Privacy Policy

Last updated: 4 October 2026  ·  BAMJOY LTD — Registered in England & Wales  ·  ICO Registration: ZB924199

1. Who We Are

BAMJOY LTD ("BAMJOY", "we", "us", "our") operates the Story Weaver platform at www.bamjoy.com — an AI-powered personalised children's storybook service. We are registered with the Information Commissioner's Office (ICO) under registration number ZB924199.

Data Controller: BAMJOY LTD, Downham Market, Norfolk, England

For all privacy matters: privacy@bamjoy.com

2. Our Commitment to Children's Privacy

BAMJOY is designed for use by parents and guardians on behalf of children. We take children's privacy with the utmost seriousness and operate in full compliance with:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• The ICO's Age Appropriate Design Code (Children's Code)
• The Children's Online Privacy Protection Act (COPPA) where applicable

We do not permit children to create accounts directly. All accounts are created and managed by a parent or guardian aged 18 or over. Children's data is only collected through a parent's account, with the parent acting as the responsible party.

We do not use children's data for advertising, profiling, or any commercial purpose beyond delivering the BAMJOY service.

3. What Data We Collect

3.1 Account Data (Parent/Guardian)

When you register, we collect:

• Your name
• Your email address
• Your password (stored as a secure hash — never in plain text)
• Your subscription tier and billing status
• Date of account creation

3.2 Child Profile Data

When you create a child profile, we collect:

• The child's first name (or a nickname — you do not need to use their real name)
• The child's age group (used to tailor story content and reading level)
• Optional: a stylised avatar image made from a photo you upload (Viewcam feature). We keep the avatar, not the photo
• Optional: how Salford, our classroom teddy, should say your child's first name, including any "sounds like" spelling you give. You hear it and approve it first
• Your child's chat messages with Salford, and Salford's replies
• Today's classroom register (whether your child has started class today), stored with their profile and replaced each day

We do not collect a child's full name, date of birth, school, location, or any contact information.

3.3 Story Data

When you create a story, we collect:

• Story title, content, and illustrations generated by our AI
• Story settings you choose (genre, characters, themes)
• Whether a story is saved to your library or marked as public

3.4 Usage Data

We collect standard technical data to operate the service:

• Browser type and version
• Device type
• Pages visited and features used
• Session duration
• Error logs

We do not build behavioural profiles for advertising purposes.

3.5 Payment Data

Payments are processed by Stripe. We do not store your card number, CVV, or full payment details. We receive only a confirmation token and your subscription status from Stripe. Stripe's privacy policy applies to payment processing: stripe.com/gb/privacy

3.6 Communications

If you subscribe to our newsletter or contact us by email, we collect your email address and the content of your communications.

4. How We Use Your Data

We never use your data or your child's data for:

• Targeted advertising
• Sale to third parties
• Automated decision-making that produces legal or similarly significant effects

5. AI Services and Your Data

BAMJOY uses Google's AI services to write stories, draw pictures, power Salford's chat and give stories and Salford a voice. This is exactly what we send, and where it goes:

• Stories and illustrations: the story settings you choose (genre, characters, themes, age group), including any character name you type, are sent to Google Gemini.
• Viewcam avatars: if you upload a photo to make an avatar, the photo is sent to Google Gemini to draw the stylised version. We store the avatar only, not the photo.
• Salford chat: your child's messages to Salford are sent to Google Gemini, together with their first name, phonics phase, the titles of books in your library and their recent Salford chats, so that Salford's replies make sense. We never send your email address or payment details.
• Narration and Salford's voice: story text and Salford's lines are turned into speech by Google Cloud Text-to-Speech through its EU endpoint, so this processing stays in the EU. For Salford to say your child's name, their first name (or the "sounds like" spelling you give) is sent too. Salford never says a name you have not approved, and the name recordings are stored privately in your account.

Google processes this data on our behalf under Google's data processing terms, and does not use it to train its AI models. We never send your child's surname, date of birth, school or location. Everything generated is stored in your BAMJOY account in Google Cloud (see section 7).

6. UK Phonics Engine

Our built-in UK Phonics Engine analyses story text to highlight phonics patterns in line with the DfE Letters and Sounds framework (Phases 1–5). This processing happens locally within your browser session and does not involve sending phonics data to external servers.

7. Who We Share Data With

We share data only with the following trusted service providers, under appropriate data processing agreements:

We do not use advertising networks, data brokers, or social media tracking pixels.

8. Data Retention

You can delete your account yourself from your Account page. Your profile, child profiles, books, pictures, narration, consent records and community posts are deleted straight away, and any paid plan is cancelled. Payment records stay with Stripe because the law requires us to keep them for tax purposes. If you would rather ask us, email privacy@bamjoy.com and we will delete everything within 30 days.

When you remove a child profile, that child's reading progress, quiz results, phonics progress, game scores and Salford chats are deleted straight away. Your family's books stay in your library. For disaster recovery we keep a rolling safety copy of our database for 7 days; deleted data is erased from it automatically after that.

9. Your Rights Under UK GDPR

As a UK resident, you have the following rights:

• Right of access — request a copy of the data we hold about you
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — limit how we process your data
• Right to data portability — receive your data in a portable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for newsletter at any time

To exercise any right, email: privacy@bamjoy.com

We will respond within 30 days. We may need to verify your identity before processing requests.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the ICO: ico.org.uk | 0303 123 1113

10. Cookies

We use a minimal set of cookies necessary to operate the service:

We do not use advertising cookies, third-party tracking cookies, or analytics cookies that profile you across sites. For full details see our Cookie Policy.

11. Security

We implement the following security measures:

• All data transmitted over HTTPS (TLS 1.2+)
• Passwords stored using bcrypt hashing
• Firebase Security Rules restricting data access to authenticated account owners
• Payment data handled entirely by Stripe (PCI DSS compliant)
• Regular security reviews of Firestore rules and Cloud Function permissions
• Staff access to production data limited to authorised personnel only

12. International Transfers

Your account, child profile, story and chat records are stored in Google Cloud in the EU (Belgium and the Netherlands), files such as illustrations and audio are stored in London, and Google Cloud Text-to-Speech processes audio in the EU. The Google Gemini API (stories, illustrations, Viewcam avatars and Salford's chat) and Firebase Authentication may process data on servers outside the UK/EEA. Where this happens, Google relies on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA), which give protection equivalent to UK GDPR.

13. Children's Code Compliance

In line with the ICO's Age Appropriate Design Code, BAMJOY:

• Does not serve behavioural advertising to child users
• Does not profile children for commercial purposes
• Applies privacy-protective defaults across all child-facing features
• Does not use nudge techniques to encourage children to weaken their privacy settings
• Provides age-appropriate, clear language in all child-facing content
• Ensures parental oversight and control over all child profile data

14. Changes to This Policy

We will notify registered users by email of any material changes to this policy before they take effect. The "last updated" date at the top of this page will always reflect the most recent version.

15. Contact Us