PRIVACY POLICY

VOLPI STUDIOS (Website and Mobile Application)

Last updated: November 2, 2026

1. INTRODUCTION

At Volpi Studios, S.L. ("Volpi Studios", "we", "our" or "the company"), we take the protection of your personal data very seriously. This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website (volpistudios.com) and our mobile application (Volpi Studios App).

This policy complies with the EU General Data Protection Regulation (GDPR), the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD), and other applicable regulations.

Data controller:
Volpi Studios, S.L.
Tax ID (CIF): B22550123
Address: Peña Vieja 3, Madrid, 28034, Spain
Contact email: [email protected]

2. INFORMATION WE COLLECT

2.1 Information provided directly

  • Registration data: name, email address.
  • Profile data: username (or nickname), age range, language preferences.
  • Subscription and payment data: plan type, subscription status. Card or payment method data is processed directly by Stripe, Apple Pay or Google Pay; we do not store it.
  • Voice recordings: if you use our voice personalization feature, we process your audio recording to generate the personalized story. A voice clone associated with your account will be generated.
  • Contact forms and waitlist: email address, name (optional), and the source from which you registered.

2.2 Information collected automatically

  • App usage data: stories played, preferences, progress, usage time.
  • Technical data: device type, operating system, app version, device identifiers, IP address (anonymized, except as described in section 5.1).
  • Web analytics data: pages visited, time spent, traffic source (with your prior consent or, depending on where you visit us from, by default with a right to object; see section 11.6).
  • Performance & battery diagnostics: device performance, battery and background-activity data (via Apple MetricKit). Aggregated anonymously for overall service health; only linked to your account if you explicitly choose to attach it to a support request. This does not include your story content or voice recordings.

2.3 Data from minors

Volpi Studios is a family service aimed at parents and guardians. We do not collect personal data from children under 16. Any data concerning minors must be notified to the company before it is shared by the parent or guardian.

Account-linked device performance diagnostics (see section 2.2) are collected only through the explicit action of the account holder or user and within the app's support flow. Diagnostic data is never collected silently.

3. HOW WE COLLECT INFORMATION

  • Directly from you: when you register, create a profile, subscribe, fill out a contact form or join the waitlist.
  • Automatically: through analytics cookies (see section 11.6), local storage technologies and server logs.
  • From third parties: if you sign in with Apple or Google, we receive the information you have authorized to share (typically name and email).

4. HOW WE USE YOUR INFORMATION

  • Service delivery: create and manage your account, process subscriptions, offer personalized content.
  • Personalization: adapt story recommendations based on the age and preferences of the profile.
  • Voice processing: generate a personalized story with your voice.
  • Communications: send you confirmations, service updates and, if you have given your consent, commercial communications.
  • Service improvement: analyze usage to improve the experience, fix bugs and develop new features.
  • Diagnostics and troubleshooting: analyze device performance and battery/background-activity data to maintain overall service health and, when you attach diagnostics to a support request, investigate the specific issue you reported.
  • Advertising measurement: find out which ad campaigns bring us new users (see section 5.1).
  • Legal compliance: fulfill tax, contractual and regulatory obligations.

Legal basis for processing (Art. 6 GDPR): contract performance, explicit consent, legitimate interest and legal obligation, as applicable to each purpose.

Anonymous performance diagnostics rely on our legitimate interest in keeping the service reliable; account-linked diagnostics attached to a support request rely on your consent (the explicit in-app opt-in).

5. WHO WE SHARE YOUR INFORMATION WITH

We do not sell your personal data. We only share your information with:

  • Essential service providers:
    • Stripe (payment processing) — see Stripe Privacy Policy
    • Google Analytics 4 (web analytics; see section 11.6)
    • Microsoft Clarity (heatmaps and session recordings; see section 11.6)
    • Google Firebase (crash and performance diagnostics, analytics, push notifications and authentication)
    • Apple and Google authentication services
  • Story personalization services: ElevenLabs and, as an alternative provider, Minimax (anonymized voice and voice clone only, with no data that determines or facilitates personal identification of the user).
  • Meta Platforms Ireland Ltd.: measurement of our advertising campaigns on Facebook and Instagram (see section 5.1).
  • Legal authorities: when required by law or legal process.

All our providers are bound by data processing agreements (DPAs) that ensure the protection of your data in accordance with GDPR.

5.1 Advertising campaign measurement with Meta

We advertise Volpi on Facebook and Instagram. To find out which ads work, we share with Meta Platforms Ireland Ltd. ("Meta") service usage events, such as registration, trial or subscription. They always relate to the adult account holder. We never send Meta data about children, story content or voice recordings.

  • Website.If advertising cookies are on (see section 11.6), we load the Meta Pixel (see section 11.5) and, when you start a trial or your paid subscription is activated on our website, our server reports that event to Meta through the Conversions API with this data: your email address hashed (SHA-256), a pseudonymous identifier of your account, the plan, the amount and the transaction reference, the identifiers from Meta's cookies and, if you arrived from Facebook or Instagram, the identifier of that click. If advertising cookies are off, nothing is sent to Meta from your browser or from our server for purchases made on the website.
  • Android app. When you install the app or register in it, and when you start a trial or subscription from it, our server reports it to Meta through the Conversions API. Without your consent we only send:
    • a pseudonymous identifier of your account, encrypted with a secret key that only Volpi holds;
    • if the install comes from Facebook, Instagram or a Meta ad, the Google Play install referrer;
    • the app and operating system versions;
    • for trials and subscriptions, the plan and amount.

    Only if you give your "advertising measurement" consent do we add your hashed email (SHA-256), your IP address and technical device data (model, language, time zone and screen).

  • iOS app. The app sends no data to Meta. If you install it from an ad, Apple (SKAdNetwork/AdAttributionKit) may send Meta and Volpi an aggregated, anonymous report, with no personal identifiers, containing a value that indicates the stage of use reached (for example, registration, trial or subscription). If you subscribe from your iPhone, payment is completed on our website and what is described above for the website applies.

Our apps do not include the Meta SDK or use your device's advertising identifier (IDFA/AAID).

Legal basis.If you visit us from the European Economic Area, the United Kingdom, Switzerland or Brazil, the Meta Pixel and our server's reporting of trials and subscriptions made on the website rely on your consent; outside those territories, on our legitimate interestin measuring the effectiveness of our advertising, and you may object at any time from "Cookie preferences" (see section 11.6). The additional Android data (hashed email, IP and device data) relies on your consent. The minimal reporting from the Android app relies on our legitimate interestin measuring the effectiveness of our advertising, limited to business events of an adult's account; you may object to it at any time.

Meta's role. Volpi and Meta are joint controllers for the collection and transmission of this data. Meta then processes it as a controller under its Business Tools Terms and its Privacy Policy. Meta may transfer it to Meta Platforms, Inc. (USA), which participates in the EU-US Data Privacy Framework (see section 10).

Retention. The IP and device data we store for consent-based measurement are deleted when you withdraw consent or after 30 days without using the app. Meta keeps the data it receives under its own policy.

How to object or withdraw consent.On the website, reject advertising cookies in the banner or from "Cookie preferences". In the Android app, write to [email protected]. From then on we will stop sending Meta data about your account; data already sent is not affected.

6. HOW LONG WE KEEP YOUR DATA

  • Account data: while your account is active, and up to 30 days after requesting its deletion.
  • Subscription data: during the subscription period plus the legal tax retention period (5 years in Spain).
  • Analytics data: maximum 14 months (per Google Analytics 4 configuration).
  • Support diagnostics data: performance and battery diagnostics linked to your account through a support request are kept for up to 90 days.
  • Waitlist and contact data: up to 2 years after the last interaction, unless you request deletion.

7. SECURITY OF YOUR INFORMATION

We implement appropriate technical and organizational security measures, including:

  • HTTPS/TLS encryption for all communications.
  • We do not store passwords: you sign in with one-time codes sent to your email or with Apple/Google.
  • httpOnly cookies for session authentication.
  • Data access restricted according to the principle of least privilege.
  • Periodic review of security measures.

No system is 100% secure. If we detect a security breach affecting your data, we will notify you in accordance with GDPR (within 72 hours).

8. YOUR RIGHTS (GDPR)

As a data subject, you have the following rights:

  • Access: obtain a copy of the personal data we hold about you.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): request the deletion of your data.
  • Restriction of processing: restrict how we process your data.
  • Data portability: receive your data in a structured, machine-readable format.
  • Objection: object to the processing of your data in certain circumstances.
  • Withdraw consent: at any time, without retroactive effect.

To exercise any of these rights, contact us at [email protected]. We will respond within a maximum of 30 days.

9. HOW TO DELETE YOUR DATA

You can request the deletion of your data in two ways:

  • From the app: go to Settings → Account → Delete my account. This will delete all your personal data and subscription data.
  • By email: send an email to [email protected] with the subject "Data deletion". We will process your request within a maximum of 30 days.

Some data may be retained during the legally required period (for example, tax data for 5 years).

10. INTERNATIONAL DATA TRANSFERS

Some of our service providers may be located outside the European Economic Area (EEA). In these cases, we ensure that transfers are made with appropriate safeguards:

  • Standard contractual clauses approved by the European Commission.
  • EU-US Data Privacy Framework, where applicable.
  • Adequacy decisions by the European Commission for countries with an equivalent level of protection.

11. COOKIES AND WEB TECHNOLOGIES

Our website uses the following technologies:

11.1 Google Analytics 4 and Microsoft Clarity (analytics cookies)

We use Google Analytics 4 and Microsoft Clarity to understand how users interact with our website. Microsoft Clarity produces heatmaps and anonymized session recordings (text field content is masked by default). When these cookies are activated depends on where you visit us from (see section 11.6). While analytics cookies are off, Google Analytics sets no cookies and only receives basic cookieless signals about the visit (such as the page and browser type), without identifiers that recognize you across visits (Google Consent Mode), and Microsoft Clarity is not loaded.

11.2 localStorage (user preferences)

We use the browser's local storage (localStorage) to save your preferences, such as language choice and cookie consent status. This data is stored locally on your device and is not transmitted to our servers.

11.3 Essential cookies (authentication and location)

We use httpOnly cookies for secure session authentication. These cookies are strictly necessary for the operation of the service and do not require consent.

We also use the essential cookie volpi_geo_country, which stores for 24 hours the code of the country you visit us from, derived from your IP address, to apply the cookie options that correspond to your location (see section 11.6). It is needed for that purpose and does not require consent.

11.4 Cookies in the mobile application

The mobile application uses equivalent technologies (session tokens, secure local storage) for authentication and user preferences. No third-party cookies are used for advertising purposes in the app. Advertising campaign measurement in the app does not use cookies and is described in section 5.1.

11.5 Meta Pixel (advertising cookies)

If advertising cookies are on (see section 11.6), we load the Meta Pixel from Meta Platforms Ireland Ltd. The Pixel sets the _fbp cookie and, if you arrive from a Meta ad, _fbc (up to 90 days). It sends Meta, together with your IP address and browser data, the pages you visit and actions such as starting checkout, starting a trial, subscribing or tapping to download the app, to measure our campaigns (see section 5.1). If you turn them off, the Pixel is not loaded and your browser sends nothing to Meta.

11.6 Consent based on your location

Essential cookies are always on. Analytics cookies (section 11.1) and advertising cookies (section 11.5) work as follows:

  • European Economic Area, United Kingdom, Switzerland and Brazil (and whenever we cannot tell where you are visiting from): we do not turn them on until you choose in the banner. You can accept or reject them all, or choose by category under "Customize". Until you choose, Google Analytics runs without cookies (see section 11.1) and neither Microsoft Clarity nor the Meta Pixel is loaded. Legal basis: your consent.
  • Rest of the world:analytics and advertising cookies are on by default, based on our legitimate interest in understanding how the website is used and measuring our campaigns. You can object at any time, by category, from "Cookie preferences" at the bottom of the page (in the US, "Do Not Sell or Share My Personal Information"). We honor your browser's Global Privacy Control signal as an objection to advertising cookies; if you expressly accept them with the signal on, your choice prevails.

We know which country you are visiting from through your IP address (see section 11.3). Your choice is stored in your browser (see section 11.2) and you can change it at any time from "Cookie preferences".

12. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. We will notify you of significant changes through:

  • A notice on our website or application.
  • An email to the address associated with your account.
  • A push notification in the application (if enabled).

The date of the last update appears at the beginning of this document. We recommend reviewing it periodically.

13. CONTACT AND PRIVACY SUPPORT

For any query, complaint or request related to the privacy of your data, you can contact us at:

We commit to responding to all requests within a maximum of 30 days.

14. SUPERVISORY AUTHORITY

If you consider that the processing of your personal data infringes applicable regulations, you have the right to file a complaint with the competent supervisory authority:

  • Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD)
  • Website: www.aepd.es
  • C/ Jorge Juan, 6 — 28001 Madrid, Spain

However, we encourage you to contact us first to try to resolve any issue directly.