Privacy Policy
Last updated: 18 April 2026
This Privacy Policy explains how Elana Tales ("we", "us", "the Provider") collects, uses and protects your information when you use the Elana Tales service ("the Service") at elanatales.com. Please also read our Terms of Service, which govern your use of the Service.
We are the data controller for the personal data described in this policy. We are based in the United Kingdom and process data within the UK.
1. Data We Collect
1.1 Account Data
When you register, you provide your email address or we receive it from your authentication provider (for example Google or Apple). We use your email to:
- authenticate you and manage your account;
- notify you when new episodes are available in your adventures.
1.2 Subscriber Data
If you subscribe to product updates (without registering), we save your email address at your request solely to send you product news and updates. You can unsubscribe at any time.
1.3 Usage Data
We may collect anonymised, aggregate usage data through web analytics (e.g. page views, referral sources, device type, country). We never record personally identifiable information (PII) in our analytics. We do not use analytics tools that track individual users across sessions or across websites.
1.4 Generated Content
Your adventures, episodes, choices and audio files are stored in our database to deliver the Service. These are generated by third-party AI providers on our behalf (see Section 5).
1.5 Important: Do Not Submit Personal Data as Content
Do not include personal data in any names or text you enter into the Service. When you name an adventure, a hero, a companion or any other in-game element, that text may be transmitted to third-party AI providers to generate story content. Use fictional names and avoid entering real names, addresses, phone numbers, health information or any other personal data in these fields.
2. Cookies
We do not use tracking cookies.
We use a single, strictly necessary cookie: a session cookie that is required for the site to function (keeping you logged in and managing your session state). This cookie does not track you and is deleted when your session expires or you log out.
Because this cookie is strictly necessary for the operation of the Service, consent is not required under PECR (Privacy and Electronic Communications Regulations 2003).
3. Lawful Basis for Processing
Under UK GDPR, we process your personal data on the following bases:
| Purpose | Lawful Basis |
|---|---|
| Account creation and authentication | Performance of a contract (Article 6(1)(b)) |
| Episode notifications | Performance of a contract (Article 6(1)(b)) |
| Product update emails (subscribers) | Consent (Article 6(1)(a)) |
| Anonymised analytics | Legitimate interest (Article 6(1)(f)) |
| Session cookie | Legitimate interest (Article 6(1)(f)); exempt under PECR as strictly necessary |
4. How We Use Your Data
We use your data to:
- provide, operate and maintain the Service;
- authenticate your identity;
- send you episode notifications and, where you have consented, product updates;
- improve the Service through anonymised, aggregate analytics;
- comply with legal obligations.
We do not sell, rent or share your personal data with third parties for marketing purposes.
5. Third Parties
The Service relies on third-party providers for infrastructure, AI content generation, authentication and email delivery. We do not transmit your personal data (such as your name or email address) to these providers. Third-party AI providers generate your stories and audio based on narrative prompts that do not contain personal information.
Our key third-party categories:
- AI content generation — generates episode text and audio (no PII transmitted);
- Cloud hosting and storage — hosts the Service and stores generated content;
- Authentication — manages sign-in (your email is shared with the auth provider for login);
- Email delivery — sends transactional emails (your email address is shared for delivery only).
6. Data Retention
We retain your account data and generated content for as long as your account is active. If you request deletion, we will remove your personal data within 30 days (see Section 8).
Anonymised analytics data does not contain personal data and may be retained indefinitely.
7. Data Security
We use industry-standard technical and organisational measures to protect your data, including encryption in transit (TLS) and secure database access controls. However, no method of transmission or storage is 100% secure and we cannot guarantee absolute security.
8. Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you;
- Rectification — request correction of inaccurate data;
- Erasure — request deletion of your personal data;
- Restriction — request that we limit processing of your data;
- Portability — request your data in a structured, machine-readable format;
- Object — object to processing based on legitimate interest;
- Withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email us at team@elanatales.com. We will respond within 30 days.
To delete your data and account: email team@elanatales.com with the subject line "Delete my data".
9. International Transfers
Your data is primarily processed and stored in the United Kingdom. Some third-party providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or adequacy decisions recognised by the UK Government.
10. Children
The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice. The "Last updated" date at the top indicates the most recent revision.
12. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
13. Contact
For any questions about this Privacy Policy or your data, contact us at team@elanatales.com.