world parameters,
4. art style instructions.

This data is transmitted solely for the purpose of fulfilling the generation request and is not used for training AI models.

2.5. Newsletter Subscriber Data

Newsletter subscription is a separate, free-of-charge service available both to Account holders and to unregistered visitors. To provide this service, the Controller collects:

1. the email address provided in the sign-up form,
2. the date and time of sign-up together with the IP address and User-Agent of the browser (to document the moment consent was given),
3. a unique confirmation token used in the double opt-in mechanism, and the date and time it was used,
4. the subscription status (pending confirmation, active, unsubscribed) and the date of any unsubscription,
5. engagement data for newsletter messages (opens, link clicks) collected via PostHog (see section 5).

Data of subscribers who are not registered users of the Application is processed solely to provide the newsletter service and is not linked with Account data, unless the subscriber registers an Account using the same email address.

2.6. Photo Processing (Character Creator)

The character creator offers an optional path in which you may upload a photo so that we can create an illustrated character resembling the person or subject shown in it ("likeness preservation"). If you use this path:

1. The photo may contain an image of a person, which constitutes a special category of personal data (biometric/likeness). We process it solely on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR), which you grant per upload by confirming that you hold the rights to use the likeness.
2. Purpose: analysing the visible appearance to pre-fill the character's appearance and generating an illustrated character (which may resemble the uploaded subject).
3. Retention: the photo is stored temporarily and is deleted once it has been processed, and in any case no later than 24 hours from upload (automatic deletion). The generated illustration is retained as part of your character.
4. Recipients: the photo is transmitted to our AI providers (see section 5) to analyse its visible appearance and to generate the character. It is not used to train AI models and is not shared with any other third parties.
5. Your rights: you may withdraw consent at any time (withdrawal does not affect processing carried out before withdrawal) and delete the created character.
6. You must not upload photos of other people without their consent (or the consent of their legal guardian for children).

2.7. Voice Processing (Story Narration)

The Application lets you generate a narration of a story — a recording in which the story's text is read aloud. A narration can be recorded with a built-in narrator voice (in which case we process no data about your voice) or with your own voice, based on recordings you make in the Application. If you create your own voice:

1. What we collect: two recordings of your voice made in the Application following the texts displayed, the voice name you choose, the language of the recording and technical parameters of the recording (length, loudness levels, browser settings), which describe the recording, not its content.
2. Legal basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR), which we collect by way of a separate declaration before the first sample is recorded. We treat voice recordings as biometric data.
3. Your own voice only: the feature serves solely to create a model of your own voice. You must not record another person's voice or play back a recording of someone else's voice — these rules are set out in § 17 of the Terms of Service.
4. Purpose: creating a digital model of your voice and using it to generate a short preview and narrations of your stories. The recordings are not used to identify or recognise individuals and are not used for any other purpose.
5. Recipients: the recordings and the story text are transmitted to our speech synthesis provider, Eleven Labs Inc. (USA), see section 5. The recordings are not transmitted to any other third party, are not published and are not shared with other users.
6. Where we store them: the recordings are held in a separate, encrypted store in the European Union that is not publicly reachable. Only the process that generates narrations can access them.
7. How long we keep them: until you delete the voice in question — see section 7 point 6 for details. The recordings have no automatic expiry, because they are what allows the voice model to be recreated when you want to record another narration. Deleting a voice in your Account settings amounts to withdrawing your consent and results in the permanent deletion of the recordings and of the voice model held at the provider.
8. The generated narration: the narration audio file is stored together with the story, on the same basis as illustrations. A narration recorded with your own voice plays under the story's public link only where you have given separate consent for that specific narration; you may withdraw that consent at any time with effect for the future. Narrations recorded with a built-in narrator voice are available under the public link without separate consent.
9. Record of consent: we record the giving and withdrawal of consent in a separate register, which contains no recording of your voice and no audio file. We keep the register for the period set out in section 7.
10. Your rights: you may withdraw your consent at any time by deleting the voice in your Account settings (withdrawal does not affect the lawfulness of processing carried out beforehand), and you may delete individual narrations.

3.1. Performance of the Agreement (Article 6(1)(b) GDPR)

We process account data and user content for the purpose of:

1. creating and maintaining your Account,
2. enabling you to create characters and stories,
3. generating content and illustrations using AI,
4. sharing stories via public links (when you choose to share them),
5. managing Credits,
6. sending transactional messages: email address verification, password reset and confirmation of a password change, notification that a data export is ready, and notifications about the status of a story being created — that it is ready, that its creation has been paused (e.g. for lack of Credits) or that it could not be finished (together with information about the refund of Credits, if they were refunded).

3.2. Legitimate Interest of the Controller (Article 6(1)(f) GDPR)

We process data for the purpose of:

1. ensuring the security of the Application and protection against abuse,
2. diagnosing technical issues,
3. monitoring the performance and availability of the Application,
4. monitoring AI operations (costs, token usage, latency) using Langfuse,
5. demonstrating that processing based on consent is lawful (keeping the records of consent — section 7 point 5),
6. sending a one-time reminder to finish a registration that was started (confirming the email address), if the registration has not been finished. We send the reminder no earlier than 24 hours after the registration was started and after the last message with a confirmation link, and no later than 7 days after the registration was started. For this purpose we process the email address given at registration, the date the registration was started, whether the address has been confirmed, and the language of the message. Our legitimate interest is enabling the completion of a registration that was started with your email address — a person who began creating an account can reasonably expect one such message. The reminder contains only a new confirmation link and no advertising or promotional content.

Right to object. You may object at any time to the processing of your data based on legitimate interest (Article 21(1) GDPR; details in section 8). If you do not want to receive the reminder to finish your registration, write to contact@fablele.com — we will not send it. You do not need to give reasons for objecting to this reminder.

3.3. Consent (Article 6(1)(a) GDPR)

On the basis of your consent, we process data for the purpose of:

1. analytics and improvement of the Application, measuring advertising effectiveness and building remarketing and lookalike audiences (PostHog analytics cookies, including session recording, Meta Pixel and the Conversions API),
2. sending the newsletter and other marketing communications to the email address provided, including measuring subscriber engagement (opens and clicks) — in this respect the Controller relies simultaneously on:
   1. consent within the meaning of Article 6(1)(a) GDPR,
   2. consent to the use of telecommunications terminal equipment for the purpose of sending commercial information, including direct marketing, within the meaning of Article 398(1) of the Polish Act of 12 July 2024 — Electronic Communications Law,
3. analysing an uploaded photo and generating an illustrated character from it (point 2.6) — as regards special categories of data, on the basis of explicit consent (Article 9(2)(a) GDPR),
4. creating a digital model of your voice and using it to generate narrations (point 2.7) — to the extent that the recording constitutes biometric data covered by Article 9(1) GDPR, on the basis of explicit consent (Article 9(2)(a) GDPR),
5. making a narration recorded with your own voice available under a story's public link — consent given separately for each narration (point 2.7).

Consent to the newsletter is given via a double opt-in mechanism — completion of the sign-up form and clicking a unique confirmation link sent to the email address provided. All consents are voluntary, given separately, and may be withdrawn at any time (see section 8). Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

3.4. Legal Obligations (Article 6(1)(c) GDPR)

We process data to the extent necessary to fulfil legal obligations, in particular:

1. fulfilling users' rights under the GDPR,
2. responding to requests from public authorities.

3.5. Do You Have to Provide Data

Providing an email address and a password is a condition of entering into the agreement — without them you cannot create an Account. Any other data is provided voluntarily; not providing it only means you cannot use the feature that requires it (e.g. a photo or your own voice). We do not take decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

1. The Application uses AI models provided through the OpenRouter platform to generate story text and illustrations. The specific model may change without an update to this Policy — access to all models takes place through the same data processor (OpenRouter).
2. Data transmitted to AI providers includes only the content necessary to generate the requested result (character descriptions, plots, art style parameters). Your email address, password and other identifying data are not transmitted to AI providers.
3. The Controller exclusively uses models made available through OpenRouter in Zero Data Retention (ZDR) mode. This means that AI model providers do not retain input or output data after the generation is completed, nor use such data to train AI models. Information about ZDR mode is published by OpenRouter at openrouter.ai/docs/guides/features/zdr.
4. To generate voice narration and to create a digital model of the user's voice (point 2.7), the Controller uses Eleven Labs Inc. (USA). The Zero Data Retention mode referred to in point 3 above applies only to the OpenRouter platform and does not extend to this provider: creating a voice model inherently consists of storing it on the provider's side. The Controller makes use of the option offered by the provider to exclude the transmitted data from being used to train the provider's models. The voice model is deleted at the provider once the user deletes the voice, and also when we free up space at the provider for other voice models — the recordings held in the Controller's store are then the only source from which the model can be recreated.
5. Generated content (text, illustrations and narrations) is stored on the Controller's servers (AWS, EU region) and associated with your Account.
6. The Controller uses Langfuse to monitor AI operations (tracking token usage, costs, latency and response quality). Langfuse may process fragments of prompts submitted to AI models.
7. In accordance with Article 50 of Regulation (EU) 2024/1689 (AI Act), content produced by the system is marked as created with AI. Generated illustrations carry machine-readable provenance metadata (including a digital source type indicator), and stories display a human-readable notice that they were created with AI. These markings describe only how the file was created and contain no personal data of the user.

The Controller uses the following data processors (sub-processors):

1. Amazon Web Services (AWS), EU region (Frankfurt, eu-central-1) — Application hosting, file storage (S3), delivery of transactional email and the newsletter (SES), content delivery network (CloudFront). Web application firewall (WAF) logs, which include IP addresses, are stored in the US region (us-east-1) due to the technical requirements of that service.
2. MongoDB Atlas, EU region (Frankfurt, eu-central-1) — database storing account data and user content.
3. OpenRouter (USA) — intermediary providing access to AI models; user data (character descriptions, plots, art style parameters) is transmitted for the purpose of content generation. OpenRouter relies on its own sub-processors that are AI model providers — the current list of models and OpenRouter's privacy policy are published at openrouter.ai/models and openrouter.ai/privacy.
4. Eleven Labs Inc. (USA) — speech synthesis and voice cloning provider. We transmit to it voice recordings (to create a digital voice model) and story text (to generate a narration); we do not transmit the email address, the name given to the voice or any other identifying data — the voice model is described at the provider solely by a technical label. The processing is entrusted under the Data Processing Addendum published at elevenlabs.io/dpa. The provider uses its own sub-processors, the current list of which it publishes at compliance.elevenlabs.io/subprocessors; outside Enterprise plans the provider reserves the right to process data in the United States, the European Union or Singapore.
5. PostHog (servers in the European Union) — analytics tool collecting data about user interactions with the Application (including session recordings) and with newsletter messages (opens and link clicks). We also transmit Conversions API events to Meta via PostHog (see point 6).
6. Meta Platforms Ireland Ltd. (Ireland) — provider of Meta Pixel and the Conversions API used to measure advertising campaign performance on Facebook and Instagram, build remarketing audiences (Custom Audiences) and lookalike audiences created by Meta on their basis (Lookalike Audiences), and report conversions. The Controller transmits the following events (conversions) to Meta:
   1. account registration — a hashed (SHA-256) email address, a hashed (SHA-256) account identifier (an external ID — a string that does not let Meta establish your identity), the ad click and browser identifiers (fbc, fbp), the IP address, browser information (user agent) and the address of the page on which the account was created;
   2. account activation (completion of the first story) and completion of a series episode — a hashed email address, a hashed account identifier, fbc and fbp (if stored with the account), the browser information (user agent) stored at registration (if it was stored) and event labels (e.g. the series identifier and episode number) — never the title or the text of a story; without the IP address;
   3. creation of your own voice (voice clone, point 2.7) — only the event name and a hashed account identifier (plus a random event identifier used solely for deduplication); without the email address, without browser information (user agent), without campaign identifiers and without any voice data (recordings, the model or the voice name);
   4. the first playback on a given day of the narration of your own story — an event sent from the browser via PostHog: a hashed account identifier, fbc and fbp (if available), the IP address, browser information (user agent), the address of the page visited and the type of narration voice (narrator or your own voice); without the email address and without the recording.
   At registration we store with the user's account the campaign identifiers (fbc, fbp and the utm_* parameters) and browser information (user agent, truncated to 512 characters) so that they can be transmitted with later events and those events can be linked to the campaign the user came from; they are retained for as long as the account exists. We store this data, and transmit the events in points 1–3, only if consent to analytics and marketing cookies (section 9) was given at the time of registration; the event in point 4 — only if that consent is given at the time of playback. With respect to event data transmitted via Meta Pixel and the Conversions API, the Controller and Meta Ireland are joint controllers within the meaning of Article 26 GDPR under Meta's Controller Addendum (Meta Controller Addendum). Meta Pixel and the Conversions API are only activated after the relevant consent has been given.
7. Langfuse (Germany, cloud) — AI operations monitoring tool (tracking prompts, tokens, costs).
8. Zoho Corporation — provider of the email mailboxes in the fablele.com domain; it processes the correspondence you send us (e.g. complaints, reports, data requests).
9. Google LLC (USA) — if you click the button to send a story to a TV (Chromecast), your browser downloads the Google Cast library directly from Google's servers, which receive, among other things, your IP address.

The Controller may share personal data with public authorities where required by law.

Personal data may be transferred outside the European Economic Area (EEA) to the following entities:

1. OpenRouter (USA) — on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission. OpenRouter is responsible for any onward transfers to its own sub-processors (AI model providers) under its own safeguards (SCCs or the EU-US Data Privacy Framework, as applicable).
2. Eleven Labs Inc. (USA; the provider may also process data in Singapore) — on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, incorporated into that provider's Data Processing Addendum. The transfer covers voice recordings and story text; it does not cover the email address or any other identifying data.
3. Amazon Web Services (USA, us-east-1 region) — as regards web application firewall (WAF) logs, on the basis of the Standard Contractual Clauses incorporated into the AWS Data Processing Addendum.

In each case, the Controller applies appropriate safeguards in accordance with Chapter V of the GDPR. You can obtain a copy of the safeguards applied by contacting the Controller.

1. Account data and user content — for the duration of the Account. After Account deletion, data is archived for 30 days and then permanently deleted.
2. Analytics data (PostHog) — for a period of 12 months from the date of collection; session recordings — for a period of 30 days.
3. AI operations data (Langfuse) — for a period of 90 days from the date of collection.
4. Marketing consents and email addresses of newsletter subscribers — until consent is withdrawn or unsubscription from the newsletter.
5. Records of consent (newsletter, photo, voice; including sign-up and double opt-in confirmation logs, IP address, User-Agent, timestamps) — for a period of 3 years from the withdrawal of consent, unsubscription or the deletion of the Account, in order to demonstrate the lawfulness of processing (Article 7(1) GDPR). The records contain neither photos nor voice recordings.
6. Voice recordings (point 2.7) — until you delete the voice in question; the recordings have no automatic expiry. After Account deletion, we delete the recordings and the voice model held at the provider once the Account's 30-day archival period has elapsed (§ 4(12) of the Terms of Service), in the next automatic deletion cycle — usually within a day of its expiry.
7. Narrations (point 2.7) — for the duration of the Account, on the same basis as other user content (point 1 above).
8. Security logs — for a period of 90 days.

Under the GDPR, you have the following rights:

1. Right of access — you may obtain information about what data we process and receive a copy of it.
2. Right to rectification — you may request the correction of inaccurate or the completion of incomplete data.
3. Right to erasure ("right to be forgotten") — you may request the deletion of your data. You can do this yourself by deleting your Account in the Application.
4. Right to restriction of processing — you may request the restriction of processing in certain circumstances.
5. Right to data portability — you may download your data in JSON format (data export function in the Application).
6. Right to object — you may object at any time, on grounds relating to your particular situation, to the processing of your data based on the Controller's legitimate interest (point 3.2). The Controller will then stop processing that data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. An objection to the reminder to finish your registration is always honoured, without any reasons required. You can submit an objection to contact@fablele.com.
7. Right to withdraw consent — you may withdraw your consent to data processing (e.g. analytics, marketing) at any time without affecting the lawfulness of prior processing. You may withdraw your consent to the newsletter by clicking the "Unsubscribe" link available in every newsletter message, through your Account settings (if you are a registered user) or by contacting the Controller.
8. Right to lodge a complaint — you have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

To exercise any of the above rights, please contact the Controller at: contact@fablele.com. The Controller shall respond without undue delay, and no later than within one month of receipt of the request.

1. The Application stores information in cookies and in browser storage (localStorage) in the following categories:
   1. Essential — required for the proper functioning of the Application (authentication, session maintenance, the selected language and colour theme). These do not require consent.
   2. Functional — remember, among other things, tips you have already seen and your progress in the Application.
   3. Analytics and marketing — collect data about how you use the Application (PostHog, including session recording) and measure the effectiveness of advertising campaigns on Meta platforms (Meta Pixel). These require your consent.
2. You may manage your cookie preferences at any time using the cookie settings available in the Application.
3. Disabling essential cookies may prevent you from using the Application properly.

1. The Application is intended for adults only. We do not knowingly collect personal data directly from minors; if we learn that an Account has been created by a minor, we will delete it together with its data.
2. Content created in the Application (stories, characters) may contain children's data (e.g. names and, when a photo is used, their likeness), which is entered and managed exclusively by the adult user.
3. Recording another person's voice, including a child's, is prohibited (§ 17 of the Terms of Service); such a recording is deleted together with the voice model created from it.

1. The Controller reserves the right to amend this Privacy Policy to reflect changes in the law, changes in data processing practices or changes in the Application's functionalities.
2. Users will be informed of material changes to this Privacy Policy by email or by a notification in the Application, with at least 14 days' advance notice.