1. Introduction

This Adult Privacy Policy explains how Build My Story collects, uses, shares, and protects personal information when adult users (including parents, guardians, educators, and organization leaders) access or use the Build My Story website and related products and services that link to this policy (the “Services”).

Children may use the Services only under the supervision of an authorized adult. Information relating to children under 13 is covered in our Children’s Privacy Policy.

By using the Services, you agree to this Adult Privacy Policy and our Terms of Use.

2. What Information We Collect

2.1 Information You Provide to Us

We collect Personal Information you directly provide during use of our Services, including when you:

• Create a licensed teacher or parent account

• Submit or approve child data

• Upload photos or story content

• Order printed books

• Contact support

The types of Personal Information we may collect include:

• Full name

• Email address

• Role (licensed teacher, parent, org leader)

• School or group affiliation

• Mailing address (for print delivery)

• Billing details (handled securely by Stripe)

• Child first names (only when added by an adult)

• Child photos or goals (optional, with verified consent)

• Written stories, titles, or prompts you or a child submits

Note: We do not allow children to input or share identifiable data independently.

Parental Consent: For children under 13, Build My Story requires verifiable parental or guardian consent (or school consent where permitted by COPPA/FERPA) before collecting or processing any personal data, including a child’s first name or photo.

We do not store biometric identifiers or templates. If you upload a child’s photo to create an avatar, the photo may be processed by AI tools to generate a likeness, and this processing may be regulated as biometric data under some laws (e.g., BIPA).

Even when not directly named, a combination of details (e.g., school name, photo, and first name) may still identify a child. We treat these indirect identifiers as protected personal information.

2.2 Information Collected Automatically

When you use our Services, we and our vendors collect limited device and usage data, including:

• IP address

• Device type and operating system

• Browser type

• Page interactions (e.g., buttons clicked)

• General location based on IP

• Error or crash logs

• Authentication and session data

We use cookies and similar tools (e.g., pixels, SDKs) to keep you signed in, understand feature usage, and maintain platform security.

In EU and UK jurisdictions, non-essential cookies are disabled unless explicitly allowed by you.

 

2.3 Information from Third Parties

We may receive personal data from third-party services you choose to connect with, such as:

• Google Login or Microsoft Sign-In

• School rostering tools

• AI generation providers

These services are governed by their own privacy policies. When used, they pass limited data (e.g., name, email) to us under your control.

 

3. How We Use Your Information

We use Personal Information only as needed to operate, maintain, and improve the Services. This includes:

• Account creation and user authentication

• Generating personalized storybooks

• Delivering printed books or emails

• Supporting your use and troubleshooting issues

• Maintaining educational records for schools

• Notifying you of updates, reminders, or system changes

• Complying with legal obligations (e.g., FERPA, COPPA, GDPR)

• Analyzing anonymized usage data to improve the platform

We do not use Personal Information for ad targeting or profiling.

Printed books ordered by adults may include children’s data. This is considered commercial use and requires explicit adult consent. We only proceed with book printing when initiated and authorized by an adult user.

 

4. Legal Bases for Processing

We process your Personal Information under the following legal bases:

• Consent – When you explicitly authorize data collection (e.g., uploading a student photo)

• Contractual necessity – To deliver your requested services

• Legitimate interests – To maintain secure operations, analyze usage trends, and improve features

• Legal obligation – To comply with education privacy laws such as COPPA, FERPA, and GDPR

If you are located in the EU, UK, or other jurisdictions with data protection laws, you have additional rights outlined in Section 7.

By checking the consent box during signup or before use, you affirm that you are an authorized adult (parent, guardian, teacher) and that you’ve read and agreed to this Privacy Policy.

5. How We Share Your Information

We do not sell or rent Personal Information. We share it only when necessary to deliver our Services or comply with legal requirements.

5.1 Service Providers

We work with trusted service providers—such as cloud storage providers, AI content tools, and print fulfillment partners—who help us operate the platform. These providers only process information on our behalf under strict contractual safeguards. You may request a list of our current service providers (subprocessors) by contacting us using the information at the bottom of this page.

5.2 Schools and Verified Organizations

When a licensed teacher or organization sets up a classroom, data is visible only to verified adult users managing that group. Parents cannot access other students’ information.

When Build My Story is used by a school for an educational purpose, Build My Story processes student data on the school’s behalf and under the school’s instructions.

5.3 Legal Requirements

We may disclose information if we believe it is necessary to:

• Comply with applicable laws (e.g., FERPA, COPPA, GDPR)

• Respond to lawful requests by public authorities

• Protect the safety or rights of users, schools, or the public

• Enforce our Terms of Use

 

5.4 Cross-Role Visibility

Licensed teachers and verified guardians linked to the same project may view each other’s submitted content and associated classroom progress. No one can access another child’s data unless explicitly invited.

 

5.5 Public or Voluntary Visibility

No student or classroom data is visible to the public. If adults voluntarily join promotional campaigns, referral projects, or leaderboard-style features, only non-sensitive information (e.g., name, state, role) will be shown, and only with opt-in.

We will never publicly display, publish, or promote your or your child’s content for marketing or promotional purposes without a separate opt-in. Use in case studies, flyers, or other public-facing materials requires distinct and verifiable consent.

5.6 Business Transfers

If Build My Story is involved in a merger, acquisition, or asset sale, Personal Information may be transferred to the acquiring entity under equivalent data protection terms. We will notify users before such transfers.

6. How We Protect Your Information

We implement a layered security approach, including:

• TLS encryption for all data in transit

• Encryption at rest using industry best practices

• Access controls and role-based permissions

• Audit logs and regular internal reviews

• Multi-factor authentication for admin access

• Photo moderation and internal compliance review

  We never expose student data to public search engines or ad networks.

 

7. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the data we hold about you or your child

• Correct inaccurate or outdated data

• Request deletion of your account or associated child data

• Withdraw consent for optional data use (e.g., images)

• File a complaint with your local data protection authority

If you are a parent or guardian, you may request a full copy of the data we’ve collected about your child. You may also review and request changes or deletions to that data. See the contact instructions at the bottom of this page.

To make a request, email us at [email protected]. We may verify your identity before acting on your request.

7.1 EU/UK Users

You may also request:

• Data portability

• Processing restrictions

• The right to object to automated decisions

7.2 U.S. Users (California, Colorado, etc.)

You may request:

• Access to your personal data

• Deletion of your data

• Opt-out of sensitive data use

 

8. Marketing Preferences

Adult users can opt out of marketing communications at any time by clicking “unsubscribe” in any marketing email or by contacting [email protected].

 

9. Retention and Deletion

We retain Personal Information only as long as needed to support an educational project or deliver printed books.

If you delete your account or request deletion, Build My Story will delete or anonymize personal data within a reasonable period (typically within 30 days).

Backups are retained for a limited time and are cycled out on a rolling basis (typically within 90 days).

Inactive classrooms or projects may be deleted or anonymized after 12 months of inactivity.

 

10. International Transfers

Build My Story is based in the United States, but we serve users worldwide. If you are located in the EU, UK, or other regions with data transfer restrictions, we use lawful mechanisms to transfer personal data, including Standard Contractual Clauses (SCCs) where required.

Your data may be processed in the United States and in other countries where our service providers operate, including the EU and UK.

You may request information about our data transfer safeguards by contacting Build My Story. Build My Story also applies appropriate technical and organizational measures to protect personal data transferred internationally.

 

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the “Last Updated” date

• Notify you via email or through the platform if the changes are significant

  Continued use of our Services after any updates constitutes acceptance of the updated terms.

12. Contact Us

Build My Story, Inc.
8 The Green, Dover, DE 19901
United States

📧 [email protected]
📞 +1 (805) 817-3175