Privacy notice

ReadyStories (readystories.com) is run by Conor Govey, a sole trader in the UK. You can contact us at hello@readystories.com. ReadyStories is the controller for school staff (accounts, sign-ups and feedback), website visitors and our own marketing emails. If a parent or anyone else contacts us directly, we're also the controller for that correspondence. ReadyStories is a trading name of Conor Govey, registered with the Information Commissioner's Office under registration number ZC282126.

Pupil data: your school is the controller of its pupils' data. ReadyStories processes that data only on your school's instructions, to provide the service.

Contact: hello@readystories.com

We collect information from school staff and other adults. We don't collect it from pupils.

• Founding-schools sign-up (/founding-schools): first name, school email, role, school name and, if you choose to tell us, what you currently use social stories for. We also record which link brought you to us (for example "linkedin") and the time and wording of your sign-up.
• Free calendar (/free-calendar): first name, email, role, school name (optional), and whether you ticked the box to receive occasional emails. We record the wording you agreed to, the time, and which link brought you to us.
• Feedback form (/feedback): name, email, role, school name (optional), your answers and, only if you give permission, a quote we may use on our website and in marketing.
• ReadyStories accounts: your name, email and login details, and which school you belong to.
• Payments: when paid plans launch, payments will be handled by Stripe. We won't see or store full card details.
• Downloaded PDFs: story PDFs are made in your browser. Once you've downloaded or printed one, it's the school's responsibility, and we can't control or delete copies.
• Website visits: basic visit statistics. See section 7.

When school staff use ReadyStories, it saves:

• Pupil profile: the name staff enter (we ask for a first name or nickname only, but the app doesn't enforce this), class, key stage and reading level, and an optional "what helps" note.
• Appearance and support details: gender, appearance, clothing, support items (such as ear defenders or a wheelchair) and the avatar drawn from them.
• Story inputs: the situation, feelings and notes staff type in.
• Generated stories: story text and pictures, cast sheets, and up to five previous versions of each story.
• Family adults: names, roles and avatars of any family adults added to a story.
• Boards and visual supports staff create.

We never ask for photos of pupils, and there's no way to upload one to a pupil profile. We don't ask for dates of birth, addresses, diagnoses or EHCP details. Free-text boxes can hold anything typed into them, so please don't type surnames, other people's names, or sensitive details such as health, diagnoses or family circumstances.

Only staff at your school who have been invited by your school's admin can see pupils and stories. Pictures are shown using links that expire after an hour. The picture files themselves stay in storage until they're deleted.

Stories are written by Google's Gemini models, which we access through OpenRouter (USA). Pictures are drawn by Google's Gemini image model ("Nano Banana 2"), which OpenRouter reaches through Google AI Studio.

AI processing happens in the USA. Story and picture requests are sent through OpenRouter in the USA to Google's models.

Before a request goes to AI, we replace the names we know about (pupils, staff and family adults) with placeholders, and put the real names back inside ReadyStories. This can't catch every name, for example a name typed into a note or a clothing description, so a name could still reach the AI. That's why we ask staff not to type surnames, other names or sensitive details.

We tell AI providers not to collect or train on the content we send. Where our AI providers offer it, we ask them not to keep the story text we send. Pictures are drawn through Google AI Studio, which may keep image requests for up to 55 days in the USA to monitor for abuse.

Read-aloud uses your browser's built-in speech, so the text may be processed by your browser or device maker's speech service.

School and pupil data is stored with Lovable Cloud (which runs on Supabase) in the EU (Ireland). Pictures and pages are delivered through a global content delivery network (Cloudflare) so they load quickly.

• Lovable / Supabase: hosting, accounts and database (EU, Ireland)
• Cloudflare: website delivery and security (global)
• OpenRouter (USA): routes story and picture requests to AI models
• Google (Gemini and Google AI Studio): writes stories and draws pictures. Image requests may be kept for up to 55 days in the USA.
• Brevo (EU, used only for ReadyStories): sign-up, welcome, programme and newsletter emails
• Stripe: when paid plans launch, payments will be handled by Stripe
• Unsplash: (inside the app only) receives the search words staff type when swapping in a real photo of a place or object, so please don't type names there
• Your browser's speech service: read-aloud

We don't sell your data.

We use as few cookies as possible:

• session-id (Lovable analytics, 30 minutes). This counts visits and shows which pages and links people use, so we can improve the site. It's used only for overall statistics, not to profile you. Lovable provides this on our behalf.
• __cf_bm (Cloudflare, about 30 minutes). This protects the site from bots, and the site needs it to work.
• __dpl (Lovable, about 7 days). This makes sure you're served the current version of the site, and the site needs it to work.
• Login cookies or storage, if you sign in to ReadyStories. The service needs these to work.

Turning off visit statistics: You can turn off analytics at any time with the "Turn off analytics" link in the footer. We'll remember your choice on this device.

• Founding-schools programme: when you tick "I'd like to join the ReadyStories founding-schools programme." we use your details to run the programme and email you about it (legitimate interests, in providing what you asked for). Tips and news emails are sent only if you also tick the optional box "Yes, also send me occasional social story tips and ReadyStories news." (your consent). You can unsubscribe from either at any time.
• Free calendar: we use your details to send you the calendar (legitimate interests, in giving you what you asked for). If you tick "Yes, send me Conor's occasional emails with social story tips and news about ReadyStories, including the founding schools beta. I can unsubscribe at any time.", we also send you occasional emails, based on your consent.
• Feedback: legitimate interests, in improving ReadyStories. A quote is used only with your consent.
• Providing the service to schools: to carry out our agreement with your school.
• Visit statistics: legitimate interests, under the statistical-purposes exception for cookies, with the opt-out in section 7.

Every email we send includes an unsubscribe link. You can also email hello@readystories.com and we'll take you off our lists. Unsubscribing from marketing doesn't affect your school's use of ReadyStories.

We keep data for as short a time as we can. We are putting automatic deletion in place; until then we delete on request. Email hello@readystories.com and we'll delete what you ask for.

Deleting a pupil removes their profile and the stories about them from ReadyStories. Until our clean-up fixes are finished, some picture files may stay in storage. Email us and we'll remove them by hand.

Under UK GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to its use (including for marketing, at any time), to data portability, and to withdraw consent whenever we rely on it. To use any of these rights, email hello@readystories.com. We'll reply within one month.

Pupil data belongs to the school, so parents should contact their child's school first. We'll help the school respond.

If you're unhappy, please tell me first and I'll do my best to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

ReadyStories is for school staff. Children don't use it, don't create accounts and don't give us information. Our forms are for adults only.

School data is stored in the EU (Ireland). AI requests go through OpenRouter in the USA to Google, and Google AI Studio may keep image requests in the USA for up to 55 days. Cloudflare (global) and Unsplash may also process data outside the UK, as will Stripe once paid plans launch. When data leaves the UK, we rely on UK adequacy regulations for the EU, and for US providers the UK–US Data Bridge where the provider is certified, or otherwise the International Data Transfer Addendum (standard contractual clauses).

If anything changes, we'll update this page and the date at the top. If a change is significant, we'll tell signed-up schools by email.

Conor Govey, ReadyStories. Email: hello@readystories.com

Thanks for trusting ReadyStories with your school's stories.
Conor