CURRENT RELEASE: This version applies to orders offered for delivery in Ukraine. Translations and references to other markets do not mean that sales are open there.
1.ABOUT THIS POLICY
This Privacy Policy explains how VitaTale collects, uses, stores, shares and deletes personal data when people use the website and the personalised biography-book service.
The Policy is designed as one common framework for Bulgaria, Romania, Greece, Poland and Ukraine.
For users in the European Union, the General Data Protection Regulation and applicable national data protection laws apply.
For users in Ukraine, mandatory Ukrainian data protection law and other applicable rules apply.
If mandatory local law gives a person broader rights than this Policy, the mandatory local rule prevails.
2.WHO IS RESPONSIBLE FOR THE DATA
Data controller:
БИЗАР АДВЕНЧЪР ЕООД (BIZARRE ADVENTURE LTD.) Registration number: 208096271 Registered address: 26 Rodopi St., floor 3, apt. 5, Central District, Plovdiv 4000, Bulgaria Privacy email: hello@vitatale.app General contact email: hello@vitatale.app
In this Policy, "VitaTale", "we", "us" and "our" refer to the legal entity identified above.
3.WHO THIS POLICY APPLIES TO
This Policy may apply to:
- website visitors;
- buyers;
- project owners;
- primary storytellers;
- additional storytellers;
- invited participants;
- book recipients;
- affiliate applicants and affiliates;
- people who contact support;
- other people whose personal data lawfully appears in project materials.
One person may perform more than one role.
4.THE PARTICULAR NATURE OF VITATALE
VitaTale works with personal and family memories.
Those materials may include:
- childhood memories;
- family relationships;
- life events;
- places and dates;
- photographs;
- health information;
- religious beliefs;
- political views;
- information about origin;
- information about private life;
- information about other people.
For that reason, VitaTale applies a data-minimisation principle and asks users to provide only what is genuinely useful for creating the book.
A storyteller is not required to answer every question. The storyteller may:
- skip a question;
- change the subject;
- end the interview;
- stop participating.
5.PERSONAL DATA WE MAY PROCESS
5.1.Buyer information
We may process:
- name;
- email address;
- secure access information;
- order information;
- selected plan;
- number of copies;
- number of available storyteller seats;
- language;
- limited payment information;
- refund information;
- delivery information;
- support history;
- accounting information required by law.
5.2.Storyteller and participant information
We may process:
- name;
- role in the story;
- language;
- invitation information;
- records of required notices and consents;
- interview answers;
- corrections to answers;
- text produced from voice input;
- facts, events, places, people, themes and scenes extracted from the material;
- preferences;
- information about stories that should be excluded from the book;
- technical information needed to protect access.
5.3.Interview content
The storyteller decides what to share.
The content may include:
- memories;
- opinions;
- dates;
- family relationships;
- personal stories;
- descriptions of other people;
- work;
- education;
- travel;
- important events;
- photographs;
- other life circumstances.
5.4.Photographs
We may process:
- the original uploaded image;
- captions;
- technical file metadata;
- processed versions needed for layout and printing;
- information about where the photograph is used in the project.
VitaTale does not use uploaded photographs for facial recognition or biometric identification unless a separate feature of that kind is introduced in the future after an appropriate legal and privacy review.
5.5.Voice input
Voice recordings are used only to convert speech into text.
Under the current architecture:
- the original audio is not a permanent part of the project;
- it is not stored as a family audio archive;
- it is not retained in VitaTale's permanent storage;
- after processing, the project retains the text and only the minimum technical information needed for the feature.
Access and size checks are applied before processing.
Users should review the transcript because speech recognition can contain errors.
5.6.Payment information
Payments are handled by an external payment provider, currently Stripe.
VitaTale does not store:
- the full payment card number;
- the card security code;
- complete payment credentials that are needed only by the payment provider.
VitaTale may store:
- order number;
- amount;
- currency;
- payment status;
- payment transaction identifier;
- confirmed refund information;
- information needed for accounting and dispute handling.
5.7.Delivery information
We may process:
- recipient name;
- phone number;
- country;
- city;
- address;
- selected branch or parcel locker;
- selected delivery method;
- tracking number;
- delivery status.
Nova Poshta may be used for Ukrainian orders.
For other supported countries, the actual carrier and delivery method are shown during ordering.
5.8.Affiliate Program information
We may process:
- name;
- email address;
- application information;
- approval status;
- affiliate codes;
- attribution information;
- commission information;
- refund adjustments;
- payout requests;
- payout confirmation;
- necessary tax and accounting information.
5.9.Technical information
To the extent reasonably necessary, we may process:
- IP address;
- browser and device type;
- request time;
- session information;
- login attempts;
- rate-limiting information;
- technical errors;
- security events;
- referral source information;
- safe technical identifiers received from external providers.
Logs should not intentionally contain full interview text, book text, photographs, access secrets or payment secrets when the system operates as intended.
6.WHERE PERSONAL DATA COMES FROM
We may receive personal data:
- directly from you;
- from the buyer who creates the project;
- from an invited storyteller;
- from another participant in the project;
- from the payment provider;
- from the carrier;
- from the printing partner;
- from an affiliate link;
- from infrastructure providers;
- automatically when the service is used, where this is necessary for operation and security.
7.INFORMATION ABOUT OTHER PEOPLE
A biography will often mention third parties.
Users must act lawfully and in good faith.
VitaTale must not be used for:
- harassment;
- blackmail;
- unlawful publication of intimate material;
- knowingly false defamatory statements;
- unlawful disclosure of medical information;
- unlawful disclosure of information about a child;
- unlawful disclosure of criminal-conviction or offence information;
- other unlawful processing.
The fact that a user sends VitaTale information about another person does not automatically make that processing lawful.
8.SPECIAL CATEGORIES OF PERSONAL DATA
In the European Union, specially protected categories include information concerning:
- health;
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade-union membership;
- genetic data;
- biometric data used for identification;
- sex life;
- sexual orientation.
If a storyteller voluntarily provides such information about themselves, VitaTale uses only a lawful basis permitted for the relevant processing.
Where explicit consent is required, it is requested separately.
We do not encourage users to provide sensitive information about another living person unless they have a lawful basis to do so.
9.CRIMINAL CONVICTIONS AND OFFENCES
Information about criminal convictions and offences is subject to special legal rules.
A user should not provide such information about another identifiable living person unless the user has a confirmed lawful basis.
VitaTale may restrict or remove such material where continued processing would create an unjustified legal risk.
10.INFORMATION ABOUT DECEASED PEOPLE
Data protection law primarily protects living individuals, but other rules may continue to apply, including:
- family rights;
- image rights;
- confidentiality rights;
- copyright;
- other national protections.
Material about deceased people must therefore also be handled lawfully and respectfully.
11.CHILDREN AND MINORS
Purchasing VitaTale is intended for adults.
Only adults may purchase or participate directly. Adults may describe their own childhood and family memories, but VitaTale does not interview children directly in the current version.
The current VitaTale version follows this model:
- the buyer must be an adult;
- independent storyteller participation is limited to adults;
- an adult may tell stories about their own childhood;
- direct interviewing of a child is not supported unless a dedicated parental-consent and child-safeguard process has been implemented and legally reviewed.
12.PURPOSES AND LEGAL BASES
12.1.Creating and performing the order
Purposes:
- create the order;
- provide access;
- create the project;
- deliver the selected plan;
- organise printing;
- organise delivery.
Legal basis: performance of a contract or steps taken at the user's request before entering into a contract.
12.2.Creating the book
Purposes:
- conduct the interview;
- analyse answers;
- ask follow-up questions;
- structure the material;
- create the manuscript;
- edit the manuscript;
- check links between text and source material;
- prepare the final layout.
Legal basis: performance of the contract.
Where the material contains data categories that require an additional legal condition, the relevant additional condition must also be satisfied.
12.3.Payments, accounting and tax
Purposes:
- confirm payment;
- record refunds;
- maintain required financial records;
- comply with tax obligations;
- respond to payment disputes.
Legal basis: performance of the contract and legal obligations.
12.4.Security
Purposes:
- prevent unauthorised access;
- limit automated abuse;
- investigate incidents;
- prevent fraud;
- protect users and infrastructure.
Legal basis: legitimate interests in security and, where applicable, legal obligations.
12.5.Support
Purposes:
- respond to questions;
- correct errors;
- handle complaints;
- respond to data protection requests.
Legal basis: performance of the contract, legal obligations and legitimate interests in providing support.
12.6.Marketing
Marketing communications are sent only where a valid legal basis exists.
Where consent is required:
- consent is requested separately;
- the control is not pre-selected;
- consent can be withdrawn.
Opting out of marketing does not stop messages that are necessary for an active order, security or delivery.
13.ARTIFICIAL INTELLIGENCE
VitaTale uses artificial-intelligence systems for purposes such as:
- analysing responses;
- selecting follow-up questions;
- structuring memories;
- suggesting titles;
- creating an outline;
- drafting and editing text;
- checking consistency with source material;
- literary review.
Users should be clearly informed that they are interacting with artificial intelligence no later than the first such interaction, unless that fact is already obvious from the interface.
Artificial intelligence can make mistakes.
It is not:
- a notary;
- an official historical archive;
- a doctor;
- a lawyer;
- a psychotherapist;
- an independent fact-checking service.
Before production, the buyer has an opportunity to review the final manuscript.
14.OPENAI
VitaTale currently uses OpenAI services for certain artificial-intelligence functions.
VitaTale configures requests so that persistent storage is not used where the current architecture provides for that setting.
Under the current terms for OpenAI's business API services, data is not used by default to train models unless the account owner separately enables the relevant data-sharing option.
VitaTale should not voluntarily enable use of private book content for model training without:
- a separate legal assessment;
- an update to this Policy;
- consent where consent is legally required.
Actual provider retention depends on the contract, selected settings and specific service endpoint.
15.RECIPIENTS OF PERSONAL DATA
We do not sell personal data.
The following categories of recipients may be used to operate VitaTale.
15.1.Application and computing infrastructure
Hosting and computing providers.
15.2.Database infrastructure
The provider operating the database infrastructure used by VitaTale.
15.3.Private file storage
Cloudflare R2 or another approved provider for photographs, book files and technical derivatives.
15.4.Artificial intelligence and speech recognition
OpenAI or another provider that has been reviewed before use.
15.5.Payments
Stripe or another payment provider.
15.6.Email delivery
The provider used to send service emails.
15.7.Carriers
Nova Poshta for relevant Ukrainian orders and other carriers for other supported markets.
15.8.Printing partner
The printing partner receives only the files and data needed to manufacture the order.
15.9.Professional biographer or editor
An authorised professional may access the specific manuscript only to the extent needed for the purchased editorial service.
16.DATA MINIMISATION WHEN SHARING
Each provider should receive only the information required for its task.
For example:
- the payment provider does not need the manuscript;
- the carrier does not need interview text;
- the email provider does not need the full book;
- the printer does not need payment-card information;
- the artificial-intelligence provider does not need delivery details.
17.PROCESSOR AGREEMENTS
Where a provider processes personal data on behalf of VitaTale, an appropriate data processing agreement must be in place where required by applicable law.
VitaTale documents its production providers and their roles internally and updates that record when providers change.
18.INTERNATIONAL DATA TRANSFERS
Some providers may process data outside the user's country.
For users in the European Union, where personal data is transferred outside the European Economic Area, VitaTale uses a lawful transfer mechanism such as:
- an adequacy decision;
- Standard Contractual Clauses;
- another mechanism permitted by applicable law.
Additional safeguards are used where necessary.
19.RETENTION PERIODS
We do not keep personal data longer than necessary for the relevant purpose.
The retention periods currently applied by VitaTale are set out below.
19.1.Project, interviews, manuscript, photographs and book files
These are retained:
- while the project is active;
- while needed to perform the contract;
- until confirmed deletion by the user;
- or until another clearly disclosed retention period expires.
Inactive-project period: 5 years after the last meaningful project activity, with advance deletion notices where contact details remain valid
19.2.Financial and accounting records
10 years, or longer where mandatory law requires it
Where law requires longer retention, the minimum required financial information is retained separately from the private book content.
19.3.Security logs
12 months
19.4.Support records
3 years
19.5.Backups
up to 35 days
Deleted data may remain for a limited period in protected backups until the relevant backup expires, provided the backup is not used for normal day-to-day access.
20.DELETING PROJECTS AND PHOTOGRAPHS
When deletion is confirmed, VitaTale:
- deletes the active database record where appropriate;
- creates a durable technical deletion task for private file storage;
- deletes related private objects;
- retries deletion after temporary failures;
- does not keep a user project active simply because a storage cleanup step temporarily failed.
Mandatory financial, tax or security records may be retained separately in the minimum amount required by law.
21.SECURITY
VitaTale uses technical and organisational measures such as:
- private file storage;
- access restrictions based on project ownership;
- separate storyteller invitations;
- protected storage of access secrets;
- rate limiting;
- server-side authorisation checks;
- temporary signed links to private files;
- no permanent storage of original voice recordings;
- log minimisation;
- validation of external-service output;
- separation of administrative access;
- durable deletion procedures;
- verification of payment-provider notifications.
No system can guarantee absolute security.
22.PERSONAL DATA BREACHES
If a personal data breach occurs, VitaTale:
- investigates the incident;
- limits its effects;
- documents it;
- evaluates the risk;
- notifies the competent supervisory authority where required;
- notifies affected individuals where required.
23.DATA PROTECTION IMPACT ASSESSMENT
Before public scaling, VitaTale should document its privacy-risk assessment and determine whether a formal Data Protection Impact Assessment is required.
Relevant risk factors may include:
- highly personal family memories;
- special-category data;
- information about third parties;
- automated text analysis;
- private photographs.
24.YOUR RIGHTS
Depending on applicable law, you may have the right to:
- receive information about processing;
- access your personal data;
- correct inaccurate data;
- request deletion;
- request restriction;
- object to certain processing;
- receive portable data where the right applies;
- withdraw consent;
- complain to a supervisory authority.
Requests: hello@vitatale.app
We may request reasonable identity verification to avoid disclosing a private family project to the wrong person.
25.IF YOU ARE MENTIONED IN SOMEONE ELSE'S BOOK
If you believe another VitaTale user is processing your personal data in a private project, you may contact us.
We will:
- verify the requester where appropriate;
- try to identify relevant material without unjustifiably disclosing another person's project;
- assess the applicable legal basis;
- consider the rights and freedoms of all affected people;
- apply the remedy required by law.
We do not provide a copy of another person's private book merely because someone suspects that they may be mentioned in it.
26.SUPERVISORY AUTHORITIES
A user in the European Union may complain to the competent data protection authority, including the authority in the country of their habitual residence, place of work or alleged infringement, where applicable.
A user in Ukraine may contact the competent Ukrainian authority under applicable law.
27.COOKIES AND SIMILAR TECHNOLOGIES
Use of cookies and similar browser technologies is explained in a separate policy.
28.CHANGES TO THIS POLICY
This Policy may be updated because of:
- product changes;
- a new market;
- a new provider;
- legal changes;
- retention changes;
- changes in processing.
A materially new purpose is not automatically accepted merely because the user saw an earlier version of this Policy.
29.CONTACTS
Privacy: hello@vitatale.app
Legal: hello@vitatale.app
Postal address: 26 Rodopi St., floor 3, apt. 5, Central District, Plovdiv 4000, Bulgaria