Privacy Policy

Who processes your data

Lulio is published by Pierre Filstroff, project owner under a Contrat d'Appui au Projet d'Entreprise (CAPE, a French business-incubation scheme) with Créacité (11 route de la Fédération, 67100 Strasbourg, France), which hosts his business activity. Pierre Filstroff is the data controller on Créacité's behalf. Full contact details: legal notice.

Data collected

Parent account: email address, creation date, sign-in via Google (if you choose this option) or a link sent by email
Child profile: first name, age range, chosen themes and worlds, episode length and frequency — entered by the parent, never by the child
Messages sent through the contact form: name, email, message content
Technical data: an opaque session identifier (cookie), the IP address at the time of the request
Where your first visit came from: the site you arrived from, or the campaign link you followed (a social media post, for example). It stays in the session, on the server, and is attached to the account only if you agree after your first sign-in
Your answer to "How did you hear about Lulio?", asked after your first sign-in, and the details you add if you pick "Other"
Android app, if you accept notifications: a device-specific notification token (Firebase Cloud Messaging) and the phone model, to know where to send the notification
Whether you chose to receive Lulio news and offers, asked after your first sign-in

What we never ask for

No photo of the child, no physical description
No family name, no address, no school
No data sold to a third party, no advertising profiling
No photo of a child anywhere on the site: the home page visuals are AI-generated and do not depict any real person

Reading recording (fluency measure)

The fluency timer can record the child reading aloud, so the adult can listen again and count the errors. It is optional: the adult ticks the box, and the browser asks for permission to use the microphone the first time
The recording stays in the browser on the device. Lulio never sends it, neither to its servers nor to any third party, and does not keep it: it is gone as soon as the timer is restarted or the page is left. Lulio therefore receives no voice data
The microphone turns off at the end of the minute. The permission can be withdrawn at any time in the browser settings
Without a microphone, or if permission is refused, the measure is taken by hand, as before
In the Android app, the phone asks for microphone permission; it can be withdrawn in the app settings. The audio stays on the device, as in the browser
As an option, Lulio can suggest the last word read and the number of errors. The reading is recognised in the browser: Lulio sends a recognition model (40 to 300 MB depending on the device, kept in cache), but receives neither the audio nor its transcription. The suggestion is checked and corrected by hand; only the figures the adult saves (words read, errors) reach Lulio, as without the option

Why this data

To provide the service: generate and send the saga's episodes
To let you know, by email or by notification in the Android app, that an episode is ready
To manage the account and billing
To respond to messages sent through the contact form
To send you Lulio news and offers, by email or by notification in the Android app, if you agreed
To learn which channels bring people to Lulio, using your answer to "How did you hear about Lulio?" and, if you agree, where the first visit came from

Legal basis

Performance of the contract, for the account and the subscription
Legitimate interest, for responding to a contact message
Consent, for attaching where the first visit came from to the account: it is asked after your first sign-in and can be withdrawn anytime in your settings, which deletes it. It is shared with no third party and only used to measure our own channels
Legitimate interest, for your answer to "How did you hear about Lulio?", which you give yourself
Legitimate interest, for where the first visit came from on accounts that finished signing up before this consent was asked, which keep it: you can object anytime in your settings, which deletes it
Consent, for news and offers: the box is unticked by default after your first sign-in, and you can unsubscribe anytime from your settings, or with the link in each email
Legitimate interest, for accounts already verified when this option was introduced (November 2026), which were subscribed to news and offers: you can object anytime, the same way
The child's data is entered and managed by the parent, the sole account holder: it is their consent, within the meaning of Article 8 of the GDPR, that covers it

Who receives your data

Brevo, for sending transactional emails (sign-in, replies to contact form messages) and news and offers, if you receive them
Stripe (Stripe Payments Europe, Ltd., our contracting entity in the EU), for processing card payments
Anthropic, for generating your child's personalized episodes (first name, age, siblings, companions, chosen universes)
ElevenLabs, for text-to-speech narration of episodes, from the generated text (including the child's first name)
Google, only if you choose to sign in with a Google account
Google (Firebase Cloud Messaging), to deliver the Android app's notifications, only if you accept them: Google receives the device token and the notification content
Hosting runs on personal infrastructure, in France — see the legal notice
Anthropic, ElevenLabs and Google are established outside the European Union or may process data there; this processing is governed by the European Commission's standard contractual clauses, which guarantee a level of protection equivalent to the GDPR
Site analytics (OpenPanel) run on our own server. They set no cookie and receive no email, first name or account identifier (see the cookie page)
No recipient other than those listed above, no resale of data

What our providers keep

Anthropic erases the texts sent and received from its servers within 30 days. They are not used to train its models
ElevenLabs: Lulio removes each synthesis from ElevenLabs' history as soon as the audio is retrieved. Its backups are erased within 30 days. Episode illustrations are also generated by ElevenLabs, and Lulio does not yet remove them on their side
Brevo: the history of emails sent to your address is deleted with the account
Stripe: the customer record is deleted with the account. Stripe keeps invoices and payments for its own legal obligations
Google: the notification token is deleted with the account. Lulio's access to your Google account can be removed in that Google account's settings
OpenPanel receives no email, first name or account identifier: the analytics cannot tell who the parent is

Deleting your account

From the website or the Android app: in the parent area settings, Delete my account. Your current subscription is cancelled at the same time
Without access to the app: write to us from the account's address, through the contact form. We handle the request within one month at most
The account is closed right away, then erased after 7 days with the children's profiles, the sagas, the episodes, their audio and their images. An email confirms the request and gives a link to cancel it
What stays: invoices, with Stripe (10 years, accounting obligation), and a log line with no personal data that proves the deletion

Data security

Lulio implements appropriate technical and organizational measures to protect your data: encrypted connections (HTTPS), data access restricted to those who need it, hosting in France. These measures aim to prevent unauthorized access, loss, or alteration of data.

Automated decisions

Episode generation relies on the information you enter (first name, age, themes…), but does not produce any individual decision with legal effects or that significantly affects you within the meaning of Article 22 of the GDPR: it is entertainment content, not an automated decision about you.

Retention period

Account: for as long as it exists, subscribed or not. You can delete it at any time (see Deleting your account)
After a deletion request: the account is closed right away, then erased by the daily purge that follows a 7-day delay, so 8 days at most. The delay lets you undo a mistaken deletion with the emailed link. Nobody can sign in in the meantime
Invoices: 10 years (French Commercial Code), kept by Stripe, our payment provider. Lulio keeps no copy once the account is erased
Deletion log: the account ID, the dates and the number of items erased, with no address and no content. It proves that a deletion took place
Contact form messages: kept for as long as needed to handle the request, then deleted
Session cookie: deleted on sign-out or when the session expires
Where the first visit came from: 90 days at most in the session (its lifetime) until an account exists, removed from the session after your first sign-in, then kept as long as the account if you agree, until you withdraw your consent
Android app notification token: deleted with the account; it stops being used as soon as you turn off notifications or uninstall the app
News and offers subscription: until you unsubscribe or delete the account
IP address: never stored in the database, it only appears in the server's technical logs

Payment

Payment is processed by Stripe (Stripe Payments Europe, Ltd.), which receives your card details directly — Lulio never has access to them and does not store them. Stripe acts as a data processor, in the performance of the subscription contract.

Your rights

Access, rectification, erasure, restriction, objection, and portability of your data
Complaint to the CNIL (cnil.fr), the French data protection authority, if you believe your rights have not been respected
Download your data: parent area settings, Download my data. You get a JSON file with the account, the children, the sagas, the episodes and the reading sessions
To exercise any other right: contact form. We answer within one month at most
Turn off the Android app's notifications, at any time, in your phone's settings
Unsubscribe from news and offers: parent area settings, or the link in each email
No data protection officer (DPO) is appointed, which is not required given the size and activity of the service; your requests are handled directly through the contact form