Privacy Policy

Effective: 2026-11-01

This policy describes what personal data we process when you use the SagaVu service, why we process it, for how long, and what rights you have in relation to it. We have aimed to write this in plain language; if anything is unclear, please write to us at privacy@sagavu.com.

1. Who processes your data?

Data Controller	SoundCam Productions Kft.
Registered Address	2364 Ócsa, Üllői utca 48.
Company Registration Number	13-09-211186 Registry: Budapest Környéki Törvényszék Cégbírósága
Tax Number	13580100-2-13
Contact	legal@sagavu.com
Data Protection Officer	We are not subject to the mandatory appointment requirement under Article 37 of the GDPR, and therefore have not appointed a Data Protection Officer. For data protection enquiries, you can reach us at the email address above.

2. What data do we process, and where does it come from?

Data category	What it covers	Source
Account data	Email address and display name. We do not know your password — it is stored encrypted by Amazon Cognito.	From you
Google or Apple sign-in data	If you sign in with a Google or Apple account: your email address and whether it is verified, and the name in that account (first and last name).	From Google or Apple (GDPR Art. 14)
Age and parental consent	Your date of birth and country. If you are below the age that applies in your country (16 in Hungary): your parent's or guardian's email address, and the time and method of their approval.	From you and from your parent
Content you provide	Prompts, scripts, uploaded images, audio and video files, project settings. If you include data relating to a real person in these (name, likeness, voice sample), that data is also processed.	From you
Data about the child and other people in a story	The characters' names or nicknames, age group, traits and the details you write about them (for example favourites, what happened that day). For a photo character, up to 4 photos per person and the character sheet drawn from them; for voice features, a voice sample.	From you — we do not collect data directly from the child
Generated content	The images, videos, audio, text, and their metadata that have been created.	Created by the service
Billing data	Name, billing address, tax number (if provided), purchase amount and date. We do not store or see card details — those are handled by Stripe.	From you / from Stripe
Usage data	Credit transactions, generation history, API key usage data (last used, IP address), server-side operational logs.	Automatically, during use
Content reports	If you report content: the reason, your description, a snapshot of the reported content, your email address (if you give it), and your IP address and browser details.	From you
Custom production requests	If you write to us using the custom production form: your name, e-mail address, what you would like, the description, the deadline, the approximate budget, whether you are ordering as a private person or for a company (and the company name), and the time you sent it.	From you

We do not seek to process special categories of data (GDPR Art. 9). Please do not upload material containing health, religious, political or other special category data. We do not create face-recognition templates from photos, and we do not use them to identify anyone.

3. Why do we process it, and on what legal basis?

Purpose	Legal basis (GDPR Art. 6(1))	Note
Account management, service provision, content generation	b) performance of a contract	The service cannot be provided without this.
Age check and proof of parental consent	c) legal obligation	GDPR Art. 8(2) and Art. 7(1).
Sending photo characters, voice samples and character details to external AI providers	a) consent	Asked for separately and withdrawable at any time; below 16, parental approval is required. The uploader declares that they may use the likeness of the person in the photo (see: Children and photo characters).
Automated safety screening of uploaded photos (filtering out nude, sexual, violent or unlawful images; child protection)	f) legitimate interests	On every photo, before any AI provider sees it, on AWS in Frankfurt; we record the decision without the image. You may object to this (see: Your rights), but photos cannot be uploaded without screening.
Showing a story you publish in the Story library, and checking it before publication	b) performance of a contract	Only at your request; you can withdraw publication at any time.
Billing, accounting, and tax obligations	c) legal obligation	Accounting Act s. 169, VAT Act
Handling content reports, and communicating and explaining decisions	c) legal obligation	Articles 16–17 of the EU Digital Services Act (DSA); keeping the evidence is a legitimate interest.
Fraud prevention, operational security, and debugging	f) legitimate interests	You may object to this (see: Your rights).
Voluntary feedback to improve the service (story ratings, and what held you back from a purchase)	f) legitimate interests	Voluntary; kept until the account is deleted, and included in data export and erasure. You may object to this (see: Your rights).
Fixing errors in the story engine: our staff mark some poor outputs and write rules from them	f) legitimate interests	This does not train any AI model, and only our internal team sees the marked excerpt. You may object to this (see: Your rights).
Sending offers and news by email (only if you ask for it in Settings, aged 18+)	a) consent	Consent under Hungarian Advertising Act s.6: name and email address. You can withdraw it at any time free of charge with the link at the bottom of each email, in Settings, at privacy@sagavu.com or by post to our registered office; we then delete your name and address from the register.
Storage on your device that is not strictly necessary	a) consent	Withdrawable at any time (see: Cookies and local storage).
Measuring whether our emails are opened and their links clicked (only if you turn it on in Settings)	a) consent	You can turn it off at any time under Settings → Notifications. When it is off, our emails contain no tracking pixel and links do not pass through the measurement server.
Answering custom production requests and preparing a quote (stories, story series, video production)	b) steps prior to entering into a contract, at your request	Also without an account. We do not use it for anything else. If you also agree to marketing e-mails on the form, that is handled as described in the marketing e-mail row.

What happens if you do not provide the data? An email address and password are required to create an account. Billing data is required for paid plans. Uploading content is voluntary.

4. Children and photo characters

SagaVu stories are for children, but the account and the story are mainly created by an adult — a parent, grandparent or guardian. We receive the details of the child in the story from you; we do not collect data directly from the child.

Age check. After you sign in, we ask for your date of birth. If you are below the age that applies in your country (16 in Hungary, GDPR Art. 8), you can use your account — including the features that use photos or voice — only after your parent or guardian has approved it through a signed link, valid for 7 days, sent to the email address you give. We keep the fact and time of the approval and the parent's email address as proof of consent.
Photo characters. If you want a drawn story character based on a real person — for example your child — you can upload up to 4 photos per person. Before uploading, you declare that you are entitled to use the photo; a child's photo requires the consent of the person with parental responsibility (details in the Terms). We remove location and camera data from the photo.
Where does the photo go? On upload, Amazon Web Services first screens the photo automatically in Frankfurt (filtering out nude, sexual or violent images) before any AI provider receives it. Two external AI providers then process it: Google (drawing and checking the character sheet) and Anthropic (checking that the image is not a protected cartoon character or other copyrighted work, and a fallback for checking the character sheet). We ask for separate consent for this, which you can withdraw at any time; without consent the photo goes to neither of them. No other AI provider receives the pictures of a story made from a photo character, and once the character sheet is ready, the story's pictures, voice and film are made from the drawn sheet only.
How long do we keep it? We delete the original uploaded file within one day, and the processed photo once the character sheet is ready — or immediately if you remove it — at the latest within 30 days of upload, together with its earlier stored versions. The drawn character sheet and the story made from it are part of your story: we keep them until you delete the story or your account. A drawn likeness can also be personal data, because it resembles the real person.
No identification, no training, no advertising. We do not create face-recognition templates from photos, and we do not use them to identify anyone. Under their contracts, the providers that process the photos do not train their models on them. We use a child's likeness or story in advertising only with your separate, express consent.
If you did not upload it. If someone else uploaded your child's photo or story, or you appear in the photo, write to privacy@sagavu.com or use the Report button on the story: after checking, we will remove it.
Publishing. A story goes into the Story library only if you ask for it; there, only signed-in users can see it, and you can withdraw it at any time. A story resembling a real person is labelled as such.

5. Who do we share your data with?

We use data processors to operate the service. Data is only ever passed to the recipient category necessary to fulfil the feature you have chosen. We do not sell your data. Data is used for advertising only if you also accept ad measurement in the cookie banner: we then tell Google, Meta and TikTok when you registered, started your first story or paid after arriving from one of our ads. Based on the same consent, our server also sends the same event to Meta and TikTok alongside your browser (Meta Conversions API, TikTok Events API), with a SHA-256 hash of your email address and account ID, your IP address, your browser details and the page address, so that they can match it to the ad click; they do not receive your email address in plain text, and count the two signals as one event. TikTok measurement does not run in Kids mode or on pages intended for children. Story content and child-profile data are never used for advertising.

Recipient category	Purpose	Data involved	Processing territory
Cloud, Storage, and Authentication Providers	Account management, database, file storage, and sign-in	Account data, projects, uploaded and generated content	Primarily EU; some support operations in the USA
Payment and Billing Providers	Payment, subscription, and statutory invoicing	Contact, purchase, and billing data; we never see your card details	EU / USA
Generative AI and Speech Providers	Fulfilling the text, image, video, or audio feature you have chosen	The story idea and text (including the characters' names and age group); photos and voice samples only when you select such a feature	USA (on the providers' global endpoints)
GPU Infrastructure Providers	Running our self-hosted generative models	The text, image, or audio input required to complete the task	EU / USA, depending on the active infrastructure configuration
Web analytics — Microsoft Clarity (only with consent; independent controller)	Measuring how the website and the app are used (heatmaps, masked session replay) to improve them. Under its own terms Microsoft is an independent controller and may also use the data for its own purposes.	Pseudonymous visitor ID, device and browser data, page views, clicks and scrolling; the content of input fields and of the signed-in area is masked	EU / USA
Ad measurement (only with consent)	Measuring which visitors arriving from our ads (Google, Facebook, Instagram, TikTok) register, start their first story or pay; we build no remarketing lists. For the collection and transmission of Facebook and Instagram measurement data Meta is a joint controller with us, and for its further processing an independent controller under its own privacy policy. TikTok (TikTok Technology Limited, Ireland and TikTok Information Technologies UK Limited) is a joint controller with us for collecting and transmitting the TikTok measurement data and for the measurement reports, an independent controller for its further processing (ad optimisation, security), and may also transfer the data within its group to Singapore and the USA under its own safeguards. Under the joint-controller arrangement, TikTok handles the exercise of data subject rights; you can read about TikTok's processing at https://www.tiktok.com/legal/page/eea/privacy-policy/en	Pseudonymous ad-click identifier, the conversion type, purchase amount and currency, and a non-reversible order or account identifier; to Meta and TikTok, from our server (Meta Conversions API, TikTok Events API), also a SHA-256 hash of the email address and account ID, the IP address, browser details and the page address. We send no name, plain-text email address or story content	EU / USA

The recipients by name, with their role, where they process data and the safeguard for the transfer:

Recipient	Role and purpose	Where it processes data	Transfer safeguard
Amazon Web Services EMEA SARL	Processor — Hosting, database, file storage, sign-in, email delivery, video assembly; automated safety screening of uploaded photos (Amazon Rekognition)	EU (Frankfurt)	No transfer to a third country
Stripe Payments Europe, Limited	Processor; independent controller for fraud prevention — Payments and subscriptions	EU and USA	EU–US Data Privacy Framework (GDPR Art. 45), with standard contractual clauses as a fallback
KBOSS.hu Kft. (Számlázz.hu)	Processor — Invoicing	Hungary (EU)	No transfer to a third country
Microsoft (Clarity)	Independent controller — Web analytics, only with consent	EU and USA	EU–US Data Privacy Framework (GDPR Art. 45), with standard contractual clauses as a fallback
Google Ireland Ltd. (Google Ads)	Independent controller — Ad measurement, only with consent	EU and USA	EU–US Data Privacy Framework (GDPR Art. 45), with standard contractual clauses as a fallback
Meta Platforms Ireland Ltd. (Meta-pixel, Konverziók API)	Joint controller for collection and transmission, independent afterwards — Ad measurement (Facebook, Instagram), only with consent	EU and USA	EU–US Data Privacy Framework (GDPR Art. 45), with standard contractual clauses as a fallback
TikTok Technology Limited (IE) / TikTok Information Technologies UK Limited (TikTok Pixel, Events API)	Joint controller for collection and transmission, independent afterwards — Ad measurement (TikTok), only with consent	Ireland and United Kingdom	Adequacy decision for the United Kingdom (GDPR Art. 45, (EU) 2025/2574)
Google Cloud EMEA Limited / Google LLC	Processor — Image, text and music generation, image checks, Story library checks, drawing photo character sheets	Global endpoint — the provider processes data in several countries, mainly the USA	EU–US Data Privacy Framework (GDPR Art. 45), with standard contractual clauses as a fallback
OpenAI Ireland Ltd.	Processor — Writing the story, support chat, live voice storytelling, transcription, fallback image generation without photo characters	Global endpoint — the provider processes data in several countries, mainly the USA	The European Commission's standard contractual clauses (GDPR Art. 46(2)(c))
Anthropic Ireland, Limited	Processor — Checking uploaded photos (whether they are copyrighted artwork), fallback image checks and story writing, editor assistant	Global endpoint — the provider processes data in several countries, mainly the USA	The European Commission's standard contractual clauses (GDPR Art. 46(2)(c))
SpaceXAI LLC (xAI, Grok)	Processor — Fallback image and video generation without photo characters	Global endpoint — the provider processes data in several countries, mainly the USA	The European Commission's standard contractual clauses (GDPR Art. 46(2)(c))
Eleven Labs Inc.	Processor — Narration, sound effects, subtitles, voice cloning	Global endpoint — the provider processes data in several countries, mainly the USA	EU–US Data Privacy Framework (GDPR Art. 45), with standard contractual clauses as a fallback
Runpod, Inc.	Processor — Rented GPUs for the video and speech models we operate ourselves	EU data centres; US company	The European Commission's standard contractual clauses (GDPR Art. 46(2)(c)) — signature of the data processing agreement in progress
Runpod, Inc. (Public Endpoints)	Processor — Optional talking-character feature (external model)	USA	The European Commission's standard contractual clauses (GDPR Art. 46(2)(c)) — signature of the data processing agreement in progress

In addition, we may disclose data to authorities where required by law.

6. Data transfers outside the EU

We store your data primarily in the European Union (Amazon Web Services, Frankfurt). To make stories and for some supporting services, however, we also transfer data to the United States; which safeguard applies to which recipient is shown in the "Transfer safeguard" column of the named table above.

EU–US Data Privacy Framework (GDPR Art. 45): for recipients certified under the framework (Amazon, Google, Microsoft, Meta, Stripe, ElevenLabs), the European Commission's adequacy decision is the safeguard; certification can be checked at dataprivacyframework.gov. Their contracts also include standard contractual clauses as a fallback.
Standard contractual clauses (GDPR Art. 46(2)(c)): transfers to recipients not certified under the framework (Anthropic, OpenAI, xAI, RunPod) are made under the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914.

You can request a copy of the safeguards at privacy@sagavu.com.

7. How long do we retain your data?

Data category	Retention period
Account data (email address, profile)	Until account deletion
Projects, scripts, generated image and video content	Until account deletion, or until the user deletes them
Credit transactions	Until account deletion
Voluntary feedback (story ratings, reasons a purchase did not happen)	Until account deletion
Consent to marketing emails (name, email address, time, version of the consent text)	Until consent is withdrawn
The fact and time of withdrawing marketing consent (without name or email address)	Until account deletion
Uploaded photo (photo character)	Deleted once the character sheet is ready, or immediately when removed, at the latest within 30 days of upload; the original uploaded file within one day
Photo declaration (per photo: time, version of the declaration text, IP address, browser)	Until account deletion
The safety-screening decision on an uploaded photo (without the photo: fingerprint, labels, decision)	No retention limit has been set yet; kept even after account deletion, because a rejection may be evidence of a criminal offence (GDPR Art. 17(3)(e))
Date of birth, country, the fact and time of parental approval, the parent's email address	Until account deletion
Consent to external AI providers (time, version of the disclosure)	Until withdrawn or until the account is deleted
Acceptance of the Terms and this notice, waiver of the right of withdrawal (time, version, IP address)	Until account deletion
Stories published in the Story library, comments, reactions	Until withdrawn or until the account is deleted
Support conversations	Until account deletion
Custom production requests	1 year after the last message, then deleted; if it leads to an order, the contract and the invoice are kept under the rules that apply to them
Consumer complaints and our replies	3 years (Hungarian Consumer Protection Act s.17/A(7)) — retained even after account deletion
Content reports (DSA)	No retention limit has been set yet: we keep closed cases as evidence and to detect repeated infringements; the reporter's identifiers, IP address and browser details are deleted when their account is deleted
Printed book orders (name, delivery address)	As long as needed to fulfil the order; after delivery, deleted when the account is deleted (the invoice is kept for 8 years)
Issued invoices	8 years (Act C of 2000, § 169 — retained even after account deletion)
Server-side operational logs	30 days
Security logs (AWS operations, access to photos and user media)	1 year
Log of staff access	2 years
Record of an account deletion (identifier, times, open tasks)	1 year after deletion
Database backups	Deleted data disappears from backups within 30 days at the latest
Data export file	7 days
Earlier versions of deleted files in storage	30 days

When you delete your account, we also delete your projects, generated content, and stored files. Invoices that have already been issued must nonetheless be retained — this is required by accounting law and is expressly permitted by Article 17(3)(b) GDPR.

8. Cookies and local storage

In addition to strictly necessary storage, we also use consent-based storage. You can change this at any time via the "Cookie Settings" link at the bottom of the page.

Name	Type	Purpose	Duration	Required?
sagavu:billing-funnel	sessionStorage	Analytics: links insufficient credits, plan selection and opening checkout using a random journey identifier	Until the tab session ends at most; not used after 30 minutes and deleted when consent is withdrawn	consent required
sagavu:decline-survey-asked	sessionStorage	Remembers that the "What held you back?" question was already asked in this session, so it is not asked again (the answer is not stored here)	Until the browser tab session ends	yes
sagavu.santaExitFeedback	local storage	Remembers that the "What held you back?" question on the Santa page was already asked in this browser, or that you already pressed the order button, so it is not asked again (the answer is not stored here)	Until deleted	yes
sagavu-support-thread	sessionStorage	ID of the open support conversation (the transcript stays on the server)	Until the tab session ends or a new conversation is started	yes
CognitoIdentityServiceProvider.*	cookie	Maintaining login session (Amazon Cognito)	Until the end of the session or token expiry	yes
NEXT_LOCALE	cookie	Remembering the selected language (Hungarian / English)	1 year	yes
meseneked-color-scheme	local storage	Remembering the light / dark theme preference	Until deleted	yes
meseneked-cookie-consent	local storage	Storing your cookie consent (without this we would ask again on every visit)	Until withdrawn	yes
wizardData, currentStoryProjectId, studioResult, pending	local storage	Preserving the interrupted session (wizard state, selected project, studio view) so that reloading the page does not lose your work	Until deleted	yes
meseneked.onboarding.*, research.insights	local storage	The state of the onboarding guide and the research panel settings	Until deleted	yes
_clck	cookie	Web analytics (Microsoft Clarity): pseudonymous visitor ID for aggregating return visits	1 year	consent required
_clsk	cookie	Web analytics (Microsoft Clarity): links the page views of a single visit	1 day	consent required
_gcl_au	cookie	Ad measurement (Google Ads): links an ad click to a later registration or purchase	90 days	consent required
_gcl_aw	cookie	Ad measurement (Google Ads): the ad-click identifier (GCLID) when you arrived from one of our ads	90 days	consent required
_fbp	cookie	Ad measurement (Meta): browser identifier that links one of our Facebook or Instagram ads to a later registration or purchase	90 days	consent required
_fbc	cookie	Ad measurement (Meta): the ad-click identifier (fbclid) when you arrived from one of our Facebook or Instagram ads	90 days	consent required
_ttp	cookie	Ad measurement (TikTok): browser identifier that links one of our TikTok ads to a later registration or purchase	13 months	consent required
ttclid	cookie	Ad measurement (TikTok): the ad-click identifier (ttclid) when you arrived from one of our TikTok ads	13 months	consent required
ttcsid, ttcsid_<pixel>	cookie	Ad measurement (TikTok): visit (session) identifier that ties together the events of the same visit in TikTok measurement	13 months	consent required
sagavu-tiktok-events-pending	local storage	Ad measurement (TikTok): identifiers of conversions already sent from the browser but not yet confirmed from our server, so TikTok counts the two as one event	Until withdrawn	consent required
sagavu-ads-sent	local storage	Ad measurement: list of conversions already reported, so the same one is not sent twice	Until withdrawn	consent required
sagavu-ads-checked-at	sessionStorage	Ad measurement: time of the last conversion check, so the server is not asked too often	Until the browser tab session ends	consent required

9. Automated decision-making and AI-generated content

We do not make any decision that produces a legal effect on you based solely on automated processing, and we do not carry out profiling (Article 22 GDPR).

A story intended for the Story library is checked automatically before publication (child safety, quality). This decides about the content, not about you, and has no legal effect on you; if it does not allow publication, we show you the reason, and you can ask a member of our staff to review it.

The service generates content using artificial intelligence and labels the output with machine-readable markup (IPTC "trainedAlgorithmicMedia"). Generated material is artificially created and is not real footage — even if it appears realistic. If you publish content depicting a real person, you may be subject to a separate labelling obligation under Article 50 of the AI Act; details are set out in the Terms of Service.

10. Fox support and saved conversations

Signed-in chat messages, account ID, page path, timestamps, case states and agent replies are stored in an AWS database to provide support and track the case. OpenAI processes the message history to produce AI replies, with Anthropic as a fallback if OpenAI is unavailable. Authorised agents can review conversations and related subscription, invoice and token records; the AI cannot access those account records. Chat is not used for advertising. Do not enter passwords, card details or children's personal data. Using static guides alone does not create a saved conversation. Starting a new conversation does not erase earlier server records; request data export or erasure through the account privacy options. Ordinary support history remains until account deletion. Consumer complaints and substantive responses are retained for at least 3 years under section 17/A(7) of the Hungarian Consumer Protection Act, including after account deletion (GDPR Articles 6(1)(c) and 17(3)(b)). A later substantive agent response or delivery record extends this minimum; open complaints remain retained until handled. Scheduled cleanup removes expired, completed complaint records.

11. Your rights

Right	What it means and how to exercise it
Access (Article 15)	You can download your data immediately via Settings → Download My Data.
Rectification (Article 16)	You can update your profile data on the Settings page.
Erasure (Article 17)	Via Settings → Delete Account. Deletion extends to your projects, generated content, and stored files. We block the account and finalize erasure after existing access expires. Issued invoices are retained for 8 years and complaint records for at least 3 years. Data needed to fulfil outstanding orders, legal cases, processor logs and backups may follow separate retention rules.
Restriction (Article 18)	You can request that processing be suspended while a disputed matter is being resolved.
Data Portability (Article 20)	Data exports are provided in machine-readable JSON format.
Right to Object (Article 21)	You may object to data processing that is based on legitimate interests.
Withdrawal of Consent (Article 7(3))	Cookie consent can be withdrawn at any time at the bottom of the page, and consent to external AI providers and to marketing emails in Settings. Withdrawal does not affect the lawfulness of earlier processing.
Rights of the child and of people in photos	The person with parental responsibility can exercise the rights on the child's behalf. If a person in a story or photo — for example the other parent, or a child who is now 16 — asks us, we will delete the photo and character concerning them after checking.

Requests beyond the self-service features can be submitted to us at privacy@sagavu.com. We will respond within one month at the latest; this deadline may be extended by two months where justified. There is no charge for the response.

12. Data Security

All data in transit is encrypted over a secure connection (TLS).
Access to stored files is separated per user; uploaded photos can be reached only by your account and by the system that processes them.
Passwords are managed by Amazon Cognito; we never have access to them.
Two-factor authentication (TOTP) is available — we recommend enabling it.
We log staff access to user data.
In the event of a data breach, we will act in accordance with Articles 33–34 of the GDPR: we will notify the supervisory authority within 72 hours and will also inform you if the breach poses a high risk to you.

13. Changes to This Notice

We update this notice from time to time — for example when we engage a new data processor. The effective date is shown at the top of the page. We will notify you in advance of any material changes, either within the service or by email.

14. Remedies

You may also bring your complaint to us first at privacy@sagavu.com. Independently of this, you may lodge a complaint with the supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

1055 Budapest, Falk Miksa utca 9-11. · https://naih.hu · ugyfelszolgalat@naih.hu

You may also seek redress through the courts. You may bring proceedings before the court with jurisdiction over your place of residence or habitual residence.