Privacy policy

Preamble

This privacy policy describes how Timothé Duc, publisher of Plume ("Plume", "we"), collects, uses and protects the personal data of users of the plume-story.com website. Plume is aimed at parents and responsible adults, not directly at children.

Data controller

The data controller is Timothé Duc, sole trader — 358 Les Grands Champs, 07340 Limony, France. For any question about your data: contact@plume-story.com.

Data collected

For the parent account:

• Credentials: email, hashed password, first name (optional).
• Social sign-in (optional): Apple or Google ID, limited to your identity (no access to the content of your other apps).
• Technical data: device and browser type, operating system, language, IP address, audience-measurement data (collected only with your consent).
• Billing data: Stripe customer ID and subscription status, payment history. Plume never sees or stores your card number, which is handled directly by Stripe.

For child profiles, created by the parent:

• First name, age, interests, familiar characters, avatar. These profiles are created and managed by the parent; the child has no account of their own.
• Generated stories (text, images, audio), linked to the parent account.

Purposes of processing

Data is processed in order to:

• provide the Plume service (account creation, story generation, illustrations, audio narration, storage);
• share with AI providers the information needed to generate your stories, images and voices;
• manage billing and subscriptions through Stripe;
• improve service quality (aggregated, anonymous statistics only);
• contact you in case of incident or significant change, and comply with our legal and tax obligations.

Legal bases

Depending on the purpose, processing is based on contract performance (article 6.1.b GDPR), free and revocable consent (article 6.1.a) or legitimate interest (article 6.1.f).

Recipients and sub-processors

To provide the service, Plume relies on sub-processors and providers that may receive certain data:

• Artificial-intelligence providers — Mistral AI, OpenAI and Google — which receive the information needed (creation prompts, the character's first name and traits) to generate the text, images and voices of your stories.
• Stripe, for secure payment processing and subscription management.
• OVH, our hosting provider, for data storage.
• Audience-measurement tools (Google Analytics 4, Microsoft Clarity, Google Ads), only with your consent.

Some of these providers (notably OpenAI and Google) may process data outside the European Union; such transfers are framed by appropriate safeguards (standard contractual clauses). Plume never sells your data and does not use it for targeted advertising.

Your rights

Under GDPR, you have a right of access, rectification, erasure, restriction, objection and portability. You can exercise these rights at contact@plume-story.com. Any complaint can also be filed with the CNIL.

Retention periods

• Account data: as long as the account is active, then deleted within 30 days after closing.
• Stories: kept in your account as long as you do not delete them.
• Billing data: kept for as long as required by our accounting and tax obligations.
• Technical logs: 12 months.

A question?

Write to us at contact@plume-story.com. We reply within 30 days, in line with GDPR.