Privacy Policy

1. Who we are

OnceTold is operated from New Zealand. We provide a platform that transforms voice recordings into memoir books, audio stories, and tribute videos. Our contact email is hello@oncetold.app.

2. What information we collect

• Contact information: Your name and email address when you place an order.
• Payment information: Processed securely by Stripe. We never see or store your card details.
• Voice recordings: Audio recordings you make or upload as part of your order.
• Photos and documents: Any photos or documents you upload to include in your memoir.
• Story content: Typed answers, written documents, and other content you provide.
• Usage data: Basic analytics about how you interact with our website (no advertising trackers).

3. How we use your information

• To process your order and produce your memoir, audio story, or tribute video.
• To send you your completed files and order-related communications.
• To provide customer support if you contact us.
• To improve our service over time.

We do not sell your personal information. We do not use your story content for advertising or marketing purposes. Your memories are yours.

4. Third-party services

We use the following trusted third-party services to operate our platform:

• Stripe — payment processing (stripe.com/privacy)
• Supabase — secure data storage (supabase.com/privacy)
• Anthropic (Claude) — AI writing assistance
• ElevenLabs — audio production
• Gelato — print fulfilment for physical books
• Vercel — website hosting

Each of these providers has their own privacy policy. We only share the minimum information necessary for them to provide their service.

5. Storage and deletion

• Voice recordings and call transcripts: Deleted 90 days after your order is delivered. We'll email you a reminder before deletion.
• Generated files (PDF, audio memoir, written story): Deleted 90 days after delivery.
• Order and account data: Kept for as long as your account is active.

We will send you reminder emails before any files are deleted so you have time to download them.

Voice cloning: When you select the "Audio in their voice" option, we temporarily create a voice model from the call recording to generate the audio memoir. This voice model is permanently deleted immediately after the audio file is created. We never store voice models beyond the generation process.

6. Your rights (NZ Privacy Act 2020)

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you.
• Request correction of any inaccurate information.
• Request deletion of your data (subject to legal obligations).
• Withdraw consent for processing at any time.
• Request deletion of your recordings and transcripts at any time by emailing hello@oncetold.app.

To exercise any of these rights, email us at hello@oncetold.app.

7. Cookies

We use only essential cookies necessary for the website to function. We do not use advertising or tracking cookies.

8. Phone Call Recordings & Consent

When Ivy calls a person to capture their story, we ask for explicit verbal consent at the start of every call. The consent is recorded with a timestamp. If the person does not consent, the call ends immediately and no recording is made. You can withdraw consent at any time during the call by saying so.

9. Children's Privacy

OnceTold is primarily a service for adults capturing the life stories of family members. Where the interview subject is under 18, the following additional protections apply:

• A parent or guardian must provide explicit consent before any session involving a minor begins.
• We collect only what is necessary to produce the story — voice recordings and transcripts from the interview session.
• We do not use minors' story content for advertising or share it with third parties.
• Ivy is an AI — not a human interviewer. All subjects are informed of this before any session begins.
• Ivy will not ask minors about traumatic experiences, abuse, or sensitive personal history. If sensitive content arises unprompted, Ivy will redirect and encourage the subject to speak with a trusted adult.
• Parents or guardians may request access to, correction of, or deletion of their child's data at any time by contacting hello@oncetold.app.
• OnceTold complies with the New Zealand Privacy Act 2020.

If you have questions about how we handle a minor's information, contact us at hello@oncetold.app.

10. International customers (GDPR)

OnceTold serves customers globally. If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Legal basis for processing: We process your data on the basis of contract performance (to fulfil your order) and legitimate interests (to improve our service).
• Data transfers: Your data may be processed in countries outside the EEA (including New Zealand, the United States, and Singapore) by our third-party service providers. New Zealand has an EU adequacy decision, meaning data transfers to NZ are permitted under GDPR.
• Right to portability: You may request a copy of your personal data in a machine-readable format.
• Right to object: You may object to processing based on legitimate interests.
• Right to lodge a complaint: You may lodge a complaint with your local data protection authority.

To exercise any GDPR rights, contact us at hello@oncetold.app. We will respond within 30 days.

11. Changes to this policy

We may update this policy from time to time. We will notify active customers of any material changes by email. Continued use of our service after changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or requests, contact us at hello@oncetold.app.