Privacy Policy

Tell Me ("we", "us", "our") is operated by Tell Me Stories Ltd, a company registered in Scotland with its registered office at Office 416, 18 Young Street, Unit LGE, Edinburgh EH2 4JB. We are committed to protecting your privacy and handling your data with care and transparency.

This policy explains what data we collect, why we collect it, how we use it, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who we are

Tell Me is a subscription service that helps families capture stories from their loved ones. When we refer to "host" we mean the person who creates an account and pays for the service. When we refer to "storyteller" we mean the person whose stories are being captured.

Data Controller: Tell Me Stories Ltd
Registered office: Office 416, 18 Young Street, Unit LGE, Edinburgh EH2 4JB, Scotland
Contact: privacy@tellme.bio

2. What data we collect

From hosts (account holders)

• Account information: name, email address, password (encrypted)
• Billing information: processed and stored by Stripe. We never see or store your full card number.
• Storyteller details you provide: storyteller's name, nickname, gender, decade of birth, phone number or email address, delivery preferences, relationship information, and topic preferences
• Photos: profile pictures and any photos you add to questions or stories. You can upload these from your photo library or take one with your camera.
• Custom question recordings: if you record a spoken version of a question you've written, we store that audio so it can be sent to your storyteller.
• Contacts (app only, optional): if you grant permission, the Tell Me app reads your device's contacts so you can pick a loved one's phone number instead of typing it. This happens on your device — we only save the single number you choose; your contact list is never uploaded or stored.

From storytellers

• Story responses: text messages and voice recordings sent in reply to our questions
• Transcriptions: text versions of voice recordings, generated by AI
• Enriched stories: AI-enhanced narrative versions of their responses
• Contact information: phone number (for WhatsApp) or email address, as provided by the host
• Device information: if using the Tell Me app, we store an anonymous push notification token
• How you found us: the first page you landed on, the site that sent you (if any) and any campaign tags in the link, from the visit in which you created your account

From people who ask for our guide

If you give us your email address to read the rest of How to tell your mum or dad you want their stories — on that page, in the offer on our homepage, or by asking us to email you the message you put together — we keep:

• Your email address, the wording you agreed to and when you agreed to it
• Where you came from: the first page you landed on, the site that sent you (if any), any campaign tags in the link, and your country
• The choices you made in the message builder (who you're asking, the tone, WhatsApp or email, the day) — never any free text
• Whether you later created an account, so we stop emailing you about the guide

We use this to send you the guide straight away and one follow-up email, on a Sunday afternoon, about a week later. That's all. Every email has a one-click unsubscribe link, and the address is never passed to an advertising platform in plain text.

Automatically collected

• Page counts: a plain tally of how many times each page is viewed, how many visits the site gets, how far down each page people scroll, which links get clicked and which of our own posted links (the campaign tags on the address) brought the visit — kept without cookies and with nothing that identifies you
• Visit records (everyone): for each visit to the website, the IP address you connected from, your browser and device type, your rough location (the town, not the address), the page you arrived on and the site or link that sent you, then the pages you read in order — how long on each, how far down you scrolled and which links you clicked. If you give us your email or create an account, on the website or in the Tell Me app, we link it to that visit; for an account made in the app, we look for a visit from the same IP address in the 30 days before. We use this to see how people find Tell Me and where the website loses them. The IP address is removed after 30 days and the rest deleted after 90. We never record visits from a browser that sends a Global Privacy Control signal, and you can object at any time by emailing privacy@tellme.bio.
• Usage data (with your consent to analytics cookies): pages visited, features used, timestamps
• Technical data (with your consent to analytics cookies): browser type, device type, IP address (removed after 30 days; the rest deleted after 90)
• Diagnostics (app only): if you use the Tell Me app, crash reports and error logs — including device model, operating system version, and app version — to help us find and fix problems
• Cookies: see our Cookie Policy

3. How we use your data

Purpose	Legal basis
Providing the Tell Me service (sending questions, processing responses, building the story archive)	Performance of contract
Processing payments via Stripe	Performance of contract
Sending service emails (new story notifications, account updates)	Performance of contract
Transcribing voice recordings using AI (OpenAI Whisper)	Performance of contract
Enriching stories using AI (Anthropic Claude)	Performance of contract
Sending WhatsApp messages via Meta's WhatsApp Cloud API	Performance of contract
Keeping a record of the emails we send — whether each one was delivered and opened — so we can tell when questions aren't reaching someone	Legitimate interest
Improving the service and fixing bugs	Legitimate interest
Keeping a record of each visit to the website — where it came from, the pages read, where it stopped, and whether it led to an account — so we can see how people find Tell Me and fix the places the website loses them	Legitimate interest
Crash reporting and error diagnostics (app only)	Legitimate interest
Sending our "How to tell your mum or dad" guide and one follow-up email to people who ask for it (one-click unsubscribe in every email)	Consent
Sending marketing emails (only with your explicit consent)	Consent
Measuring which of our adverts work (only if you accept marketing cookies — see below)	Consent

4. AI processing

We use artificial intelligence in two ways:

• Transcription: Voice recordings are sent to OpenAI's Whisper API to generate text transcripts. OpenAI does not use this data to train their models under our data processing agreement.
• Story enrichment: Transcripts and text responses are sent to Anthropic's Claude API to create enriched narrative versions. Anthropic does not use this data to train their models under our data processing agreement.

In both cases, the original recording and raw transcript are always preserved alongside the AI-enriched version. We enrich, we never replace.

5. Third-party services

We share data with the following processors, all under appropriate data processing agreements:

Service	Purpose	Data shared
Stripe	Payment processing	Name, email, billing information
OpenAI (Whisper)	Voice transcription	Voice recordings
Anthropic (Claude)	Story enrichment	Text transcripts and responses
Meta (WhatsApp Cloud API)	Message delivery	Phone number, message content
Mailgun (Sinch)	Sending and receiving email	Email address, email content, and whether each email was delivered and opened
Expo	Push notifications (app only)	Anonymous device tokens
Sentry (Functional Software, Inc.)	Crash & error monitoring (app only)	Diagnostic data: device and OS info, app version, error logs
Meta (Facebook & Instagram ads)	Measuring our adverts (marketing cookies only)	Hashed email and name, Meta cookie and ad-click IDs, and for gift purchases your IP address and browser type
Google (Google Analytics)	Measuring our adverts (marketing cookies only)	Google Analytics cookie ID, your Tell Me account number, and what happened (for example, a purchase and its amount)

We do not sell, rent, or trade your personal data to any third party.

Knowing an email arrived

Our emails carry a tiny invisible image. When your mail app loads it, Mailgun tells us the email was opened, along with the kind of device and the rough area (the town, not the address). We keep that, and whether the email was delivered, so we can notice when a question isn't getting through. We don't keep a copy of the email itself, and we don't keep the IP address it was opened from. Some mail apps load images on their own and some block them, so it's a guide rather than a certainty.

Measuring our adverts

We advertise on Facebook and Instagram, and we'd like to know which adverts actually bring people to Tell Me. So if you accept marketing cookies, we tell Meta and Google Analytics when you sign up, add your first storyteller, start a subscription or buy a gift — and, for a subscription or gift, how much it cost.

To match that to the advert you saw, we send your email address and name hashed (scrambled one way, so the original can't be read back — Meta can only match it against people it already knows), along with the IDs from their cookies. When you buy a gift we also send the IP address and browser type you bought from; we keep those only until the message has gone, then delete them.

We never send your stories, recordings, questions or anything about the person telling them. If you don't accept marketing cookies, none of this happens. You can change your mind at any time in cookie settings, and we'll stop from then on.

6. Data storage and security

• All data is stored on servers located in the United Kingdom
• Data is encrypted in transit (TLS); recordings and photos are stored on encrypted-at-rest storage, and backups are additionally encrypted by us with a key held offline
• Passwords are hashed using bcrypt — we cannot read them
• Access to production systems is restricted to authorised personnel only
• We conduct regular security reviews of our systems

For a plain-language account of where stories live, who can see them, and the things we will never do with them, read Looking after your stories.

7. Data retention

• Stories, recordings, and transcripts: retained for as long as you have an active account or Legacy subscription. We never delete stories while your account is active — they're too important.
• Account data: retained until you delete your account. After you request deletion, your data is permanently removed following a short grace period (currently 14 days), during which you can still recover your account.
• Billing data: retained by Stripe in accordance with their retention policy and legal requirements
• Email delivery records: who each email went to, its subject, and whether it was delivered and opened — deleted after 12 months.
• Usage and technical data: IP addresses (on page views, visit records and the address an account was created from) removed after 30 days; detailed page views and visit records deleted after 90. The cookie-free page counts, which identify nobody, are kept for two years.
• Advert measurement: the IP address and browser type sent with a gift purchase are deleted as soon as Meta has been told. What Meta and Google keep is governed by their own policies.
• Guide email list: kept until you unsubscribe or create an account. Once you unsubscribe we keep only enough to make sure we never email that address about the guide again; email privacy@tellme.bio if you'd like it removed entirely.

8. Your rights (UK GDPR)

You have the following rights regarding your personal data:

• Right of access: request a copy of all data we hold about you
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your data ("right to be forgotten")
• Right to restrict processing: limit how we use your data
• Right to data portability: receive your data in a machine-readable format
• Right to object: object to processing based on legitimate interest
• Right to withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@tellme.bio. We will respond within 30 days. You can also delete your account yourself at any time — in the Tell Me app under Account → Delete my account, or from your account settings on the web.

9. Storyteller consent

The host is responsible for informing the storyteller about Tell Me before the first message is sent. We send storytellers a consent message explaining the service and asking them to confirm they're happy to participate. Storytellers can stop at any time by replying "STOP" or by asking their family member (the host) to pause or remove them.

10. Children's data

Account holders (hosts) must be 18 or over, as set out in our Terms of Service. Tell Me is not designed for use by children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

11. International transfers

Some of our third-party processors (OpenAI, Anthropic, Stripe, Expo, and Sentry) are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses and adequacy decisions where applicable.

12. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email. The "last updated" date at the top of this page indicates when the policy was last revised.

13. Complaints

If you're unhappy with how we've handled your data, please contact us first at privacy@tellme.bio. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

14. Contact us

For any privacy-related questions or requests:
Email: privacy@tellme.bio
General enquiries: hello@tellme.bio