Privacy Policy

1. Who is responsible for your information

The operator and data controller for PetStory at https://www.aurflowai.io is 灵枢智策（武汉）科技有限公司, in China. Address provided by the operator: 武汉市, China. Contact zhangsw1991@gmail.com for privacy matters or data requests.

This policy describes our handling of information when you browse the website, sign in, upload materials, generate books, pay or contact us. The same contact handles privacy requests; we do not list a separate data-protection officer.

2. Information we collect

Account and profile: Google account identifiers, authorized name, email and avatar, plus profile details you choose to edit. We do not receive your Google password. Creation materials: pet photos, pet names, descriptions, memories, themes and styles, together with generated stories, illustration prompts, images and task progress.

Orders: account and book references, amount, currency, payment status, timestamps and payment transaction references. Waffo Pancake and its payment partners process payment-card information; we do not store full card numbers or security codes. Support: messages and information you send us.

Technical information: IP address, request time, requested route, browser or user-agent information, session identifiers and error or security logs needed to operate the service. We do not request precise GPS location, contacts or access to your entire photo library; you choose which files to upload.

3. Purposes and legal bases

We use account details and creation materials to authenticate you, create and deliver your book and provide support: performance of our contract or steps you request before purchase. We use order information to process payment, deliver paid features and handle refunds: contract performance and applicable accounting obligations.

We process operational and security information to prevent misuse and maintain the service: legitimate interests where recognized by applicable law, and legal obligations where required. Optional processing that requires consent is based on that consent, which may be withdrawn. Where local law requires a different legal basis, that law applies.

Optional GA4 audience measurement relies on your consent and helps us understand public-page usage and improve the website.

4. Cookies and browser storage

Your browser stores the login token in local storage under pettale_token. It is used to authenticate API requests. Signing out removes it; clearing browser storage also removes it and may require you to sign in again. Account records and books are stored by the backend, not solely in your browser.

The pettale-home-language cookie remembers your language. The petTaleCookie cookie records your cookie-banner choice for up to one year. You can clear these through your browser settings. The banner choice does not remove the storage needed for a login you request.

If you allow analytics, we load Google Analytics 4 (GA4) to understand page visits. GA4 is not loaded before a choice or after rejection. You can withdraw through Cookie settings in the footer; withdrawal stops subsequent analytics and clears GA cookies accessible on this site. The petstory-analytics-v1 cookie stores your analytics choice for up to one year; GA cookies are configured to expire after 90 days.

Our manual page-view events cover public pages and do not include URL query parameters, fragments, account identifiers, book IDs, photos, memories or payment information. Google Signals and advertising personalization are disabled in our integration. Google sign-in and payment pages may use their own cookies under their own policies.

5. Service providers and disclosure

We do not sell personal information or share it for cross-context behavioral advertising. We disclose information needed for the requested service to hosting and storage providers, Google for sign-in, SiliconFlow for story and storyboard generation, Doubao / Volcengine for illustrations, and Waffo Pancake for payment and related transaction administration.

Text and image generation can require transmission of submitted descriptions, photos or derived prompts to AI providers. Do not upload sensitive personal information that is unnecessary for your book. We do not use your materials to train our own AI models; provider handling is subject to the applicable provider terms.

We may disclose necessary information to comply with lawful requests, protect rights or investigate abuse, or with your permission. If ownership of the service changes, applicable privacy obligations continue and affected users will be notified as required.

With your analytics consent, Google also processes necessary visit and device information as the GA4 analytics provider, under its applicable terms and privacy policies.

6. Security and access

We use HTTPS for the production website and API, authenticated sessions and ownership checks for account records, submitted materials, order actions and complete paid reading access. Full card details are handled by the payment provider. No internet service can guarantee absolute security.

Shared book links may reveal the title and free illustrated preview to recipients. Public gallery examples are separate from your account library; personal book links are not included in the public sitemap. A missing sitemap entry is not an access control.

Protect your Google account, login token and shared links. Report suspected incidents to zhangsw1991@gmail.com. We assess incidents and notify affected individuals and relevant authorities within the periods required by applicable law.

7. How long information is retained

Account details, uploaded materials and generated books are retained while the account is active to provide your library. Following a verified account-deletion request, our policy is to delete or anonymize this content within 30 calendar days, except information that must lawfully be retained. Deletion also removes access to the associated books.

Order and payment records are retained for seven years after completion, or longer if applicable accounting, tax or dispute-retention rules require it. Support correspondence is retained for up to two years after the last resolved request. Operational and security logs are retained for up to 180 days, with a longer period only for a documented investigation or legal requirement.

These are our retention and request-handling rules, not a claim that signing out triggers automatic deletion. Requests and retention reviews are handled by the operator. Records retained solely for legal reasons are restricted to that purpose and deleted or anonymized when the applicable period ends.

8. Your choices and data rights

Depending on applicable law, you may request access, a copy, correction, deletion, restriction, portability or an objection to processing, and withdraw consent for processing based on consent. You can edit supported profile fields in your account. For other requests, email zhangsw1991@gmail.com from your registered address.

We may verify your identity using information proportionate to the request. We respond within 30 calendar days unless applicable law requires a shorter period or permits an extension, in which case we explain the extension. Some records may be retained for legal obligations or claims. You may complain to a competent data-protection authority; exercising your rights does not result in unlawful discrimination.

9. Service messages and marketing

The current service does not operate an optional marketing-mail subscription. Account, payment, support and security communications are used for the relevant service purpose. If optional marketing is introduced, we will provide any required choice and a working unsubscribe method; opting out will not prevent essential service communications.

10. Storage and international processing

Our operator is based in China. Account, book and order records are stored on the servers supporting the service, and uploaded and generated images are stored in backend-managed file storage. SiliconFlow and Doubao / Volcengine process creation materials for generation. Google sign-in, hosting and Waffo Pancake may process information in other countries where their infrastructure operates.

Your information may therefore be processed outside your country of residence. Where applicable law restricts a cross-border transfer, we must establish the required lawful basis and safeguards, such as an adequacy decision or applicable standard contractual clauses, before that transfer. Contact zhangsw1991@gmail.com for the current hosting locations and transfer arrangements relevant to your information.

11. Children and uploaded photos

The service is intended for account holders aged 18 or older. We do not knowingly collect information from under-18 account holders. If you believe a child has provided information without appropriate authority, contact zhangsw1991@gmail.com so we can investigate and delete it where required.

Adults uploading a photo of another person, including a child, must have the rights and any consent required to do so. Avoid uploading unnecessary personal identifiers or sensitive details.

12. Third-party services

Google sign-in, AI generation and payment services have their own terms and privacy practices. Our policy describes our own handling; it does not replace those notices or extend promises about provider retention, training or security that we have not verified. Review the relevant provider notices through the following official sites before using those services.

• Google
• SiliconFlow
• Volcengine / Doubao
• Waffo Pancake

13. Changes to this policy

We update the version and effective date on this page when this policy changes. Material changes are announced on the website before taking effect where practicable. We request fresh consent where required and do not treat continued browsing alone as consent to unrelated optional processing.

14. Privacy contact

Data controller and service operator: 灵枢智策（武汉）科技有限公司. Address provided by the operator: 武汉市, China. Website: https://www.aurflowai.io.

Privacy requests, account closure, support and security reports can be sent to zhangsw1991@gmail.com. Include your registered email and relevant book or order reference so we can locate the records. Do not send passwords, full card numbers or security codes.