Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you create an account, make a purchase, or use our service.

a) Account Information

• Email address
• Password (stored in encrypted form — we never see your plain password)
• Account preferences

b) Child Information

To personalize your child's magical call experience, we collect:

• Child's first name — used during the call so the character can greet them by name
• Zip code — used to assign a local phone number for inbound calls (so your child dials a familiar area code)
• Parent/guardian relationship type

c) Call Information

• Call transcripts — the text conversation between your child and the character
• Call recordings (when purchased) — audio recording of the call
• Call duration and timestamps

d) Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers on our servers. We retain only the Stripe session ID, payment intent ID, amount, currency, payment status, and the email address associated with the payment for record-keeping.

e) Birthday Call Survey Information

If you purchase a Birthday Magic Call, you may submit additional details so the character can personalize the call:

• Character persona choice, custom persona name, and description
• Your child's age, interests, favorite things, and birthday date
• Birthday theme, special messages, additional details, and preferred tone and language

This information is used only to build and perform your child's character call. It is not used for advertising or profiling.

f) Referral Information

If you use the referral program, we store:

• Your referral code and the number of verified referrals attributed to you
• For invitations you create: the name and email address of the person you invited, the language you chose for the invitation, and its status (shared, emailed, signed up, credited, bounced, or unsubscribed)
• Referral credit is granted only after the invited person verifies their own email address

Important: the name and email address of an invited person is personal information about them, and we hold it on the basis of your instruction. We use it only to create the invitation you requested, to credit you if that person verifies their account, and to suppress undeliverable addresses. If the person you invited would rather not hear from us, they can contact us to be removed.

g) Technical Data

• IP address
• Browser type and device information
• Cookies and session tokens for authentication
• Page visits: the pages you view, the referring site or search engine, search terms, and how long you spend on a page
• Signals used for fraud and abuse prevention, such as sign-up IP, signup source, and a risk score

---

2. How We Use Your Information

• Delivering the service — connecting your child's call with the chosen character
• Personalization — using your child's name and preferences during calls
• Communication — sending order confirmations, call-ready notifications, and transcripts
• Improving our service — analyzing call quality and duration to improve the experience
• Account management — authentication, order history, and customer support
• Running the referral program — crediting free call credits when an invited person verifies their email

---

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We share data only with:

• Twilio — to place and receive phone calls (phone numbers, call routing data)
• ElevenLabs — to generate character voices during calls (child's first name, character prompt)
• Stripe — for payment processing (order amount, payment identifiers, no card data)
• Resend — to send transactional emails (email address, name)
• Service providers — hosting, analytics, and infrastructure as needed

Each provider is bound by their own privacy obligations and data processing agreements.

---

4. Data Retention

• Account data — retained for the life of your account
• Call transcripts — retained while your account is active. Transcripts are not automatically deleted after a fixed period; you can delete an individual call or your whole account at any time
• Audio recordings — the download link expires 7 days after the call and is limited to 10 downloads. The recording itself is stored on our servers and is removed when you delete the call or your account
• Page visit and analytics records — retained for up to 24 months, then deleted
• Referral invitation records — retained for the life of your account, so that credited referrals remain auditable
• Payment records — retained for 7 years as required by financial regulations

---

5. Data Security

We take reasonable measures to protect your data, including:

• All data transmitted over HTTPS/TLS encryption
• Passwords stored using bcrypt hashing (never in plain text)
• Session tokens use cryptographic signing
• Database access restricted to authenticated application servers
• Regular security reviews and infrastructure updates

---

6. Children's Privacy

Magic Moments is designed for children's calls, and we take children's privacy especially seriously:

• We collect only what is needed to personalize and route the call: first name, and zip code if you choose an inbound number. If you add a birthday call you may also provide age, interests, and birthday details
• Call transcripts and recordings are accessible only to the parent/guardian account holder
• We do not use children's data for advertising or profiling
• AI characters are programmed with safety guardrails: they never ask for personal information (address, school, phone number)
• Parental consent is required before any call is placed

---

7. Your Rights

You have the right to:

• Access — request a copy of all data we hold about you
• Correction — update or correct your personal information at any time through your dashboard
• Deletion — request permanent deletion of your account and all associated data
• Data portability — request your call transcripts and recordings in a downloadable format
• Opt-out — unsubscribe from any non-transactional communications

To exercise any of these rights, contact us at support@magicmomentslab.app.

---

8. Cookies

We use a small number of first-party cookies, all set by us:

• Session cookie — keeps you logged in as you navigate the site
• CSRF token — protects forms against cross-site request forgery
• Language cookie — remembers your language choice so the site loads in the right language
• Analytics session ID — a random identifier used to group page visits into a session for aggregate site statistics

We do not use advertising cookies, cross-site tracking cookies, or third-party tracking cookies. You can clear or block cookies in your browser; blocking the session cookie will prevent you from staying logged in.

---

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you by email if material changes are made. Continued use of the service after changes constitutes acceptance of the updated policy.

---

10. Contact

If you have questions about this privacy policy or our data practices, please contact us at:

support@magicmomentslab.app

Magic Moments
2881 Northeast 32nd Street
Ft Lauderdale, FL 33306

If you have questions about the terms governing your use of the Service, see our Terms of Service.