Privacy policy
How we protect your and your children's data under Moldovan Law no. 195/2024 on personal data protection and Regulation (EU) 2016/679 (GDPR).
Last updated: 2026-10-16.2
1. The controller
The data controller is Dalia's Story, IDNO —, —. For data-protection matters write to the form on the Contact page.
2. Data we collect
• Parent account: e-mail, password (stored encrypted), preferred language. • Order contact details: name, phone. • Children's data: first name, age, gender, avatar choices, favourite colour/hobby/pet and, optionally, one photo per child. The photo is uploaded only after parental consent, used solely to match the cartoon character’s look (hair, skin tone, glasses), never used for facial recognition, never published, and visible only to the parent and authorised staff producing the order. • Story texts: good deeds, the gift, parents' message, city, siblings/pets mentioned. • Orders and payments: product, price, promo code, transaction reference (we never store card data). • Technical data: security logs, IP address, sign-in attempts.
3. Purposes and legal bases
• Creating and delivering the story, your account and support — performance of a contract. • Processing children's data — consent of the parent/guardian, given in the story creator. • Invoicing and accounting — legal obligation. • Security, fraud prevention and abuse limits — legitimate interest. We do not use data for advertising, do not sell it and do not build marketing profiles.
4. Children's data
Children's data is processed only with the consent of a parent or legal guardian and only to create the ordered story. Photos are optional, used only to style the avatar and visible only to you and authorized staff. We never publish children's stories; the family link is private and can be switched off at any time.
5. Processors
We use providers that process data on our behalf under contract: hosting and database (cloud), AI text and image generation, voice and video-rendering services, the payment processor MAIB and the e-mail delivery service. We share only the data strictly necessary.
6. International transfers
Some providers may process data outside Moldova or the EU. In such cases we use appropriate safeguards — adequacy decisions, standard contractual clauses or equivalent measures — under Art. 44–50 of Law no. 195/2024 and Chapter V GDPR.
7. Retention
• Optional children’s photos — you can remove them any time from the order page; they are deleted automatically 30 days after the story is completed. • Unpaid drafts and photos uploaded for them — automatically deleted after 90 days. • Completed stories — kept until you delete them or your account. • Accounting records (orders, payments) — for the period required by tax and accounting law, anonymized after account deletion. • Security logs — at most 12 months.
8. Security
We use encrypted connections (HTTPS), private storage with temporary signed links, database-level access rules, staff roles and permissions, an audit log and sign-in rate limits. In a security incident we notify the authority and, where needed, affected people within the legal deadlines.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability, objection and to withdraw consent at any time. On “My account” you can download all your data (JSON) and delete your account; in “My stories” you can delete any story. For other requests write to the form on the Contact page — we reply within 30 days.
10. Complaints
You may complain to the National Center for Personal Data Protection (48 Serghei Lazo St., Chișinău, datepersonale.md). EU residents may also contact the data-protection authority in their country.