Datenschutzrichtlinie
Dies ist eine unverbindliche Übersetzung. Rechtlich verbindlich ist die englische Fassung dieses Dokuments; im Konfliktfall gilt die englische Fassung.
1. Who we are
This Privacy Policy explains how Casper Sleep collects and uses personal data when you use our apps and website (the "Service"). The data controller and service operator is JOSE FRANCISCO ANTUNES LDA, with postal address R DO FIGUEIRAL EDF QTA VILLAGE GARAJAU BL D 4CA 9125-063 CANICO, PORTUGAL. You can contact the controller about privacy at privacy@caspersleep.ai.
2. Data we collect
We collect: account data (such as your email and authentication details); child-profile data you choose to provide (such as a first name or nickname, age range, appearance description, and preferences); the prompts you submit and the stories, audio, and images generated; usage and playback activity; device and technical data; and payment-related metadata from our payment processors (we never receive or store card details). If you use a photo to fill in a child's appearance description, that photo is read on your own device and is never uploaded to us — only the description it produces is sent. We ask you to minimize the child data you provide and to avoid including unnecessary identifying details.
3. Children's data and parental consent
The Service is intended to be set up and operated by a parent or guardian. We rely on you to provide and consent to any child data on that child's behalf. We collect only what is needed to create and play personalized stories, we do not use child data for behavioural advertising, and we do not knowingly allow children to create accounts. Where required by laws such as COPPA (US) or the GDPR (EU/UK), we obtain verifiable parental consent before collecting a child's personal data, and you may review, limit, export, or delete that data at any time.
4. How we use data
We use personal data to: provide and personalize the Service and generate content; run safety and content-moderation checks; manage subscriptions, credits, and payments; provide customer support; send service and account communications; maintain security and prevent abuse; and comply with legal obligations. We do not sell your personal data.
5. AI providers and other processors
To generate stories we send the necessary prompt and content to third-party AI providers for text generation, image generation, text-to-speech narration, and content-safety review. We also use processors for payment (including Apple, Google, and our web payment processor), cloud hosting and media storage/delivery, email and notifications, and error monitoring. We do not use analytics providers. These providers process data on our behalf under contractual safeguards and only for the purposes of operating the Service.
6. Legal bases (EU/UK)
Where the GDPR or UK GDPR applies, we process personal data on the bases of: performance of our contract with you (to provide the Service); your consent (for child data and certain optional features), which you may withdraw at any time; our legitimate interests (to secure, maintain, and improve the Service) balanced against your rights; and compliance with legal obligations.
7. Sharing and disclosure
We share personal data with the processors described above, with authorities where required by law or to protect rights and safety, and in connection with a corporate transaction (such as a merger or acquisition) subject to this Policy. If you ask Apple or Google to refund an in-app purchase, the store may ask us for information to assess your request; where we respond, we share only account-level purchase facts about you as the purchaser — whether the purchased credits were used, whether the purchase was delivered, the approximate age of your account, and whether your account is in good standing — and never your child's profile data, your prompts, or generated content. By requesting a refund from the store you agree to this sharing for that purpose; you can object or ask questions at privacy@caspersleep.ai. We do not otherwise disclose your personal data to third parties for their own purposes.
8. International transfers
We and our providers may process personal data in countries other than yours, including the United States. Where we transfer data internationally we use appropriate safeguards, such as standard contractual clauses or equivalent mechanisms, to protect it.
9. Data retention
We keep personal data only as long as needed for the purposes described here: account and subscription data for the life of your account and as required for legal, tax, and audit purposes; child profiles and generated content until you delete them or close the account; and operational logs for 14 days. When data is no longer needed we delete or anonymize it.
10. Your rights
Subject to your local law, you may request access to, correction of, deletion of, or a copy (export) of your personal data, and you may object to or ask us to restrict certain processing or withdraw consent. You can exercise many of these directly in the app, or by contacting privacy@caspersleep.ai. EU/UK users may also lodge a complaint with their local data-protection authority.
11. Security
We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and content moderation of generated images. No system is perfectly secure, but we work to protect your and your child's information and to notify you of incidents where required by law.
12. Account closure and deletion
You can delete a child's data, individual stories, or your entire account from within the Service. Deleting your account removes your profiles and generated content from active systems, including your support conversations and any record of a cancelled store subscription. Some records are kept afterwards. We keep payment and refund records with your identity removed — ledger entries about transactions, not copies of your receipt, which is held by your app store or payment processor. They carry no account identifier, and each stores its payment reference as a keyed one-way value: if a store asks us about a specific payment they can quote its reference and we can match it, but we cannot work backwards from a record we hold to the person who made it. These are kept for seven years for accounting and legal obligations, then deleted. We also keep a tamper-evident security audit trail, which never contains your name, email address, prompts, stories, or any child's details. Your own entries in it record only a one-way pseudonym, the type of action, and when it happened; a record of anything our support staff did on your account does identify the account concerned. The trail is an append-only integrity chain, so entries are never removed from it, and copies are held in a write-once archive for seven years. We also instruct our processors to delete associated data.
13. Changes and contact
We may update this Policy; we will post the new version with a new version identifier and effective date and, for material changes, notify you. This English version is the legally binding version; translations are provided for convenience. Contact us at privacy@caspersleep.ai.
Version 2026-09-05.v1 - gültig ab 5. September 2026