Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you create an account, make a purchase, or use our service.

a) Account Information

• Email address
• Password (stored in encrypted form — we never see your plain password)
• Account preferences

b) Child Information

To personalize your child's magical call experience, we collect:

• Child's first name — used during the call so the character can greet them by name
• Zip code — used to assign a local phone number for inbound calls (so your child dials a familiar area code)
• Parent/guardian relationship type

c) Call Information

• Call transcripts — the text conversation between your child and the character
• Call recordings (when purchased) — audio recording of the call
• Call duration and timestamps

d) Payment Information

Payment processing is handled by Shopify. We do not store credit card numbers on our servers. We retain only the order ID and payment status for record-keeping.

e) Technical Data

• IP address
• Browser type and device information
• Cookies and session tokens for authentication

---

2. How We Use Your Information

• Delivering the service — connecting your child's call with the chosen character
• Personalization — using your child's name and preferences during calls
• Communication — sending order confirmations, call-ready notifications, and transcripts
• Improving our service — analyzing call quality and duration to improve the experience
• Account management — authentication, order history, and customer support

---

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We share data only with:

• Twilio — to place and receive phone calls (phone numbers, call routing data)
• ElevenLabs — to generate character voices during calls (child's first name, character prompt)
• Shopify — for payment processing (order details, no credit card data)
• Resend — to send transactional emails (email address, name)
• Service providers — hosting, analytics, and infrastructure as needed

Each provider is bound by their own privacy obligations and data processing agreements.

---

4. Data Retention

• Account data — retained for the life of your account
• Call transcripts — retained for 1 year, then deleted unless you choose to keep them
• Audio recordings — available for download for 7 days after the call, then permanently deleted
• Payment records — retained for 7 years as required by financial regulations

---

5. Data Security

We take reasonable measures to protect your data, including:

• All data transmitted over HTTPS/TLS encryption
• Passwords stored using bcrypt hashing (never in plain text)
• Session tokens use cryptographic signing
• Database access restricted to authenticated application servers
• Regular security reviews and infrastructure updates

---

6. Children's Privacy

Magic Moments is designed for children's calls, and we take children's privacy especially seriously:

• We collect only the minimum information needed (first name, zip code) to personalize and route the call
• Call transcripts and recordings are accessible only to the parent/guardian account holder
• We do not use children's data for advertising or profiling
• AI characters are programmed with safety guardrails: they never ask for personal information (address, school, phone number)
• Parental consent is required before any call is placed

---

7. Your Rights

You have the right to:

• Access — request a copy of all data we hold about you
• Correction — update or correct your personal information at any time through your dashboard
• Deletion — request permanent deletion of your account and all associated data
• Data portability — request your call transcripts and recordings in a downloadable format
• Opt-out — unsubscribe from any non-transactional communications

To exercise any of these rights, contact us at support@magicmomentslab.app.

---

8. Cookies

We use only essential cookies:

• Session cookie — keeps you logged in as you navigate the site
• We do not use tracking cookies, advertising cookies, or third-party analytics cookies

---

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you by email if material changes are made. Continued use of the service after changes constitutes acceptance of the updated policy.

---

10. Contact

If you have questions about this privacy policy or our data practices, please contact us at:

support@magicmomentslab.app