Controller:
Milosz Nowakowski, Bajkiki, Becherlehenstraße 26, 73527 Schwäbisch Gmünd, Germany
E-Mail: support@bajkiki.com
We collect data that you voluntarily provide to us (name, e-mail address). In addition, data is collected automatically when you use our app (usage data, AI-generated content, device information).
Your data is processed to:
The legal basis is Art. 6 (1) lit. b GDPR (performance of a contract) or Art. 6 (1) lit. f GDPR (legitimate interest).
When you register and sign in by e-mail, we process your e-mail address and send you a one-time code (OTP) via the service Resend (Resend, Inc., USA). Processing is based on Art. 6 (1) lit. b GDPR.
You can sign in with your Google account. Your name, e-mail address, and profile picture are transmitted by Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Privacy Policy applies. Data transfer to the USA is based on EU Standard Contractual Clauses.
To create personalized stories, we process the information you enter (e.g., daily routine, names, chosen values). This data is transmitted to the following AI services:
For illustrations, we additionally use image AI services (Google Imagen/Gemini, Google Ireland Limited; xAI, USA; OpenRouter, Inc., USA). For the optional AI read-aloud voice, we use text-to-speech services from OpenAI (USA) and Google (Google Ireland Limited).
The entered data is transmitted temporarily for processing. The generated stories are stored in your account if you wish. The AI providers process the data in accordance with their respective privacy policies.
To protect children, both your inputs and the generated content are automatically checked for inappropriate content (content moderation via OpenAI). The content is generated exclusively by machines and may contain errors despite safety filters; we recommend briefly reviewing each story before reading it aloud.
Bajkiki is directed exclusively at adults (parents and legal guardians) who create stories for their children. An account may only be created by persons aged 18 and over; the app is not intended for independent use by children without supervision.
If you provide information about your child for personalization (e.g., first name, age, experiences of the day), we process it solely to create the requested story. As the legal guardian, you decide on these inputs and are responsible for them (Art. 8 GDPR). Please only enter the information necessary for the story and refrain from providing particularly sensitive data (e.g., health or government data).
We apply data minimization: inputs are only transmitted temporarily for generation; the finished story is stored in your account for as long as you wish to keep it and can be deleted at any time. Information about your child is not used for advertising and is not shared with third parties for advertising purposes.
For web payments, we use Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland). Stripe processes your payment data (credit cards, SEPA, etc.) directly. We do not receive full payment data. The Stripe Privacy Policy applies.
For in-app purchases on mobile devices, we use RevenueCat (RevenueCat, Inc., USA) to manage subscriptions. Payment processing itself is handled via the Apple App Store or the Google Play Store. We do not receive any payment data, only the subscription status.
Voice recordings that you create in the app (e.g., your own read-aloud recordings) are stored exclusively locally on your device. They are never transferred to our servers.
Our application is hosted on the following platforms:
Data transfer to the USA is based on EU Standard Contractual Clauses pursuant to Art. 46 (2) lit. c GDPR.
To detect and fix technical errors, we use Sentry (Sentry Software S.A., Luxembourg / Functional Software, Inc., USA). Sentry automatically receives error reports and performance data in the event of app crashes or malfunctions. No content of your stories is transmitted. Further information: Sentry Privacy Policy.
Generated images and audio files are stored on Cloudflare R2 (Cloudflare, Inc., USA). Cloudflare R2 stores data in encrypted form and does not access content. The Cloudflare Privacy Policy applies.
When you sign in with Apple, Apple transmits your Apple ID e-mail address and (if applicable) your name to us. Sign-in is provided by Apple Inc. (One Apple Park Way, Cupertino, CA, USA). The Apple Privacy Policy applies.
To protect our services from abuse and overload, we use technical security measures:
The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in the security and availability of our services).
To monitor application performance, we use:
The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in technical optimization).
We use anonymized usage statistics to improve the app. No personal data is shared with third parties for advertising purposes. We do not use tracking for advertising purposes.
Our web app does not use advertising or tracking cookies. We use technically necessary cookies and local storage (localStorage) for:
Under the GDPR, you have the following rights:
To exercise your rights, contact us at support@bajkiki.com.
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).
We use SSL/TLS encryption for all data transmissions. Passwords are stored only as hashed values. Access to personal data is strictly limited to authorized persons.
We have concluded data processing agreements (DPAs) pursuant to Art. 28 GDPR with all service providers used, ensuring GDPR-compliant processing.
Last updated: June 2026