Privacy Policy

Last Updated: June 01, 2026

My Story Tech Teknoloji Ltd ("we," "us," or "our") operates the kidtohero.com website and service (the "Service"). This Privacy Policy explains how we collect, use, and protect your personal data.

1 Data Controller

For the purposes of the Turkish Personal Data Protection Law (KVKK) and the EU General Data Protection Regulation (GDPR), the Data Controller is:

Company Name: My Story Tech Teknoloji Ltd

Address: Kuştepe mahallesi mecidiyeköy yolu caddesi no 12 daire 3101 Trump Towers Residance Şişli / İSTANBUL

Phone: +90 542 280 8197

Email: privacy@kidtohero.com

2 Data We Collect, Purpose, and Legal Basis

We collect and process your data for specific purposes and rely on a legal basis for each activity, as required by law.

Data Category	Purpose of Processing	Legal Basis
Account Data	To create and manage your account, authenticate you, and provide customer support.	Performance of a contract
Payment Data	To process your subscription payments, manage subscriptions, and prevent fraud. We do not store your credit card number.	Performance of a contract; Legal obligation
User Input (Prompts & Character Photos)	To process your request and generate the AI Output (the story) for you. Character photos are sent to our AI provider solely to generate the illustrated character and are not retained for any other purpose. You may upload any photo of your choice as a character reference — it does not have to be a photo of a child.	Performance of a contract
AI-Generated Output	To provide the Service and allow you to access, edit, and save your generated stories.	Performance of a contract
Usage Data	To monitor the usage of our Service, ensure security, identify technical issues, and improve Service performance.	Legitimate interest; Performance of a contract

3 How We Use Your Data for AI

Our commitment to your data privacy:

We DO NOT use your "Input" (prompts) or "Output" (stories) to train our AI models or any third-party AI models.
Your Inputs and Outputs are processed exclusively for the purpose of providing the story generation Service to you as part of our contract.
We treat your Inputs and Outputs as confidential information.

4 Data Sharing and Disclosure

We do not sell or rent your personal information to third parties. We only share your data with the following categories of service providers who assist us in delivering our services:

Payment Processors: To process your payments. These partners are PCI DSS compliant and handle your sensitive payment data.
Infrastructure Providers: We use cloud hosting providers (e.g., AWS, Azure) to host our Service.
Third-Party AI Providers: If we use a third-party AI provider (e.g., OpenAI, Anthropic) to help generate content, we will only send your Input to them for processing. We have contractual agreements with these providers that prohibit them from using your data for their own purposes or for model training.

5 Children's Privacy & Our Commitments for the Kids Category

KidToHero is designed to be enjoyed by children with the active supervision of a parent or legal guardian. Accounts may only be created and managed by an adult (aged 18+). Children are never asked to create an account, enter payment information, or interact with the app without an adult present. We do not knowingly allow children under 13 to sign up or provide any personal information directly. In line with the U.S. Children's Online Privacy Protection Act (COPPA), the Apple App Store Kids Category guidelines, and Google Play's Families policy, we commit to the following:

We do NOT use third-party analytics SDKs or advertising networks inside the app. No tracking identifiers are collected or shared with advertisers.
We do NOT display third-party ads. We do NOT send marketing communications to children.
Sensitive actions (purchases, account deletion, profile deletion, PIN changes) are protected by a parental gate (a 4-digit parent PIN) and cannot be performed by a child acting alone.
The only photo we process is the "character photo" that the parent chooses to upload. This photo does NOT have to be a photo of the child — parents are free to upload any image they prefer (for example, a toy, a drawing, or an age-appropriate stock illustration) as the visual reference for the story's main character.
Character photos are sent to our AI illustration provider solely to generate the book's illustrations. The provider is contractually prohibited from retaining, sharing, or using the photo to train their models.
A parent may delete a child profile, any uploaded character photo, any generated story, or their entire account at any time from within the app. Deletion requests are processed within 30 days.
If you believe a child has submitted information to us without parental consent, please contact privacy@kidtohero.com and we will delete that information promptly.

6 Data Security and Retention

We implement industry-standard technical and organizational measures to protect your personal data, including SSL encryption for data in transit and encryption for sensitive data at rest. We retain your personal data only for as long as necessary to fulfill the purposes for which we collected it or as required by law.

7 Your Data Protection Rights

Depending on your location, you have certain rights regarding your personal data. Under Turkish Law (KVKK Article 11) and GDPR, these rights include:

Right to Access: Request access to the personal information we hold about you.
Right to Correction: Request correction of inaccurate or incomplete data.
Right to Deletion (Right to be Forgotten): Request the deletion of your personal data.
Right to Object: Object to our processing of your data, particularly for marketing.
Right to Data Portability: Request a copy of your data in a machine-readable format.

To exercise these rights, please contact us at: privacy@kidtohero.com

Have Questions?

If you have any questions about our Privacy Policy or how we handle your data, please contact us.