Privacy Policy

Last updated: 9 September 2026

Please read this Privacy Policy (the "Policy") to understand how we collect, use, disclose and protect your personal data and your child's personal data when you use Bedtime Bay. It is written to comply with the Personal Data Protection Act 2012 of Singapore (the "PDPA") and, for users in other countries, with the data-protection laws that apply to them to the extent required.

1. Definitions

• Organisation / Company / we: Zeta Pegasi Labs Pte. Ltd., UEN 202636586D, 152 Beach Road, #23-02 Gateway East, Singapore 189721, which determines the purposes and means of processing personal data in connection with the Service.
• Data intermediary / processor: any third party that processes personal data on the Company's behalf, such as the hosting, email, voice-generation and text-generation providers listed in Section 8.
• User / you: any adult natural person, in Singapore or elsewhere, who uses the Platform as the parent or legal guardian of a child.
• Child: the minor whose details the User enters so that stories can be personalised; the Child does not use the Platform directly.
• Personal data: data, whether true or not, about an individual who can be identified from that data alone or together with other information.

2. Who we are

Bedtime Bay is an online platform owned and operated by Zeta Pegasi Labs Pte. Ltd., a private limited company incorporated in Singapore (the "Platform", "we", "us", the "Company"). The Platform delivers personalised bedtime stories for children and is intended for parents and legal guardians ("User", "you").

The Platform provides digital entertainment and educational services consisting of: (1) a library of bedtime stories in English, personalised with the Child's name and gender; (2) "Write your own story", which generates a custom story with artificial intelligence from the User's choices; (3) narration in a male or female narrator voice chosen by the User; (4) voice cloning, which lets a parent record their own voice to narrate the stories; and (5) a "My stories" archive of past stories. The Service is provided through the website bedtimebay.com and may later be provided through a mobile application to which this Policy applies equally.

3. About this Policy

Purpose. This Policy sets out how personal data is collected, used, disclosed and protected in connection with the Platform. We use your personal data only to the extent permitted by law and for the purposes for which it was collected: performing our contract with you, providing, personalising and improving our services, protecting the Service against fraud and abuse, and complying with our legal obligations.

Conflict. If there is any conflict between the Terms and Conditions and this Policy in relation to personal data, this Policy prevails.

Changes. We may amend this Policy from time to time to reflect changes in our practices or in applicable law. Amendments are published on the website with an updated "Last updated" date and take effect on publication, except for material changes that alter the basis of processing or of your consent, which we will notify to you by the email registered on your account or through the Platform before they take effect, and for which we will obtain your consent where the law requires it.

4. Scope

Personal scope: this Policy applies to every natural person who visits the Platform, creates an account, or contacts us, and to the Children whose details Users enter.

Material scope: this Policy applies to all processing of personal data carried out by the Company or on its behalf in connection with its services, by any means.

5. Data-protection principles

We process personal data in accordance with the following principles:

• Consent and notification: we collect, use and disclose personal data only with your consent (or deemed consent) after telling you the purposes, or where the PDPA otherwise permits.
• Purpose limitation: we collect personal data for the specific, reasonable purposes set out in this Policy and do not process it later in a way incompatible with those purposes.
• Data minimisation: we collect only what is needed. We do not ask for your phone number, address or identity documents, and we ask only for the Child's first name, age and gender.
• Accuracy: you can correct and update your data at any time from the "Account" page or from Chat.
• Retention limitation: we keep personal data only for as long as needed for the purposes, then delete or anonymise it as described in Section 11.
• Protection: we treat personal data as confidential and protect it with appropriate technical and organisational measures.
• Accountability: we have appointed a Data Protection Officer (Section 17) and require everyone who processes data on our behalf to comply with data-protection obligations.

6. What personal data we collect and how

We collect personal data directly from you through the Platform. The categories are:

• Account data: your email address, which identifies your account and is how we contact you about it (welcome and email-confirmation message, password-reset links, notices of password changes and account deletion, and replies to support requests); the password you choose, which we store only as an irreversible salted cryptographic hash (scrypt) and never see; and, if you choose Google sign-in, the email address, its verification status and a numeric account identifier that Google provides to us. We do not request your name, photo or contacts from Google.
• Consent record: the date and version of your acceptance of the Terms and this Policy, and your choice about receiving marketing email (off by default).
• Child data: first name, age and gender, used to personalise the story linguistically and narratively. When writing a custom story you may optionally enter the names and relationship of siblings, a pet's name, the name of the person reading the story, and a town or neighbourhood, to include them in the story. We ask for nothing else about the Child.
• Custom-story choices: the theme, setting, story type, length and tone you select from predefined lists.
• Voice data (optional): to provide voice cloning we ask for an audio recording of the parent reading a script we provide. The recording is processed in temporary memory only and is not stored on our servers; a non-public voice model is created from it at the voice provider (Section 8).
• Generated content: the texts of custom stories and the stored narrations kept in your account so that you can return to them.
• Contact messages: the name, email address and message you send through the "Contact" page.
• Technical and usage data: your IP address and the country inferred from it, browser type and language, device type, sign-in times, and technical event logs (for example, how many stories and narrations were requested each day). We use these to operate and protect the Service, to limit repeated sign-in attempts, to apply daily usage limits, and to measure and improve the Platform's performance. We do not use third-party analytics or advertising tools and we do not build profiles that are sold to anyone.
• Subscription data: if you subscribe, we store the identifiers and status Stripe returns to us — a Stripe customer identifier, a subscription identifier, the plan you bought, the amount and currency, whether the subscription is active, and the date the current period ends. We keep these to know what your account is entitled to and to show your plan on the "Account" page. No card data of any kind is among them, and there is no field in our database capable of holding one.
• What we do not collect: we do not collect phone numbers, postal addresses or identity documents; we do not store your payment-card details (any payment is processed by a licensed external payment provider); and we do not use your data for third-party advertising.

7. Purposes and legal basis

8. Who we share your data with

We do not sell your personal data. We share it only with service providers that process it on our behalf, to the extent needed to operate the Service:

• Hosting: the Platform's database and application servers for the English and Thai editions are operated by us on infrastructure located outside Singapore (see Section 9). The hosting provider does not access the content of the data beyond what is needed to provide hosting.
• Network and security: Cloudflare, Inc. (United States), which routes and protects traffic to the website and serves the interface pages. Your requests pass through Cloudflare's network, but Cloudflare does not store your account data.
• Email: Brevo (Sendinblue SAS, France), which delivers account emails (welcome, password reset, notices) and any marketing email you opt in to. Brevo receives your email address and the content of the message.
• Google sign-in: Google LLC (United States), when you choose to sign in with Google; Google's use of your data is governed by Google's privacy policy.
• Custom-story generation: DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., People's Republic of China), the provider of the language model that writes "Write your own story" stories. For each story you request, the provider receives the Child's first name, gender and age band, the optional names you enter, and your story choices. It does not receive your email address or any account data. The data is used only to generate the story, under the provider's API terms. This provider is not used for library stories.
• Narration and voice cloning: Fish Audio (United States), which converts story texts (including the Child's name) to speech and creates the cloned voice model, stored there as a non-public model linked only to a technical identifier. The original recording is processed temporarily and is not kept by us.
• Backup narration provider: ElevenLabs (United States), used only if the primary provider is unavailable; it receives the story text only.
• Payment processing: Stripe (Stripe, Inc., United States, and its group companies, including Stripe Payments Europe and Stripe's Singapore entity), which processes subscription payments. Payment is completed on a page hosted by Stripe. Stripe receives your email address, the plan and amount, your card details (which you enter directly on Stripe's page) and the technical data Stripe needs for fraud prevention. We never receive your card number, expiry date or security code. What comes back to us is a Stripe customer identifier, a subscription identifier, the plan, the amount and currency, the subscription status and the date the current period ends. Stripe acts as an independent controller for its own fraud-prevention and regulatory purposes; its processing is governed by Stripe's own terms and privacy policy.
• Government or regulatory authorities: where disclosure is required by law or by an order or lawful request of a competent authority.

In every case we disclose only what is necessary for the stated purpose, and we bind our service providers contractually to protect the data and not to use it for their own purposes.

9. Transfer of data outside Singapore

Because of the service providers described above, some of your personal data is processed outside Singapore, specifically in: the country where our application servers are hosted (currently outside Singapore, in the country where our operations team is based); the United States (Cloudflare, Google, Fish Audio, ElevenLabs, Stripe); the European Union — France (Brevo); and the People's Republic of China (DeepSeek, for custom-story data only).

In accordance with the PDPA transfer-limitation obligation, we transfer personal data outside Singapore only where the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA (including contractual clauses with our providers), or where you have consented to the transfer after being told about it, or where the transfer is necessary to perform our contract with you. By creating an account and using the services described above you expressly consent to these transfers, and in particular to the sending of the Child's basic data and your choices to the AI provider in China when, and only when, you use "Write your own story". We additionally minimise the data sent to the minimum necessary.

Users in Thailand. For users of our Thai edition, processing is also carried out in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand; the rights in Section 13 are available to you under that Act as well.

10. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, use, disclosure, modification or loss, including:

• encryption of all communication with the Platform using HTTPS/TLS;
• storing passwords only as irreversible salted hashes (scrypt), never storing or sending them in clear text; storing password-reset and email-confirmation links as hashes with limited validity and single use;
• managing sign-in sessions with a secure cookie (httpOnly, Secure, SameSite) that scripts in the browser cannot read, with the ability to sign out of every device from the "Account" page;
• limiting the number of sign-in attempts, password-reset requests and contact messages to reduce automated attacks;
• restricting access to data to those who need it for their work, securing systems and databases, regular backups and monitoring;
• not storing payment-card details and not storing the original voice recording.

No system can be guaranteed absolutely secure. Where a data breach is likely to result in significant harm to you, or is of a significant scale, we will notify the Personal Data Protection Commission and, where required, you, in accordance with the PDPA.

11. Retention

• We keep your account data, the Child's data, stories and narrations for as long as your account exists.
• Account deletion: you may delete your account yourself at any time from the "Account" page. This immediately erases your email address and credentials, the Child's data, your story history and custom stories, stored narrations, and the cloned voice model at the voice provider, and ends all sign-in sessions. We send you a confirmation email.
• After deletion we keep only an anonymised record consisting of a cryptographic hash of your email address and the deletion date, to prevent abuse of the free trial by re-creating the account; the hash cannot be reversed into your email address.
• We keep records of financial transactions (once payment is available) for the period required by accounting and tax law.
• We keep "Contact" messages for twelve (12) months after they are answered, and technical server logs for no more than thirty (30) days unless a security incident requires longer retention.
• Data is stored in secure environments with restricted access. Where third parties store or process data for us, we ensure they meet the required standard of protection.

12. Users under 18

The Platform is intended for adult parents and legal guardians. Children under 18 may not create an account or use it directly. We process a Child's data (first name, age, gender and optional names) solely on the basis of the consent of the parent or guardian who enters it, and solely to personalise stories. We do not communicate with the Child directly and we do not build a profile of the Child.

If you believe a child's data has been provided to us without a parent's or guardian's consent, please contact us so that we can review and delete it.

13. Your rights

You may exercise the following rights in relation to your personal data and your Child's:

• Access: to know how your data is processed and to obtain a copy. You can download a complete copy of your account data in JSON format directly from the "Account" page ("Download a copy of my data").
• Withdrawal of consent: where processing is based on consent, including unsubscribing from marketing email from "Account" and deleting the cloned voice from "My voice". Withdrawing consent that is necessary for the Service may mean we can no longer provide it.
• Correction: to correct or update your data; you can update the Child's details from Chat and change your password from "Account".
• Erasure: to delete your account and data yourself, immediately, from "Account", or by request to us.
• Data portability: to obtain your data in a machine-readable format (the JSON file).
• Objection and restriction: to the extent provided by applicable law.
• Breach notification: as required by law.

How to exercise them. Besides the self-service tools on the "Account" page, you may send any request through the "Contact" page or by email to info@bedtimebay.com from your registered email address, stating the nature of the request. We may verify your identity before acting. We will respond to and act on a valid request within thirty (30) days of receiving it, and will tell you if we need more time. We may decline a request in whole or in part where the law permits, and will give reasons. We do not charge a fee for these requests, except where the PDPA permits a reasonable fee for access requests, in which case we will tell you in advance.

14. Cookies and local storage

• We use one strictly necessary cookie for authentication (auth_token) to keep you signed in on your device. It is secure, protected from being read by scripts, and expires after thirty (30) days or when you sign out. A second, temporary cookie (10 minutes) protects the Google sign-in process.
• We do not store your sign-in token in the browser's local storage, and we do not use cookies for analytics, advertising or cross-site tracking.
• Your browser or mobile application may temporarily cache static interface files (logo, icons, page shell) to speed up loading; these files contain no personal data. The Platform does not provide an offline mode.
• You may delete cookies at any time from your browser settings; you will then need to sign in again.

15. Complaints

If you have a complaint about how we handle personal data, please contact us through the "Contact" page or at info@bedtimebay.com. We will acknowledge your complaint, give you a reference, and respond within thirty (30) days. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission of Singapore (pdpc.gov.sg). Users in other countries may also contact their local data-protection authority. Requests and complaints are handled free of charge.

16. Acknowledgement and consent

By creating an account and confirming your acceptance of this Policy at sign-up, you acknowledge that you have read and understood this Policy, and that you are the parent or legal guardian of the Child, authorised to provide the Child's data and to consent to its processing for the purposes described above, including the sending of the Child's basic data and your choices to the AI provider when you use "Write your own story".

By using the voice-cloning service, you further confirm and undertake that:

• the recording you upload will be used exclusively to narrate stories on the Platform, and that the voice is your own or that of an adult who has given you prior express consent to use and clone it;
• you will not upload or use any recording of another person's voice without their prior express consent;
• you understand that you can permanently delete the voice model at any time from the "My voice" page, and that it is deleted automatically when your account is deleted.

17. Contact us and Data Protection Officer

If you have any question about this Policy or about the processing of your personal data, or wish to exercise any of your rights, you may contact us:

• Company: Zeta Pegasi Labs Pte. Ltd., UEN 202636586D
• Registered office: 152 Beach Road, #23-02 Gateway East, Singapore 189721
• Data Protection Officer: Humam Malhas — admin@zetapegasilabs.com
• Service email: info@bedtimebay.com
• Contact page: bedtimebay.com/contact
• Account deletion: bedtimebay.com/delete-account

Zeta Pegasi Labs Pte. Ltd. · Contact · Delete your account and data