Privacy Notice for Goodnight eNight
Welcome to Goodnight eNight!
Welcome to Goodnight eNight! We help families craft imaginative, personalized bedtime stories. This notice explains how we collect, use, share, and protect the information you entrust to us. It applies to our website, WordPress plugin, AWS‑based Story Builder pipeline, and related services.
Who We Are & How to Reach Us
Goodnight eNight LLC (based in Texas, USA) is the controller of your personal data.
Email: legal@goodnightenight.com
Mailing address: available on request via the above email.
You may also write to our Data Protection Lead at privacy@goodnightenight.com for privacy-specific questions.
Information We Collect
Provided by you:
– Account details such as name, email address, and Story Builder account credentials.
– Story personalization data you choose to supply about yourself, your children, or other characters: names, nicknames, pronouns, ages or school stages, locations (e.g., city, state, country), favorite activities, toys, colors, moods, personal challenges, pet information, physical descriptors, likeness or narrator preferences, lesson themes, soundtrack preferences, parental attestations and consent acknowledgements (e.g., “I am 18 years of age or older,” “I read and understand the Privacy Policy”), and any other narrative notes you enter.
– Content and media you upload or link, including images or audio used for likeness or narration.
– Communications with us (support requests, surveys, feedback).
Collected automatically:
– Technical and usage data captured when you visit our site or use the app: IP address, approximate location inferred from IP, device identifiers, browser type and version, operating system, referral URL, language, pages viewed, interaction timestamps, and error logs.
– Pipeline telemetry generated by our AWS Lambda workflow (e.g., request IDs, status codes, processing step results) and CloudWatch diagnostics. When debug logging is enabled, payload snippets may be included for troubleshooting.
Generated during service delivery:
– Story content, prompts, images, and metadata produced by our Story Builder pipeline.
– Request artifacts stored in Amazon S3 under structured keys such as pipeline data/requests/{requestId}/story-content.json, story-pages.json, and related media.
Collected via integrations:
– Google Analytics (including GA4 Measurement Protocol events) records aggregate usage metrics for our site and share interactions.
– Email delivery information handled by our transactional email provider (currently SendGrid) for purchase confirmations and pipeline status messages.
– Sassy Social Share plug-in loads social widgets that may capture your IP address and interaction with the relevant network (see “Social Sharing Features” below).
We do not intentionally collect data directly from children under 13. All child profile information must be submitted by a parent or legal guardian.
How We Use Your Information
– Personalize and deliver your stories, prompts, artwork, and related digital products.
– Maintain the Story Builder pipeline, including orchestrating Lambda steps, generating prompts via GPT-5, rendering images via Replicate, and posting finished assets to WordPress.
– Provide customer support, respond to inquiries, and notify you about updates or issues with your stories.
– Operate, secure, and optimize our website, WordPress plug-ins, and AWS infrastructure, including debugging errors and monitoring service health.
– Process transactions, track credits, and send status notifications.
– Comply with legal obligations, enforce our Terms of Service, prevent fraud or abuse, and protect the rights, safety, and property of our users and our company.
– Conduct anonymized or aggregated analytics to understand product performance and plan new features. We do not attempt to re-identify anonymized data.
We do not sell your personal data.
Our Story Builder Pipeline & Storage Practices
– Story requests travel through a series of AWS Lambda functions hosted in the us-east-2 (Ohio) region. Each request is assigned a unique identifier; intermediate files and final assets are stored in protected Amazon S3 buckets such as goodnightenight/pipeline-data/requests/{requestId}/.
– Certain pipeline steps invoke trusted processors: OpenAI (GPT-5) for text prompts, Replicate (flux-schnell) for image generation, and SendGrid for email notifications. These providers receive only the data needed to complete their step.
– Pipeline logs (CloudWatch) and webhook payload debugging may capture portions of your request for troubleshooting. We limit log verbosity and regularly prune diagnostic data consistent with our retention schedule.
– WordPress integrates completed stories, images, and metadata via our plugin hosted on SiteGround servers in the USA.
Third-Party Processors & Disclosures
We share data only with service providers under contract who must safeguard it and use it solely for our instructions:
– Amazon Web Services (AWS) – infrastructure, storage, databases, and CloudWatch logging (USA).
– SiteGround – WordPress hosting (USA).
– OpenAI – GPT-5 prompt generation (USA).
– Replicate – flux-schnell image rendering (USA).
– SendGrid (Twilio) – transactional email delivery (USA).
– Google – Google Analytics, Measurement Protocol events, and optional social widgets (global).
– Heateor / Sassy Social Share – WordPress plugin executing entirely on our servers; when official widgets are enabled, your browser connects directly to the respective social network (see below).
– Payment processors or marketplace platforms used for purchases (if applicable) will have their own privacy notices.
We may also disclose data if required by law, to comply with legal processes, to respond to lawful requests from authorities, or to protect the rights and safety of our users, partners, or company.
Social Sharing Features (Sassy Social Share)
Our site displays share buttons powered by the Sassy Social Share plugin. The plugin itself runs on our WordPress installation and stores configuration data only in our database. When you interact with official share widgets (e.g., Facebook Like/Share, X/Twitter Tweet, Pinterest Save, LinkedIn Share), your browser requests scripts from the relevant platform. Those platforms may collect your IP address, browser user agent, the page you visited, cookies, and details of your interaction. Review their privacy policies for more information (Facebook: https://www.facebook.com/about/privacy/update, X/Twitter: https://twitter.com/en/privacy#update, Pinterest: https://policy.pinterest.com/en/privacy-policy, LinkedIn: https://www.linkedin.com/legal/privacy-policy, Reddit: https://www.redditinc.com/policies/privacy-policy, Buffer: https://buffer.com/privacy, Xing: https://privacy.xing.com/en/privacy-policy). If you prefer not to load
these widgets, you can disable social scripts via your browser, use privacy extensions, or adjust our consent banner settings. When only static share icons are enabled, no external scripts are loaded and no data is shared with social networks.
Cookies & Similar Technologies
– Essential cookies keep you logged in, secure the site, and remember your story-building progress. You cannot opt out of these.
– Analytics cookies and Measurement Protocol events help us understand usage. Where required, we request your consent before loading these tools.
– Social widgets and embedded content may set their own cookies when activated.
You can manage cookies through our consent banner and your browser settings.
Legal Bases for Processing (EEA/UK/Swiss Users)
We rely on:
– Performance of a contract (creating your stories and managing your account).
– Legitimate interests (service security, analytics, product improvement, customer support) balanced against your rights.
– Consent (child data supplied by parents, marketing emails where offered, cookies/analytics, social widgets).
– Legal obligations (record keeping, responding to lawful requests).
You may withdraw consent at any time without affecting prior processing.
Retention
We keep personal data only as long as necessary for the purposes outlined above:
– Story Builder request files and related S3 artifacts are kept for active account use and troubleshooting, then pruned in accordance
with our retention review (at least annually). You may request earlier deletion (see “Your Rights”).
– Account records remain while you maintain an account and during any legally required retention period after closure.
– CloudWatch and application logs are retained for operational security and typically rotate within 90 days unless a longer retention is
needed to investigate an incident.
– Email delivery metadata is stored per SendGrid’s standard retention and then either anonymized or deleted.
When data is no longer needed, we delete or irreversibly anonymize it.
Security
We implement administrative, technical, and physical safeguards to protect your information, including:
– Encryption in transit (HTTPS/TLS) and at rest for AWS storage.
– Access controls, multi-factor authentication, and least-privilege policies for our team.
– Automated monitoring for unusual activity, plus WordPress hardening and application firewalls.
– Routine patching, backups, and disaster recovery procedures.
No system can guarantee absolute security; we will notify you and relevant regulators of any breach as required by law.
Children’s Privacy
Parents or legal guardians must provide information about their children and review story outputs before sharing them. We do not knowingly collect direct submissions from children under 13. If we learn that child data was provided without proper consent, we will delete it promptly. Parents can review, update, or delete their child’s information at any time by contacting us.
Your Rights
Depending on your location, you may have the right to:
– Access, correct, or update your personal information.
– Delete data or request that we restrict processing.
– Object to certain processing, including profiling for personalization.
– Port copies of your data to another service.
– Withdraw consent (for example, to marketing communications or analytics/cookies).
– Lodge a complaint with your supervisory authority (EEA/UK/Swiss users) or state attorney general (U.S. users).
You can exercise these rights through your account settings or by emailing privacy@goodnightenight.com. We may need to verify your identity or authority before fulfilling a request, particularly when it concerns child data.
International Transfers
Our primary infrastructure (SiteGround, AWS, OpenAI, Replicate, SendGrid) is located in the United States. If you are located outside the U.S., your information will be transferred to and processed in the U.S., where data protection laws may differ. We use appropriate safeguards, such as Data Processing Agreements with Standard Contractual Clauses, to protect cross-border transfers.
Do Not Track & Global Privacy Control
Our site does not currently respond separately to “Do Not Track” browser signals, but we honor applicable Global Privacy Control signals for cookie preferences where legally required. You can also manage cookies and tracking through our consent banner.
Changes to This Notice
We may update this Privacy Notice to reflect new features, legal requirements, or changes in our practices. Material changes will be highlighted on our site, and we may notify you directly (e.g., by email) when appropriate. The “Last updated” date above reflects the latest revision.
Questions or Concerns
If you have any questions, need assistance with your privacy rights, or wish to file a complaint, contact us at legal@goodnightenight.com. We are committed to providing a magical storytelling experience while honoring and protecting your family’s privacy.
Last Updated: Wednesday, October 1, 2025
