Consumer health data privacy policy

Washington’s My Health My Data Act (RCW 19.373) and Nevada’s consumer health data law treat “biometric data”, including imagery of the face from which an identifier template could be extracted, as consumer health data. The photo of your child that you upload to Tally Tells is face imagery, so we treat it as consumer health data under these laws.

Tally Tells is operated by Upforged LLC. This policy adds to our Privacy policy and Biometric data notice.

• The photo you upload of your child, which shows their face.
• Temporary face measurements (such as face shape, eye spacing or hair line) that our systems and our service providers’ systems may make from the photo while it is checked and each drawing is made. These exist only during processing. We don’t store a face template.

Only from you: the parent or legal guardian who uploads the photo after signing our consent. We don’t buy it or get it from anyone else.

For one purpose only: to check the photo is safe and usable, and to draw your child into the book you asked for. We never use it for advertising, identification or any other purpose, and it is never sold. We don’t use it to train AI. We collect it only after you give consent in the upload step.

We share it only with these service providers (processors), who handle it on our behalf, only to make your book:

• Google Cloud Vision: photo safety screening before any drawing is made.
• our illustration service providers: drawing the illustrations.
• Cloudflare: private, encrypted storage until the photo is deleted.

We have no affiliates that receive it, and we don’t sell it. We disclose it to anyone else only if the law requires it, for example the report federal law requires if our safety check flags a photo as possible child sexual abuse material.

The photo is deleted within 72 hours of upload, or sooner when you approve the drawing or ask. The only exception is a photo our safety check flags as possible child sexual abuse material, which federal law (18 U.S.C. §2258A) requires us to report and keep securely for one year. The illustrated character and preview, which are artwork, are kept 30 days unless you delete them sooner.

You have the right to:

• Confirm and access: ask whether we collect, share or sell your consumer health data, get a copy of it, and get a list of every third party and affiliate we have shared it with, with their contact details;
• Withdraw consent to our collection and sharing of it;
• Delete it. We delete it from our systems and tell our service providers to delete it too;
• Appeal if we turn down your request.

We won’t treat you differently for using these rights.

The quickest way to withdraw consent and delete everything is the “delete everything” link in your preview email or on your preview page. For any request, write to hello@tallytells.com and say which right you want to use. We’ll confirm it’s you (usually by replying to the email on your preview or order) and answer within 45 days. If we need longer, as the law allows, we’ll tell you why.

Appeals: if we turn down your request, reply to our answer with the word “Appeal”. A different person reviews it and answers in writing within 45 days. If you’re still unhappy, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint.

Upforged LLC, [BUSINESS ADDRESS]. Email hello@tallytells.com. We reply within one business day.