Privacy Policy

1. Information We Collect

We collect information to provide and improve Malu (“the Services”). Below is a summary of the types of information we collect:

Information You Provide

Information Collected Automatically

• Usage information (features accessed, session duration)
• Device information (model, OS version)
• Log information (error reports, crash logs)
• Performance data (app load times, responsiveness)

Information from Third Parties

• Payment processor confirmations (Apple, Google, Stripe)
• Aggregated analytics data

2. Where your stories are generated

When you create a story, the description you write is sent to third-party AI providers who write the story, narrate it as audio, and generate its cover image. These providers are OpenRouter, Speechify and fal.

These providers are located outside the European Economic Area, principally in the United States. This means the descriptions you write, and the stories generated from them, are transferred outside the EEA. We rely on the European Commission’s Standard Contractual Clauses as the legal basis for these transfers.

Your account details, subscription records and finished audio files remain within the EU. Audio is stored on Cloudflare R2 in the EU and your account data is stored on Supabase in Frankfurt, Germany.

We do not use what you write to train AI models, and our providers are contractually restricted from doing so.

3. How We Use Your Information

• Generate your stories — send your description to our AI providers so a story, its narration and its cover image can be created
• Provide and maintain Services — including storing your stories so you can play them again
• Screen requests — check what you write against our acceptable use rules before generating a story
• Process transactions — manage subscriptions through the Apple App Store, Google Play and web (Stripe)
• Personalize your experience — tailor content based on your preferences and the stories you create
• Communicate — respond to support requests and send service-related messages
• Improve and develop — analyze usage patterns to enhance the Services
• Detect and prevent fraud
• Comply with legal obligations

4. How We Share Your Information

We do NOT sell, rent, or share personal information for third-party marketing purposes.

5. Web Accounts & Sign-In

You can create an account on our website to manage your subscription. When you do, we store your email address and a hashed password. We never store your password in readable form.

• Session cookie — when you sign in, we set a cookie named sb-malu holding your session token. It is strictly necessary to keep you signed in and is not used for advertising or tracking.
• Password reset — if you ask to reset your password, we email you a time-limited link. Requesting a reset never reveals whether an account exists for that address.
• Set-password links — if you subscribe but do not choose a password, we email you a signed link that lets you set one. The link contains a token tied to your email address and expires after 7 days.

6. Data Storage and Security

We implement appropriate technical and organizational measures to protect your data:

• Account data and subscription records stored in the European Union (Frankfurt, Germany) via Supabase
• Generated audio stored on Cloudflare R2 in the EU
• Story descriptions and generated story text are processed outside the EEA by our AI providers, under Standard Contractual Clauses
• Encryption in transit (TLS/HTTPS) and at rest
• Auth tokens stored in the iOS Keychain and Android Keystore on mobile, and in a secure session cookie on the web
• Row-level security on database — users can only access their own data

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

7. Data Retention

Upon account deletion, your data will be removed within 30 days, except where retention is required by law.

8. Your Privacy Rights

You have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data
• Data Portability — Request your data in a structured, machine-readable format
• Objection — Object to the processing of your data
• Restriction — Request that we limit how we use your data
• Withdraw Consent — Withdraw your consent at any time where processing is based on consent

How to exercise your rights:

• Delete your account from your account page on the web, or in app settings
• Email privacy@opalno.com

We will respond to your request within 30 days.

9. Information for EEA, UK, and Swiss Residents

Data Controller: Opalno, Netherlands.

We process your personal data on the following legal bases:

• Contract Performance — Processing necessary to provide the Services you have subscribed to, including sending your description to our AI providers so a story can be generated
• Legitimate Interests — Analytics, moderation and service improvement, where our interests do not override your rights
• Consent — For optional data processing you have opted into
• Legal Obligations — Where we are required to process data by law

Your account data and generated audio are stored within the EU. Story descriptions and generated story text are transferred outside the EEA to our AI providers, under the European Commission’s Standard Contractual Clauses. You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Information for California Residents

Under the California Consumer Privacy Act (CCPA), California residents have additional rights:

• Right to Know — Request information about the categories and specific pieces of personal data we have collected
• Right to Delete — Request deletion of personal data we have collected
• Right to Opt Out of Sale — We do not sell your personal information
• Non-Discrimination — We will not discriminate against you for exercising your CCPA rights

Contact: privacy@opalno.com

11. Children's Privacy

Malu is not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal data, please contact us at privacy@opalno.com and we will promptly delete it.

12. Health Information Disclaimer

13. Contact Us

If you have questions about this privacy policy or your data:

Email: privacy@opalno.com

Website: opalno.com