Privacy Policy

Happy Little Stories (“we”, “us”) decides how and why your personal data is used, so we are the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023, and the body corporate responsible for it under the Information Technology Act, 2000.

This policy follows the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as they come into force; and the Consumer Protection (E-Commerce) Rules, 2020. Our Terms of Service cover the rest of our agreement with you.

You can ask for this policy in English or in any language listed in the Eighth Schedule to the Constitution of India. Write to us (section 15) and we'll send it.

Our service is for parents and legal guardians who are 18 or older. Children don't use it and can't have an account. If you are under 18, please don't use it.

Please give us details and photos only of a child you are the parent or legal guardian of.

• Your account

  Details: Your name, email address, phone number, your relation to the child, and your password (our sign-in provider stores it only in scrambled, hashed form; nobody at Happy Little Stories can see it).

  Where it comes from: You, when you sign up

• Your child's details

  Details: Your child's name, age and gender, and the theme and lesson you pick for each story. If you choose to add them: what your child is like, a favourite toy, favourite places, the visual style, and a pet or toy's name and description.

  Where it comes from: You

• Photos

  Details: One photo of your child's face and, if you add one, a photo of their pet or toy.

  Where it comes from: You

• What we make

  Details: Your child's cartoon character, the stories, the narration, the videos and their thumbnails.

  Where it comes from: Us, with the help of AI services (section 6)

• Your consent

  Details: What you agreed to, the version of the wording, and when.

  Where it comes from: Recorded when you tick the consent box

• Payments

  Details: The plan, the amount, the date, and Razorpay's payment and order references and status. We never receive your card number, CVV, UPI PIN or bank login: Razorpay handles them.

  Where it comes from: You and Razorpay

• Messages

  Details: What you write to us, and our replies.

  Where it comes from: You

• Technical data

  Details: Your IP address, browser and device type, the pages you visit, and error logs.

  Where it comes from: Collected automatically when you use the website

Your password is “sensitive personal data” under the 2011 Rules. We don't collect your child's school or address, and we don't use the photo to identify or recognise anyone.

You can choose not to give us any of this. But we need the account details, your child's name, age and photo (or a cartoon we already made) and a theme and lesson to make the videos. Gender is optional: you can choose “Prefer not to say”.

We use personal data only for these purposes:

• to create your account and sign you in;
• to write the stories, draw your child's cartoon, and make, check and deliver the videos;
• to take payments, give refunds, and keep the accounts and tax records the law requires;
• to answer your messages and complaints, fix problems and remake videos;
• to keep the service safe and working: preventing fraud and misuse, and fixing errors;
• to count visits to the website, without cookies, so we can improve it;
• to tell you about your orders, for example if a video is delayed.

We use your child's data because you, as their parent or legal guardian, consent to it. We use your own data with your consent and, where the law allows, for the legitimate uses the Digital Personal Data Protection Act, 2023 lists (for example, to comply with the law).

We never:

• sell or rent personal data;
• show ads on our website, or use your child's data for advertising or marketing;
• use your child's photo or details to train AI models;
• track or profile children, or direct advertising at them;
• show your child's photo, cartoon or videos publicly or in our marketing, unless you give us separate written permission.

We don't send marketing emails. If we ever want to, we'll ask you first.

We use a child's personal data only with the verifiable consent of their parent or legal guardian, as section 9 of the Digital Personal Data Protection Act, 2023 requires. When you add a child, you confirm that you are their parent or legal guardian and 18 or older, and you tick a box to agree to how we use the photo and details. We record what you agreed to, the version of the wording, and when.

We may ask you to confirm your identity and that you are an adult before we use your child's data, in the ways the law allows (for example, with details you have already given us, or an age check through DigiLocker).

We use your child's data only to make, deliver and support their videos, never in a way likely to harm their well-being. Children never sign in or use our website.

You can withdraw your consent at any time (section 12). When your child turns 18, they can use these rights themselves.

We use AI services to write the stories, turn the photo into a cartoon, draw the scenes, animate them and narrate them. Each service gets only what its step needs, and only to do that work for us (section 7).

AI can make mistakes. That's why you read the stories before you pay, and why every video is checked before it's released: an automatic check looks through each video, and any video it is unsure of waits for a person on our team to approve it.

Inside our company, only the people who make, check and support orders can see your child's details, photo and videos, and only for that work.

We share personal data only with the service providers that help us run the service (our “Data Processors”), only what each one needs, and only so they can do work for us. These are our providers today:

• Supabase

  What they do for us: Database, file storage and sign-in

  What they receive: All the data in section 3

• Vercel

  What they do for us: Hosts the website and counts visits without cookies

  What they receive: Technical data, and what you send through the website

• Our video server (a cloud server we rent)

  What they do for us: Makes the videos

  What they receive: Your child's details and photo, the cartoon, the stories and the videos

• OpenAI

  What they do for us: Writes the stories, draws the cartoon and the scenes, and checks video frames

  What they receive: Your child's details and photo, the stories, and pictures from the videos

• fal.ai

  What they do for us: Animates the scenes

  What they receive: The cartoon pictures and descriptions of each scene

• ElevenLabs

  What they do for us: Narration and character voices

  What they receive: The stories' text, including your child's name

• Google (YouTube)

  What they do for us: Hosts and plays the videos

  What they receive: The videos, their titles and descriptions (which include your child's name), and their thumbnails

• Razorpay

  What they do for us: Takes payments and gives refunds

  What they receive: Your email and phone number, the amount, and the payment details you give Razorpay

• Our email provider

  What they do for us: Sends our team emails about orders

  What they receive: Your child's name, the story title and order references

These providers process data under their own business terms and privacy policies. Some keep data for a limited time, for example to detect misuse. If we add or change a provider, we'll update this list.

We may also share personal data when:

• the law requires it, for example a court order or a request from a government agency that the law allows to ask for it;
• it is needed to protect someone's safety, or to prevent or report a crime;
• our business is transferred to another company, which must then keep the promises in this policy.

Some of our providers, including OpenAI, fal.ai, ElevenLabs, Google and Vercel, store or process data in the United States or other countries outside India. Indian law allows this, except to countries the Government of India restricts; we don't use providers in a restricted country.

We choose providers that protect data with strong security. When you tick the consent box, you agree to your child's data being processed outside India for the purposes in this policy.

Your child's videos are uploaded to our YouTube channel as unlisted and made for kids:

• Unlisted means they don't appear in YouTube search or on our channel. Only people who have the link can watch. Anyone you give the link to can pass it on, so please share it only with people you trust.
• Made for kids means YouTube turns off comments and personalised ads on them. YouTube may still show its own ads under its terms; we don't choose them.

Your My Videos page plays them in YouTube's privacy-enhanced mode (youtube-nocookie.com). When anyone watches a video, Google's privacy policy applies to what YouTube collects. We can delete a video from YouTube whenever you ask.

• Your account

  While your account is open. We delete it within 30 days of your asking us to close it.

• Your child's details, photos and cartoon

  While your account is open, so you can order more stories without uploading again and so we can fix or remake a video. We delete them within 30 days of your asking, or after 3 years with no activity on your account (we'll tell you before).

• Working files on our video server (scene pictures, sound clips)

  Deleted automatically after about 7 days.

• Finished videos

  On YouTube and in our storage while your account is open, or until you ask us to delete them.

• Records of your consent

  For as long as we keep your child's data, and then for up to 3 years, to show we had your consent.

• Payment records

  For as long as tax and accounting laws require (up to 8 years).

• Messages

  Up to 3 years after your question or complaint is closed.

• Technical logs

  For limited periods, set by our providers and by the law.

When the reason for keeping data ends, we delete it, or remove what identifies you or your child, unless a law requires us to keep it.

• Everything you send us travels over encrypted (HTTPS) connections.
• Photos, cartoons and videos are kept in private storage that isn't open to the public.
• Access rules let each parent see only their own family's data.
• Only the team members who need it can reach your data, with their own sign-in.
• Card, UPI and bank details are handled by Razorpay, never by us.

No method of storing or sending data is completely secure. If a personal data breach affects you, we will tell you, and the authorities, as Indian law requires.

For your own data, and for your child's, you can ask us to:

• give you a summary of the personal data we hold, what we do with it, and who we have shared it with;
• correct, complete or update it;
• delete it (we will keep only what the law requires, such as payment records);
• withdraw your consent, as easily as you gave it. We then stop using the data for that purpose and delete it. We can't make more videos without it, and what was done before stays lawful;
• answer a complaint (section 15);
• let someone you nominate use these rights for you if you die or can't act yourself.

To ask, write to us at support.hls@gmail.com from the email address on your account, so we know it's you. We may ask you to confirm your identity. We reply within one month.

Please give us true information, and don't make requests or complaints in someone else's name or that you know are false: the law asks this of everyone.

If you are not satisfied with our answer, you can also complain to the Data Protection Board of India once its complaint process starts (expected in May 2027).

• Sign-in: we use essential cookies to keep you signed in. The website can't work without them.
• Visit counts: Vercel Web Analytics counts visits without cookies and without following you across other websites.
• Payments: Razorpay's checkout loads on the page where you pay. Razorpay may use cookies or device information to keep payments safe, under its own privacy policy.
• Videos: YouTube's privacy-enhanced player doesn't set cookies until a video is played.

We don't use advertising or social media cookies or trackers. You can block cookies in your browser, but you then can't sign in.

When we change this policy, we'll publish the new version here with a new effective date. If a change affects how we use your or your child's data, we'll tell you by email or on the website before it applies and, where the law requires, ask for your consent again.

For any question, request or complaint about your personal data, write to us. We acknowledge every complaint within 48 hours, with a copy of your complaint as we recorded it, and resolve it within one month of receiving it.