Privacy

Who we serve

Moonbeam is built for parents and other adult caregivers. Our users are the grown-ups — children don't create accounts and don't interact with us directly. The audio we generate is for children to listen to at bedtime, played by their parent on a parent-owned device.

What we collect

• Account data: email, hashed password, plan tier, billing reference.
• Voice samples: the audio you record. Only used to build your voice model with our partner (see below); not retained on our servers after the model is created.
• Personalization: child name(s), pet, town, favorite things — typed in by you, used to write your stories.
• Stories: the prompts you give us and the stories we generate. Stored on Supabase, RLS-locked to your user id.
• Billing data: Stripe handles all of it. We never see your card number.
• Cookies: a Supabase auth-session cookie (necessary), a locale-preference cookie (necessary for the language switcher), and a localStorage entry for the cookie-banner acknowledgment. No analytics, advertising, or cross-site tracking cookies.

Voice biometric data

Your voice recording is biometric data in California (BIPA-style) and a “special category of personal data” under GDPR Art. 9. We require your explicit consent (one combined checkbox) before any recording is captured. We store the timestamp of that consent for our audit records.

The recording itself is sent to ElevenLabs to build your voice model and is not kept by us afterwards. The voice model lives in your Moonbeam account and is removed from ElevenLabs within 24 hours of you deleting it from your voices page or deleting your account.

Subprocessors

We use a small set of trusted vendors to run the service:

• Supabase — auth + database (US-East).
• Vercel — hosting + edge.
• Anthropic (Claude) — story generation. Prompts include your kid's first name + non-sensitive personalization.
• ElevenLabs — voice cloning + narration. Receives the voice sample + the story text.
• Stripe — payment processing. Handles cards and PCI directly; we never see card numbers.
• Resend — transactional emails (welcome, story-ready, receipts).

Each subprocessor has its own privacy practices and contractual data-processing agreements with us.

What we don't do

• We don't sell your data. Not now, not ever.
• We don't use your voice clone outside Moonbeam.
• We don't use your stories, voice, or personalization to train any model.
• We don't share your child's name, pet name, or any personal detail with third parties.
• We don't use advertising, retargeting, or behavioral tracking cookies.

Your rights

You can access, correct, export, or delete your data at any time. From Settings, you can delete your account — which purges your voice clones from ElevenLabs within 24 hours and removes all stories + personalization from our database immediately.

California residents (CCPA / CPRA) have additional rights to know what we've collected and to opt out of any sale or share of personal information (we don't do either). EU/UK residents (GDPR) have rights to portability, restriction, and to lodge a complaint with their local data-protection authority.

To exercise any of these rights, email us at juanserdiuk@juanserdiuk.com.

Contact

Questions, concerns, or a data request? Email juanserdiuk@juanserdiuk.com and we'll respond within a business day.