1. Introduction
Hadoota ("we", "us", "our") operates the Hadoota platform at hadoota.me. This Privacy Policy describes how we collect, use, and protect your personal information when you use our service. By creating an account or using the Platform you confirm you are at least 18 years old.
2. Information We Collect
Account Information
- Email address and display name
- Authentication credentials (hashed passwords or OAuth tokens from Google or Apple)
- Optional profile fields: first/last name, country, city
- Payment information (processed and stored securely by Stripe — we never store card numbers)
- Subscription and billing history
Kid Profile Information
A kid profile is a personalization context under your account — it tells the AI who the story is being created for so the writing style, narrator voice, and illustrations match. Kid profiles do not have separate logins. You can create, edit, or delete kid profiles from your dashboard at any time.
- Display name, age, and preferred language
- Optional: avatar image, interests, target reading-level type, narrator voice and illustration style hints
- Story creation history and conversation data tied to the kid profile
- Voice recordings (processed in real-time for speech-to-text, not permanently stored)
Automatically Collected Information
- Usage analytics (pages visited, features used, story creation events)
- Device and browser information; client type and app version (mobile / web)
- IP address (for security, rate limiting, and regional content surfacing)
- Mobile push notification token (if you grant notification permission)
3. How We Use Your Information
- To provide and improve the story creation service
- To generate AI-powered stories and illustrations from your input
- To surface activity insights, story performance, and content alerts on your dashboard
- To process payments and manage subscriptions
- To moderate AI-generated content for safety and to act on user reports
- To send important service notifications (we do not send marketing without consent)
4. AI Processing
We use Google Vertex AI (Gemini) for text generation and Google Imagen for illustration generation. Your conversation data is sent to these services to create stories. We also use Google Speech-to-Text for voice input and Hamsa AI for Arabic text-to-speech. These services process data in accordance with their privacy policies. We do not use your data to train AI models.
5. Age Eligibility
You must be at least 18 years old to create an account. The Platform does not knowingly collect personal information from anyone under 18 as an account holder. Kid profiles are personalization contexts under your user account; they are not separate accounts and have no login of their own. If you believe an underage user has registered an account, contact us at privacy@hadoota.me and we will delete it.
6. User-Generated Content & Moderation
The Platform lets users publish their stories to a discovery feed and follow other users. To keep the community safe:
- AI generation runs through automated content filters before any output is shown.
- Reports — you can report any story or user from inside the app or web. We review reports within 24 hours and may remove content or suspend accounts.
- Blocks — you can block another user; their content disappears from your feed instantly and they cannot follow you.
- Audit log — flagged AI generations are logged on the dashboard so you can see what was filtered.
7. Data Sharing
We do not sell personal data. We share data only with:
- AI service providers (Google Vertex AI, Google Imagen, Google Speech-to-Text, Hamsa AI) — for story, illustration, and voice generation
- Payment processor (Stripe) — for subscription billing
- Cloud infrastructure (Google Cloud Platform) — for hosting and storage
- Authentication (Google Firebase Authentication) — for sign-in
- Push notifications (Apple APNs, Google FCM via Firebase Cloud Messaging) — for in-app alerts
- Analytics (Google Firebase Analytics) — for product usage understanding; aggregated and pseudonymous
- Crash reporting (Google Firebase Crashlytics) — for diagnosing app crashes
- Law enforcement — when required by law or to protect user safety
8. Data Security
- All data is encrypted in transit (TLS/HTTPS) and at rest
- Passwords are hashed using bcrypt with industry-standard salt rounds
- Payment data is handled by Stripe (PCI DSS compliant) — we never see or store card numbers
- Database access is restricted to authorized services via private networking
- We conduct regular security reviews and monitoring
9. Data Retention
- Active accounts: data retained for the lifetime of the account
- Deleted accounts: personal data removed after the 30-day grace period; financial records anonymized but retained for 7 years per applicable financial-compliance requirements
- Voice recordings: processed in real-time and not permanently stored
- AI conversation logs: retained for service improvement and dashboard insights
- Moderation records (reports, blocks, flagged content): retained while the account is active and for the legal retention window after deletion
10. Your Rights
- Access — view your data via your dashboard
- Correction — update profile information at any time
- Deletion — request account deletion in-app or on the web; a 30-day grace period applies (learn more)
- Export — contact support to request a data export
- Restriction — contact support to restrict processing of your data
11. International Data Transfers
Hadoota operates globally, serving users in the Middle East and the United States. Data may be processed in different regions where our cloud infrastructure is located (Google Cloud Platform). We ensure appropriate safeguards are in place for international data transfers.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app prompt. The updated policy will be posted on this page with a new effective date.
13. Contact Us
For privacy-related questions or to exercise your rights, contact us at privacy@hadoota.me.