Privacy Policy
Last updated: 13 September 2026
Bedtime Wonder is operated by VEGA LABS LTD, registered in England and Wales. VEGA LABS LTD is responsible for the personal data described here. Contact: support@vegalabs.co.uk.
For children and grown-ups
Children can explore the stories with a parent or guardian. Accounts, purchases and story creation are for adults aged 18 or over. You do not need to give us a child’s real name, birthday, school or address. Use an invented character name. If a child has provided personal information, a parent can contact us to request help or deletion.
Account information
Signing in through Google or an email link uses Supabase Authentication. We process your email, account identifier and sign-in session; Google may also provide a name and profile image. Basic books can be read without an account. An account is needed to associate paid access with you.
Information saved on your device
Reading position, discoveries, stories, language and sound preferences are stored in your browser. When an adult signs in, optional child profiles (nickname and avatar), reading positions and discoveries are also saved privately in Supabase under that adult’s account, so each reader can resume on another device. Only that account can access these records. Profiles can be removed in the account or bookshelf; removal deletes their server progress. Local copies may remain on other devices until site data is cleared. Guest progress and reading settings stay on the device. Clearing browser data does not cancel a subscription or delete the account.
Story creation and recordings
When you request an AI story, your prompt, chosen character name, language and setting are sent to OpenAI. Narration sends story text and voice choices to ElevenLabs, or to OpenAI when that voice option is selected. Device narration uses your browser or operating system’s speech service. Generated narration and its text/timing files are cached in Supabase for reuse. These files use public URLs and can be read by anyone with the link. Do not put personal or sensitive information in a story or prompt.
Purchases and technical records
Stripe processes payments; our app does not receive full payment card numbers. We keep your account’s access plan and relevant Stripe customer, checkout and subscription identifiers, including an access expiry for yearly plans. Requests also expose technical information such as IP address, browser details and errors to hosting providers. Temporary IP-based limits help prevent excessive voice generation. If you contact us, we receive your message and contact details.
Why we use information
We use account, requested story generation and purchase data to provide our agreement with the adult account holder. We rely on legitimate interests for proportionate security, abuse prevention and support, balanced against your rights and children’s interests. Required financial or regulatory records are handled to meet legal obligations. Where consent is required for optional processing, it must be obtained separately and may be withdrawn. Reading this notice is not consent.
Who receives information
Vercel hosts the website and server functions; Supabase provides authentication, access records and recording storage; Stripe handles payments; Google handles Google sign-in; OpenAI and ElevenLabs provide requested generation. They receive information relevant to those functions and process it under their applicable terms and privacy arrangements. We do not sell personal information, run advertising in the app or operate our own model-training programme. Provider retention and use may differ by service and account settings. We may disclose information where legally required or necessary to protect rights.
How long information stays
Browser information remains until you or your browser clear it. Account and access records are kept while needed to provide the account and purchased access. Cached recordings remain until replaced or deleted, with no automatic short expiry. Support, security and transaction records may be kept as needed to resolve the issue, investigate misuse or meet accounting, tax and legal obligations. A deletion request is reviewed against those purposes; it does not automatically erase records that law requires us to retain. Contact us for help locating a recording that contains personal information.
Security and international processing
We use HTTPS and keep service credentials on the server. No online system is completely secure. Our providers may process data outside the UK or EEA. Applicable transfer protections can include adequacy decisions or approved contractual safeguards; contact us for details of the arrangements relevant to your information.
Your choices and rights
Depending on applicable law, you can request access, correction, erasure, restriction or portability of personal information. You can object to processing based on legitimate interests, and withdraw consent where it is the basis. We may need proportionate identity checks and will respond within the applicable legal time limit, normally one month under UK GDPR. You can complain to the UK Information Commissioner at ico.org.uk/make-a-complaint or your local data protection authority. Purchase access checks are automated, but you can ask us to review an error.
Updates to this notice
We will date revisions here and explain material changes through the service or a direct communication where appropriate. This notice covers Bedtime Wonder, not the separate CIVILIAN app or websites reached through external links.
Contact VEGA LABS LTD
For privacy, account, billing or cancellation requests, email support@vegalabs.co.uk and mention Bedtime Wonder. Please include only the information needed to identify your request. Never send passwords or payment card details.