Privacy Policy (v2.0)

In short

Mishami is a tool for adults. A parent or guardian writes one line about something their child is going through, and Mishami writes a story and a guidance card for the parent to read aloud. Children do not use Mishami. They do not have accounts, they do not type anything, and we do not collect anything from them directly.

We ask for very little, we do not sell anything about you or your child, and the current web version of Mishami will be retired on 30 September 2026, at which point everything in it is permanently deleted.

1. Who we are

Mishami is operated by:

Mishami, Inc. is a corporation incorporated in the State of Delaware, United States. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Mishami, Inc. is the data controller for the personal data described in this Policy.

A note on our history. Until August 2026, the Mishami web service was operated by a different company. Mishami, Inc. is now the operator and controller. Data held by the previous operator is not being transferred into new systems. It is being retired along with the current web version, as described in Section 8.

2. Who this Policy is for

This Policy is for the adult who uses Mishami: a parent or legal guardian aged 18 or over.

Mishami is not a service for children. Children do not create accounts, do not log in, do not type, do not speak to Mishami, and do not use the app or the website. The adult reads the story aloud. We do not knowingly collect personal information directly from any child.

Because the information an adult gives us is about a child, we hold ourselves to the standards written for children's data even where they do not legally bind us. Section 9 explains how.

3. What we collect

When you create an account

• Your email address.
• A profile photo, only if you choose to upload one.

When you create a story

• The child's first name or nickname.
• The child's age.
• The situation you describe, in your own words.
• Favourite characters, if you choose to add them.

Created by the service

• The stories and guidance cards generated for you, and the date each was created.

Collected automatically

• Basic technical information needed to serve the site and keep it secure, such as your IP address and browser type, held in standard server logs.

What we do not collect

• No surname for your child.
• No photographs of your child.
• No audio or video of your child.
• No precise location.
• No biometric data.
• No advertising identifiers. We run no advertising trackers and no advertising pixels on the site or in the product.

4. Why we use it, and our legal basis

We do not use your information for automated decision-making that produces legal or similarly significant effects about you or your child. We do not build behavioural profiles.

5. What we never do

• We do not sell your personal information, and we never have.
• We do not share your personal information for cross-context behavioural advertising or targeted advertising.
• We do not disclose anything about your child to any third party for advertising, marketing, or profiling.
• We do not use what you write to advertise to you.

6. Who processes data for us

We keep this list short on purpose. These are the only companies that handle your data on our behalf.

About OpenAI, stated plainly. To write a story, we send the text you typed to OpenAI's API. OpenAI states that, since 1 March 2023, data sent through its API is not used to train or improve its models unless the customer explicitly opts in. We have not opted in. OpenAI also states that it generates abuse-monitoring logs for API usage and keeps them for up to 30 days, unless a longer period is required by law, and that those logs can contain the prompt and the response. So the text you write can sit in OpenAI's abuse-monitoring logs for up to 30 days. We think you should know that rather than find it in a footnote.

7. International transfers

Mishami, Inc. is in the United States, and our providers process data in the United States. If you use Mishami from the United Kingdom, the European Economic Area, or another country with data transfer rules, your information is transferred to the United States.

Where such a transfer requires a safeguard, we rely on the European Commission's Standard Contractual Clauses, and on the UK International Data Transfer Addendum where the UK GDPR applies, together with the data processing terms offered by each provider named in Section 6.

Mishami is not currently marketed or sold in any country. The current web version is a free closed beta used by a small number of invited families.

8. How long we keep it, and when it all goes

The current web version of Mishami will be retired on 30 September 2026. On that date, the accounts, stories, guidance cards, and everything else held in that version are permanently deleted. This is not a soft deletion or an archive. The version is being replaced, and its data is not being carried over.

Before that date:

• We keep your account and your stories for as long as your account is open.
• If you ask us to delete your account, we delete it and everything in it, as described in Section 10.
• Server logs are kept for a short period for security and troubleshooting, then deleted.
• Text sent to OpenAI may sit in OpenAI's abuse-monitoring logs for up to 30 days, as described in Section 6. We cannot delete those logs on your behalf.

9. Children's information, and the standards we hold ourselves to

Mishami is a service for adults. We do not direct it at children, and we do not collect personal information from children. On that basis the US Children's Online Privacy Protection Act (COPPA) operator obligations do not apply to us.

We still build to those standards, because the information is about a child no matter who typed it. Voluntarily, and as a matter of design:

• We collect the minimum. A first name or nickname and an age. No surname, no photo of the child, no recordings.
• We never disclose a child's information to a third party for advertising, marketing, profiling, or any similar purpose. The only companies that see it are the providers in Section 6, who process it to deliver the service and nothing else.
• We do not profile children, and we do not use what you write to target anything at you.
• We publish our retention period, in Section 8, with a date.

We also design to the standards of the UK Information Commissioner's Age Appropriate Design Code and, for Quebec residents, to the express-consent and privacy-by-default expectations of Law 25, as a matter of policy rather than because we accept that they bind an adult-facing service.

If you believe a child has provided us with personal information directly, write to care@mishami.com and we will delete it.

10. Your rights, and how to use them

Write to care@mishami.com. Say what you want. We will reply within 30 days, and sooner where the law requires it.

You can ask us to:

• Give you a copy of the personal data we hold about you and your child.
• Correct anything that is wrong.
• Delete your account and everything in it.
• Export your data in a portable format.
• Restrict or object to how we use it.
• Withdraw consent, where we rely on consent.

There is no self-service delete button in the current web version. Deletion is by email request and we action it manually. We are saying so plainly rather than implying a button that does not exist.

If you are in the European Economic Area or the United Kingdom, you also have the right to complain to your data protection supervisory authority. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk). In the EEA it is the authority in the country where you live or work.

If you are in the United States, twenty states now have comprehensive consumer privacy laws, and most of them give you rights to access, correct, delete, and obtain a copy of your personal data, to opt out of its sale or of targeted advertising, and not to be discriminated against for exercising those rights. We honour all of these requests from every US resident regardless of state, because it is simpler and better than checking your address first.

Two specific notes:

• We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We honour Global Privacy Control and similar universal opt-out signals anyway.
• California residents: we do not use or disclose sensitive personal information for any purpose beyond providing the service, so no separate limitation right arises.

11. Cookies

We use only what is necessary to make the site and the product work: session and authentication cookies, and basic security. We run no analytics, no advertising pixels, and no third-party tracking. If that changes, we will update this Policy and ask for your consent before setting anything non-essential.

12. Security

We protect your information with access controls, encryption in transit, and the security measures of the providers in Section 6. No service can promise perfect security, and we will not pretend otherwise. If a breach affects your personal data and the law requires us to tell you, we will, without undue delay.

13. Changes to this Policy

If we change this Policy in a way that matters, we will post the new version here and update the date at the top. If the change is significant and we hold your email address, we will email you.

14. Contact