2. What Information We Collect

2.1 Information You Provide to Us

We collect Personal Information you directly provide during use of our Services, including when you:

• Create a licensed teacher or parent account

• Submit or approve child data

• Upload photos or story content

• Order printed books

• Contact support

The types of Personal Information we may collect include:

• Full name

• Email address

• Role (licensed teacher, parent, org leader)

• School or group affiliation

• Mailing address (for print delivery)

• Billing details (handled securely by Stripe)

• Child first names (only when added by an adult)

• Child photos or goals (optional, with verified consent)

• Written stories, titles, or prompts you or a child submits

Note: We do not allow children to input or share identifiable data independently.

Parental Consent: For users under the age of digital consent (13–16 depending on jurisdiction), we require verifiable parental or guardian consent before collecting or processing any personal data, including names or photos.

If you upload a child’s photo to create an avatar, the image may be processed by AI tools to generate a likeness. While we do not store biometric templates, the processing of facial geometry may qualify as biometric data under certain state laws (e.g., BIPA).

Even when not directly named, a combination of details (e.g., school name, photo, and first name) may still identify a child. We treat these indirect identifiers as protected personal information.

2.2 Information Collected Automatically

When you use our Services, we and our vendors collect limited device and usage data, including:

• IP address

• Device type and operating system

• Browser type

• Page interactions (e.g., buttons clicked)

• General location based on IP

• Error or crash logs

• Authentication and session data

We use cookies and similar tools (e.g., pixels, SDKs) to keep you signed in, understand feature usage, and maintain platform security.

In EU and UK jurisdictions, non-essential cookies are disabled unless explicitly allowed by you.

2.3 Information from Third Parties

We may receive personal data from third-party services you choose to connect with, such as:

• Google Login or Microsoft Sign-In

• School rostering tools

• AI generation providers

These services are governed by their own privacy policies. When used, they pass limited data (e.g., name, email) to us under your control.

3. How We Use Your Information

We use Personal Information only as needed to operate, maintain, and improve the Services. This includes:

• Account creation and user authentication

• Generating personalized storybooks

• Delivering printed books or emails

• Supporting your use and troubleshooting issues

• Maintaining educational records for schools

• Notifying you of updates, reminders, or system changes

• Complying with legal obligations (e.g., FERPA, COPPA, GDPR)

• Analyzing anonymized usage data to improve the platform

We do not use Personal Information for ad targeting or profiling.

Printed books ordered by adults may include children’s data. This is considered commercial use and requires explicit adult consent. We only proceed with book printing when initiated and authorized by an adult user.

4. Legal Bases for Processing

We process your Personal Information under the following legal bases:

• Consent – When you explicitly authorize data collection (e.g., uploading a student photo)

• Contractual necessity – To deliver your requested services

• Legitimate interests – To maintain secure operations, analyze usage trends, and improve features

• Legal obligation – To comply with education privacy laws such as COPPA, FERPA, and GDPR

If you are located in the EU, UK, or other jurisdictions with data protection laws, you have additional rights outlined in Section 7.

By checking the consent box during signup or before use, you affirm that you are an authorized adult (parent, guardian, teacher) and that you’ve read and agreed to this Privacy Policy.

5. How We Share Your Information

We do not sell or rent Personal Information. We share it only when necessary to deliver our Services or comply with legal requirements.

5.1 Service Providers

We work with trusted service providers—such as cloud storage providers, AI content tools, and print fulfillment partners—who help us operate the platform. These providers only process information on our behalf under strict contractual safeguards. You may request a full list of service providers at any time using the contact information at the bottom of this page.

5.2 Schools and Verified Organizations

When a licensed teacher or organization sets up a classroom, data is visible only to verified adult users managing that group. Parents cannot access other students’ information.

Even when not directly named, a combination of details (e.g., school name, photo, and first name) may still identify a child. We treat these indirect identifiers as protected personal information.

5.3 Legal Requirements

We may disclose information if we believe it is necessary to:

• Comply with applicable laws (e.g., FERPA, COPPA, GDPR)

• Respond to lawful requests by public authorities

• Protect the safety or rights of users, schools, or the public

• Enforce our Terms of Use

5.4 Cross-Role Visibility

Licensed teachers and verified guardians linked to the same project may view each other’s submitted content and associated classroom progress. No one can access another child’s data unless explicitly invited.

5.5 Public or Voluntary Visibility

No student or classroom data is visible to the public. If adults voluntarily join promotional campaigns, referral programs, or leaderboard-style features, only non-sensitive information (e.g., name, state, role) will be shown, and only with opt-in.

We will never publicly display, publish, or promote your or your child’s content for marketing or promotional purposes without a separate opt-in. Use in case studies, flyers, or other public-facing materials requires distinct and verifiable consent.

5.6 Business Transfers

If Build My Story is involved in a merger, acquisition, or asset sale, Personal Information may be transferred to the acquiring entity under equivalent data protection terms. We will notify users before such transfers.

Printed books ordered by adults may include children’s data. This is considered commercial use and requires explicit adult consent. We only proceed with book printing when initiated and authorized by an adult user.

6. How We Protect Your Information

We implement a layered security approach, including:

• TLS encryption for all data in transit

• Encryption at rest using industry best practices

• Access controls and role-based permissions

• Audit logs and regular internal reviews

• Multi-factor authentication for admin access

• Photo moderation and internal compliance review

  We never expose student data to public search engines or ad networks.

7. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the data we hold about you or your child

• Correct inaccurate or outdated data

• Request deletion of your account or associated child data

• Withdraw consent for optional data use (e.g., images)

• File a complaint with your local data protection authority

If you are a parent or guardian, you may request a full copy of the data we’ve collected about your child. You may also review and request changes or deletions to that data. See the contact instructions at the bottom of this page.

To make a request, email us at [email protected]. We may verify your identity before acting on your request.

7.1 EU/UK Users

You may also request:

• Data portability

• Processing restrictions

• The right to object to automated decisions

7.2 U.S. Users (California, Colorado, etc.)

You may request:

• Access to your personal data

• Deletion of your data

• Opt-out of sensitive data use

8. Marketing Preferences

Adult users can opt out of marketing communications at any time by clicking “unsubscribe” in any marketing email or by contacting [email protected].

9. Retention and Deletion

We retain Personal Information only as long as needed to fulfill the educational project or book delivery.

• When you delete your account or request deletion, we erase or anonymize personal data within 30 days

• Backups are removed within 90 days

• Classrooms or projects that remain inactive for over 12 months are automatically purged

10. International Transfers

Build My Story is based in the United States, but we serve users worldwide. If you are located in the EU, UK, or other regions with data transfer restrictions, we ensure that:

• Data transfers use Standard Contractual Clauses (SCCs)

• Or the vendor is certified under the EU–US Data Privacy Framework

Your data may be processed in the United States and in other countries where our service providers operate, including those in the EU and UK.

You may request a copy of our data transfer agreements by contacting us.
We also implement supplemental technical and organizational safeguards for data transferred internationally.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the “Last Updated” date

• Notify you via email or through the platform if the changes are significant

  Continued use of our Services after any updates constitutes acceptance of the updated terms.

12. Contact Us

Build My Story, Inc.
8 The Green, Dover, DE 19901
United States

📧 [email protected]
📞 +1 (805) 817-3175