Institutional Child Privacy & Security Policy

1. Who May Provide Children's Information

ChupiTales group-ordering tools are intended for adults. Children should not create accounts or submit their own information or photographs directly to ChupiTales.

Children's information may be provided:

• By an authorized representative. A teacher, administrator, employee, or other authorized adult may create books for children in the group. Before submitting children's information, that person must confirm that they are authorized to do so and that any permissions required from parents or legal guardians by applicable law or organizational policy have been obtained.
• By a parent or legal guardian. An organization may send parents individual links allowing them to create their own child's book. The parent or guardian must confirm their relationship to the child and authorize the use of the information to create and fulfill the book.

2. Information We Process

Depending on the book and personalization options, we may process:

• Child's first name, age, gender, and relevant personalization selections
• An uploaded photograph
• Selected book or story and customer-provided customizations
• Personalized illustrations and completed book files
• Information needed to manage, print, deliver, and support the order

We collect only information reasonably necessary to provide the requested service.

3. How We Use Children's Information

Children's information is used only to:

• Create and fulfill the personalized book
• Provide support, corrections, reprints, and dispute resolution
• Protect the security and integrity of our service

We do not sell children's personal information or use children's photos or personalization information for targeted advertising, behavioral advertising, advertising profiles, or unrelated commercial purposes.

Customer-uploaded photographs are not used by ChupiTales to train AI models.

Communications With Parents

Parents or guardians who create a book through an organization's invitation link may separately choose to receive offers, news, and promotions from ChupiTales.

Marketing communications use the adult's contact information and are separate from the child's personalization information. Marketing enrollment is optional, and recipients may unsubscribe at any time.

Children's photos and institutional personalization information are not used to determine which marketing offers a parent receives.

4. AI-Assisted Personalization and Service Providers

ChupiTales uses technology, including artificial-intelligence tools, to create personalized illustrations.

We also use service providers for necessary functions such as technology infrastructure, image processing, printing, fulfillment, and communications. We share only information reasonably necessary for those services.

Our paid AI services are selected and configured so that customer content is not used for general AI model improvement.

ChupiTales does not use children's photographs for facial recognition or identity verification and does not intentionally create reusable biometric profiles for identifying children.

5. Photo Retention and Deletion

Original uploaded photographs are deleted from ChupiTales' active systems within 30 days after the final book in the applicable order is sent.

If a dispute is opened before deletion, relevant photographs may be retained while the dispute is active and will be deleted within 30 days after the dispute is closed.

Institutional-order photographs are not retained for future purchases. A new photograph must be uploaded for a future book.

Temporary processing files are deleted when no longer reasonably needed.

Personalized illustrations, completed book files, and order records may be retained longer where reasonably necessary for customer access, support, reprints, transaction records, fraud prevention, dispute resolution, or legal obligations.

Some service providers may retain limited technical or security records according to their systems, contractual obligations, or applicable law.

6. Security

ChupiTales uses reasonable safeguards designed to protect children's information, including:

• Encrypted transmission
• Controlled and restricted access
• Secure storage practices
• Limited access by personnel and service providers with a legitimate need
• Data-retention and deletion procedures
• Security monitoring and incident-response procedures

No online service can guarantee absolute security, but we treat children's photographs and personalization information as sensitive information requiring particular care.

7. Parent and Guardian Requests

A parent or legal guardian may contact us regarding information associated with their child and, where applicable, request access, correction, or deletion.

Requests may be sent to:

support@chupitales.com

We may request reasonable information to verify the requester's identity and authority.

We aim to process verified privacy requests within 30 days, unless applicable law or an institutional agreement requires a different timeframe.

Certain transaction, accounting, fraud-prevention, dispute, or legal records may need to be retained after other personal information is deleted.

8. Responsibilities of Organizations

Organizations and their representatives are responsible for ensuring that:

• They are authorized to submit children's information
• Any required parent or guardian permissions have been obtained
• Their use of ChupiTales complies with applicable requirements and their own policies
• Accounts and creation links are shared only with authorized people
• Information submitted for personalization is accurate and appropriate

These responsibilities do not reduce ChupiTales' own privacy and security obligations.

9. U.S. Children's Privacy Requirements

ChupiTales' institutional workflows are designed for adults and with applicable U.S. privacy requirements in mind, including the Children's Online Privacy Protection Act (COPPA) where applicable and applicable state privacy laws.

Children's information in these workflows is provided by adult organization representatives, parents, or legal guardians rather than directly by children.

Additional requirements may apply depending on the organization, location, or information involved.

10. Public Schools and FERPA

Public schools, school districts, and certain other educational institutions may have additional obligations under the Family Educational Rights and Privacy Act (FERPA), state student-privacy laws, district policies, procurement rules, or contractual requirements.

Schools and districts are responsible for ensuring that requirements applicable to their disclosure of student information are satisfied before submitting that information to ChupiTales. Depending on the circumstances, this may require parental consent, another lawful basis for disclosure, a Data Privacy Agreement, or additional protections.

Where a school cannot or does not wish to provide student information directly, it may send parents individual ChupiTales creation links so parents or guardians provide their child's information themselves.

ChupiTales does not claim to be "FERPA certified" or "FERPA approved." Our processes are designed to support organizations in using ChupiTales consistently with requirements that apply to them.

11. Changes to This Policy

We may update this policy as our services, technology, or applicable requirements change.

The current version will display its effective or last-updated date, and material changes affecting how children's information is handled will be reflected here.

12. Contact Us

For questions about privacy, security, institutional orders, or a child's information, contact:

support@chupitales.com