Legal
Wispalo Privacy Policy
Last updated: 3 August 2026
Wispalo is operated by Empiire Ltd (“Wispalo”, “we”, “us”, “our”), a company registered in the United Kingdom. This policy explains what personal data we collect, why, how it's used, and the choices and rights you have.
1. Who this policy covers
Wispalo is a service for parents and guardians. Accounts are created and controlled by adults. Children do not create their own accounts, do not provide their own consent, and do not have direct access to account settings, billing, or data controls — only the parent or guardian who created the account does.
2. What we collect
About you (the parent/guardian account holder):
- Email address
- Password (stored securely, never in plain text)
- Payment information — handled entirely by Stripe; we do not store your card details ourselves
- Basic usage data (which stories you generate, when you log in, subscription status)
About your child, entered by you:
- First name
- Age
- Gender (Girl/Boy, used to personalise story pronouns and cover art)
- An optional photograph, used only to personalise that child's story cover illustration
If you generate a story anonymously (without an account):
The same child details above, plus a temporary session token that lets you return to that specific story and lets us apply our one-free-story limit. We also record a hashed version of your IP address for a short period, solely to prevent the same free story from being generated repeatedly from the same connection. We do not store your raw IP address.
If you share a story with someone else:
The story becomes accessible via a unique, unguessable link. Anyone with that link can view the story and cover image, but cannot see your account details, email, or any other information about your account.
3. Why we collect it
We collect this data to:
- Generate a personalised bedtime story and cover illustration featuring your child
- Save your child's profile so you don't have to re-enter it each time
- Provide optional audio narration for paying customers
- Process payments for single stories or subscriptions
- Enforce the free-story limit fairly
- Send you transactional emails (e.g. account confirmation, payment receipts) — not marketing emails unless you separately opt in
We do not use your data, your child's name, age, photo, or any story content to train any AI model, ours or any third party's. Story content and images are generated for you, and are not fed back into any model's training data.
4. Who we share data with
We use a small number of trusted specialist providers to run Wispalo. Each only receives the minimum data it needs to perform its specific function, and none are permitted to use your data for their own purposes, including training their own AI models:
| Type of provider | What they receive | What for |
|---|---|---|
| AI text-generation provider | Your child's name, age, gender, and the story prompt you enter | Generating the story text |
| AI image-generation provider(s) | Your child's name, gender, and photo (if uploaded) | Generating the cover illustration |
| Text-to-speech provider | Story text | Generating audio narration, for subscribers and single-purchase customers only |
| Payment processor | Your payment details, email | Processing payments and subscriptions; the payment processor holds your card details, not us |
| Database hosting provider | All account and story data | Secure data storage |
| Application hosting provider | All account and story data | Running the Wispalo website and app |
We do not sell your data, or your child's data, to anyone. We do not share it with advertisers or data brokers.
Some of these providers are based outside the country you live in (including the US). Where this is the case, we rely on their standard contractual safeguards for international data transfers.
5. Children's data specifically
We take children's data seriously and limit what we collect to the minimum needed to personalise a story: first name, age, gender, and an optional photo. We do not collect a child's surname, school, address, or any other identifying detail. We do not allow children to create their own accounts, communicate with other users, or interact with Wispalo directly — every action is taken by the parent or guardian.
If you'd like to remove your child's photo or profile at any time, you can do so from your account settings, or by contacting us (see Section 9).
6. Cookies
Wispalo uses a small number of cookies:
- Essential cookies — required for the site to function (keeping you logged in, remembering an anonymous story session, processing payment).
- Analytics/advertising cookies — if we run advertising (for example, Google Ads) to help parents discover Wispalo, we may use conversion-tracking cookies to understand whether an ad led to a signup. These do not identify your child and are not used to build an advertising profile of your child.
You can control cookies through your browser settings. Blocking essential cookies may prevent parts of Wispalo from working correctly (for example, staying signed in).
7. How long we keep data
We retain your account data for as long as your account is active. If you delete your account, we remove your personal data — including child profiles, stories, and photos — within 30 days. Where we're legally required to keep transaction records for tax and accounting purposes (typically 6 years under UK law), we retain only the minimum billing information needed for that purpose, never story content or child profiles.
Anonymous (no-signup) stories are kept for a limited period tied to the session token, or until claimed by a newly created account.
8. Your rights
Wherever you're based, you generally have the right to:
- Know what data we hold about you and your child
- Correct inaccurate data
- Request deletion of your data
- Object to or restrict certain processing
- Receive a copy of your data in a portable format
These rights, and the specific way to exercise them, may vary slightly depending on the data protection law that applies where you live. If you're unhappy with how we've handled your data, you're also entitled to complain to your local data protection regulator — for example, the Information Commissioner's Office (ICO) in the UK, the Data Protection Commission (DPC) in Ireland, or the Office of the Australian Information Commissioner (OAIC) in Australia.
To exercise any of these rights, contact us using the details below.
9. Contact us
If you have any questions about this policy, or want to access, correct, or delete your data, please get in touch via our contact page.
10. Changes to this policy
We may update this policy from time to time, for example as we add new features or work with new service providers. We'll update the “Last updated” date at the top of this page when we do. If a change is significant, we'll aim to let existing account holders know directly.