Last updated: 23 July 2026
The Bedtime Post (Netherlands, KvK 42092954, BTW-ID NL005491455B30) — "we"/"us" in this policy, and the data controller — delivers personalized children's bedtime stories to parents by email. We take privacy seriously — especially because our stories feature children. This policy explains what we collect, why, and your rights under the GDPR and UK GDPR. Questions: stories@thebedtimepost.com.
From you (the parent or guardian): your email address, your child's first name (or two siblings' first names), an age range, whether the story hero is a boy or a girl, and your timezone. That is the complete list — we deliberately do not collect surnames, dates of birth, photos, or any other information about your child.
Payments: handled entirely by Stripe. We never see or store your card or bank details. Stripe's privacy policy is at stripe.com/privacy.
Cookies: our website sets no tracking or advertising cookies.
We use your email address to deliver the nightly story and essential service messages (lawful basis: performance of our contract with you). We use your child's first name, age range and boy/girl selection solely to personalize the stories you receive (same basis — it is the product you asked for). We do not send marketing emails without separate consent, we never use your child's information for advertising or profiling, and we never sell any data.
Our service is offered to adults (18+). Children cannot create accounts. The only information about a child that we hold is the first name, age range and boy/girl selection that you, the parent or guardian, choose to give us. Notably, your child's name is never sent to our AI provider: stories are generated as templates and your child's name is inserted on our own server at the moment your email is sent.
Stripe (payments and billing), Resend (email delivery, EU region), Anthropic (story generation — receives no personal data), Cloudflare (DNS), Google Workspace (our support mailbox), and Google Cloud (hosting). Each acts under contractual data-protection terms.
Your child's details are deleted from our records as soon as stories stop: immediately if you use "stop emails now", or at the end of your paid period if you choose to keep receiving stories until then. We retain your email address and subscription status as long as needed for legal, billing and suppression purposes, then delete it. Invoicing records are kept for the period Dutch tax law requires (7 years). The full schedule — every data type, how long, and how deletion is automated — is in our data retention policy.
You may at any time request access to the data we hold about you and your child, its correction, its deletion, a portable copy, or the restriction of or objection to its processing.
How to ask: email stories@thebedtimepost.com with the subject "Data request", from the email address your subscription uses (that is how we verify it's you — if you write from a different address we will ask you to confirm from the subscription address). Tell us which right you are exercising.
What happens next: we confirm receipt, act on the request free of charge, and respond within one month (if a request is unusually complex we may extend by up to two further months, and will tell you why within the first month). Deletion requests remove your child's details and your subscriber record immediately, keeping only what invoicing and tax law oblige us to retain.
If you are unhappy with our response you may complain to the Dutch data-protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in your own country.
If we change this policy in a way that matters, we will tell you by email before the change takes effect.