PRIVACY POLICY

1. INTRODUCTION AND SCOPE

Welcome to Twistale. This Privacy Policy explains how TWISTALE LLC (in formation) ("Twistale," "we," "us," or "our") collects, uses, discloses, and secures your Personal Data when you visit our website, purchase our books, or use our digital services (the "Services").

Legal Basis for Processing (GDPR):

We process your Personal Data under the following legal bases:

• Contractual Necessity: To fulfill your orders for books and merchandise.
• Consent: To send you newsletters or process a child's data (Verifiable Parental Consent).
• Legitimate Interest: To improve our AI algorithms, prevent fraud, and maintain network security.
• Legal Obligation: To comply with tax laws and consumer protection regulations.

"LLC in Formation" Notice:

You acknowledge that Twistale is currently in the process of legal formation. This Policy constitutes an agreement between you and the company's founders. Upon formal incorporation, all data controller responsibilities will automatically transfer to the registered entity.

2. CHILDREN'S PRIVACY (COPPA & GDPR-K)

Twistale is a general audience site that offers specific features for children. We strictly adhere to the Children's Online Privacy Protection Act (COPPA) in the US and the GDPR-K standards in Europe.

2.1 The "Neutral Age Gate"

Upon registering or accessing age-restricted features (like "Generate Personal Story"), we ask for a Date of Birth. We do not default to a specific age.

• Users Under 13 (US) / Under 16 (EU): We do not collect personal information (like email or full name) without Verifiable Parental Consent.
• Users 13+ (US) / 16+ (EU): May register for a standard account.

2.2 Verifiable Parental Consent (VPC)

If a child wishes to use features that collect personal data (e.g., saving a story, keeping a game score), we require a parent or guardian to verify their identity.

• High-Level Verification: For features allowing user-generated content or public sharing, we may require a transaction (e.g., $0.50 charge) or government ID verification to prove you are an adult.
• Teacher/School Consent: If you are using Twistale in a classroom, the school consents on behalf of parents, strictly for educational purposes.

2.3 Parental Rights

Parents may review, delete, or refuse further collection of their child's information at any time by contacting us at support@twistale.com.

3. INFORMATION WE COLLECT

We collect information in three ways: (1) Information you give us; (2) Information collected automatically; and (3) Information from third parties.

3.1 Information You Provide

3.2 Information Collected Automatically

• Device Data: IP address, browser type, operating system (used for fraud detection and localization).
• Tracking Data: Cookies, pixels, and web beacons (see Section 8).
• Usage Data: Clickstream data, time spent on pages, and game interactions.

4. ARTIFICIAL INTELLIGENCE (AI) FEATURES

Our "Generate Personal Story" and "Character Blogs" features use Generative AI technologies.

4.1 Usage of Your Content

• Service Improvement: We may use anonymized user inputs (prompts) to refine our AI models and filter for safety.
• No Training on Kids' PII: We do not use Personal Identifiable Information (PII) from authenticated Child Profiles to train our public AI models.
• Ownership: As between you and Twistale, you retain ownership of your specific text inputs. Twistale retains ownership of the AI model, the generated characters, and the underlying code.

4.2 Disclaimer

AI-generated content may be inaccurate, repetitive, or inappropriate. Twistale cannot guarantee the uniqueness of any AI-generated story.

5. LOYALTY PROGRAM & FINANCIAL INCENTIVES (CCPA Notice)

We offer a Loyalty Program where you can earn points, coupons, and special offers in exchange for your engagement.

• The Incentive: Points redeemable for discounts on books and merchandise.
• Data Collected: To administer the program, we must collect and retain your Name, Email, Purchase History, and Game Scores.
• Value Calculation: We have calculated the value of your data based on the expenses related to the operation of the program (marketing systems, IT infrastructure) and the cost of the discounts provided. We believe the value of the benefits you receive is reasonably related to the value of the data you provide.
• Withdrawal: You may withdraw from the Loyalty Program at any time by deleting your account. Note: Deleting your data will result in the forfeiture of all accrued points.

6. HOW WE SHARE YOUR DATA

We do not sell your Personal Data. We share data only as follows:

• Service Providers: With companies that help us run our business (e.g., AWS for hosting, Stripe for payments, FedEx for shipping). They are contractually bound to protect your data.
• Legal Compliance: If required by a subpoena, court order, or to protect the safety of a child.
• Business Transfers: In the event of a merger, acquisition, or bankruptcy, user data may be transferred to the new owner as a business asset.

International Transfers (GDPR):

Twistale is based in the United States (or Israel). If you access the Site from the EU/UK, your data will be transferred to the US/Israel.

• Israel: The EU Commission has determined Israel offers an "adequate" level of data protection.
• USA: We rely on Standard Contractual Clauses (SCCs) or the Data Privacy Framework (if applicable) for transfers to US vendors.

7. YOUR RIGHTS (EU & US)

Depending on your location, you have the following rights:

• Right to Access: Request a copy of the data we hold about you.
• Right to Correction: Fix inaccurate data.
• Right to Deletion ("Right to be Forgotten"): Ask us to erase your data (subject to transaction record retention laws).
• Right to Opt-Out (Do Not Sell/Share): Opt-out of the "sale" or "sharing" of data for cross-context behavioral advertising.
• Right to Data Portability: Receive your data in a structured, machine-readable format.

How to Exercise: Email support@twistale.com with the subject line "Privacy Request." We will verify your identity before processing the request.

8. COOKIES AND TRACKING PIXELS

• Essential Cookies: Required for the site to function (e.g., keeping items in your cart).
• Analytics Cookies: Google Analytics helps us understand site usage. You can opt-out via your browser settings.
• Newsletter Pixels: Our emails contain tracking pixels that tell us if you opened the email. By subscribing, you consent to this tracking. You can disable this by blocking images in your email client.

9. DATA RETENTION AND SECURITY

• Security: We use industry-standard encryption (SSL/TLS) for data in transit and at rest. However, no internet transmission is 100% secure.
• Retention: We retain personal data only as long as necessary to provide the Services or as required by tax/legal obligations. Inactive profiles are anonymized after 24 months of inactivity.