Privacy Policy

Last updated: 2026-08-30

This Privacy Policy explains how ArvenX GmbH ("we", "us", "our") collects, uses, and protects personal data when you use the Wunderli mobile app ("Wunderli", "the App") and when you visit the Wunderli website at wunderliapp.com ("the Website").

Wunderli is designed for families. The App allows users to create personalized AI-generated audio stories by choosing predefined story options such as themes, styles, characters, story flow, and story length.

We design Wunderli to collect only the data needed to operate the App, manage accounts, generate and save stories, process subscriptions and credit pack purchases, protect the App from misuse, and improve safety.

We do not sell personal data. The App does not show third-party advertising and does not track users across apps or websites. The Website uses analytics and advertising cookies (Google Analytics, Meta Pixel) only with your consent, MailerLite to manage the launch waitlist, and Web3Forms to handle contact form submissions. See Section 2.7 for details.

1. Who We Are

ArvenX GmbH
Wehrenbachhalde 47
8053 Zürich
Switzerland

If you have any questions about privacy or data protection, you can contact us at:
Email: hello@wunderliapp.com
Website: https://wunderliapp.com

2. What Data We Collect

We collect limited data that is necessary to provide and protect the App.

2.1 Account and Authentication Data

Wunderli uses Microsoft Entra External ID to manage sign-in. You can sign in with Apple Sign-In, Google Sign-In, or by creating a Microsoft Entra External ID account with an email and password. These are the only supported sign-in methods.

When you create or use an account, we process:

• backend-generated user account ID
• email address, if provided by your login provider
• name or display name, if provided by your login provider
• Apple Sign-In, Google Sign-In, or Microsoft Entra External ID identifier returned by your sign-in method
• authentication-related technical data
• device information used to manage your sessions, such as device identifier, device model, platform, and operating system version

We do not receive the passwords of your Apple or Google accounts. If you sign in with a Microsoft Entra External ID account using an email and password, the password is processed by the authentication service; we do not store it in the App's backend.

2.2 Story and Character Data

Wunderli lets users create stories by choosing predefined story options. These include, for example:

• story theme
• story style
• story length
• story flow
• ending type
• selected characters
• selected language
• narration settings

Users can create fictional story characters and optionally give them names. Character names are limited to 30 characters and are checked by automated safety systems before being saved or used.

The App does not provide free-form story prompt input.

We process and store:

• selected story options
• selected character types
• character names entered by the user
• generated stories
• saved stories
• story language and narration settings
• related technical information needed to generate, save, and play stories

Users should not enter real names, contact details, addresses, health information, or other sensitive personal data about children or third parties as character names.

2.3 Safety Reports and Feedback

Users can report a problem with a generated story. To reduce accidental use by younger children, access to the report form is protected by a parent gate, such as a simple math question.

If a report is submitted, we process:

• the report text
• the related story or story identifier
• technical information needed to investigate and improve safety

Safety reports are used to review issues, improve safety, fix problems, and prevent misuse.

Users should not include unnecessary personal data in safety reports.

2.4 Subscriptions, Credit Packs, and Credit Data

Wunderli offers auto-renewing subscriptions and one-time consumable credit packs.

Subscriptions provide a recurring credit allowance. Credit packs provide additional one-time credits. Credits are used to generate stories.

In this Privacy Policy, "Credits" means the in-app balance used to generate stories.

Purchases are processed using:

• Apple App Store for iOS purchases
• Google Play Store for Android purchases
• RevenueCat for purchase validation, subscription status, and credit management

We process and store:

• product identifiers
• transaction identifiers
• purchase status
• subscription status
• trial status, where applicable
• renewal, cancellation, expiration, billing issue, and refund events
• purchase timestamps
• granted credits
• credit balance
• credit ledger entries
• credit pack purchases
• refund information
• information about a negative credit balance, which can occur when a refund is processed after credits were already used

We do not store full payment details such as credit card numbers.

Payments, refunds, and subscription management are handled by the relevant app store provider.

2.5 Technical, Usage, and Diagnostic Data

We process limited technical, product interaction, usage, and diagnostic data, such as:

• app version
• platform, such as iOS or Android
• device type
• operating system version
• app interactions, such as story generation, credit use, paywall interactions, and safety-report actions
• server-side request and dependency telemetry used for reliability and debugging
• crash reports
• logs
• error reports

This data is used to keep the App reliable, fix bugs, improve safety, prevent abuse, and ensure purchases and credits work correctly.

2.6 Fraud Prevention and Abuse Protection Data

To protect Wunderli from misuse, fraud, duplicate purchase processing, refund abuse, or repeated creation of new accounts to obtain free credits, we process limited fraud-prevention data.

This includes hashed or pseudonymized device-related or transaction-related signals.

This data is used only for security, fraud prevention, abuse prevention, and purchase integrity.

2.7 Website Data, Cookies, and Analytics

This sub-section applies to the wunderliapp.com Website only. The App itself does not use these scripts, set these cookies, or process this data.

Cookies and similar technologies (with consent only):

• Google Analytics 4 (GA4) — measures visitor numbers, page views, and traffic sources with anonymized IP. Cookies: _ga, _ga_*. Provider: Google Ireland Ltd. Data may be transferred to the United States under EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Meta Pixel (Facebook Pixel) — measures and optimizes our advertising on Facebook and Instagram, and is used to build advertising audiences. Cookies: _fbp, _fbc. Provider: Meta Platforms Ireland Ltd. Data may be transferred to the United States under EU Standard Contractual Clauses and the EU-US Data Privacy Framework. For the parts of this processing that we jointly determine with Meta (in particular the collection and transmission of pixel data), ArvenX and Meta act as joint controllers under GDPR Art. 26. The corresponding Joint Controllership Arrangement is provided by Meta via the Business Tools Terms in Meta Business Manager. Meta is the sole controller for any further use of the data under its own privacy terms.

You can accept or reject these via the cookie banner that appears on first visit. You can change your choice at any time via the "Cookie Settings" link in the Website footer. If you reject, none of these scripts load and no cookies are set; the Website continues to function normally.

Server logs: Our web host records technically necessary data such as IP address, browser type, and request time for security and service delivery. These logs are not used for profiling and are deleted after a short period.

Waitlist (MailerLite): If you sign up for the Wunderli launch waitlist on the Website, we send your name, email address, and chosen language to our email service provider MailerLite (UAB MailerLite, Lithuania). We process this data on the basis of your consent (GDPR Art. 6(1)(a)) until you unsubscribe or we delete the list.

Contact form (Web3Forms): If you send us a message via the contact form on the Website, we transmit your name, email address, message text, and chosen language to our form-handling provider Web3Forms, which forwards the message to us by email. We process this data on the basis of your consent (GDPR Art. 6(1)(a)) to handle your enquiry. We delete contact messages once your enquiry is resolved, unless we are required to keep them for legal reasons.

3. How We Use Your Data

We use your data for the following purposes:

• to create and manage user accounts
• to authenticate users
• to generate, save, and display stories
• to personalize stories using selected options and character names
• to provide narration and story playback features
• to manage subscriptions
• to grant monthly subscription credits
• to grant purchased credit packs
• to track credit balances and spending
• to process purchases, renewals, cancellations, expirations, billing issues, and refunds
• to prevent fraud and abuse
• to review safety reports
• to improve child safety and content quality
• to fix bugs and maintain technical reliability
• to comply with legal obligations

We do not:

• show ads
• sell personal data
• use personal data for third-party advertising
• track users across apps or websites

4. AI Story Generation and Safety

Wunderli uses AI systems to generate stories based on the story options selected by the user.

Users cannot enter free-form story prompts. User text input is limited to fictional character names of up to 30 characters and safety reports whose submission is protected by a parent gate.

Generated stories are checked by automated safety systems to reduce inappropriate or unsafe content. Character names are also checked by automated safety systems before being saved or used.

AI-generated content may occasionally be imperfect. Parents or guardians should review generated stories and use the report feature if they notice a problem.

5. Children's Privacy

Wunderli is designed for families and may be used by children under the supervision of a parent or legal guardian.

The user account is created and managed by the adult account holder. Children may use the App under the supervision and responsibility of that adult to choose story options, select characters, and generate stories.

Wunderli does not ask children to provide their real name, age, date of birth, address, school, photo, contact details, or other child profile information. We do not create child profiles.

Free-text input is limited. Users may enter fictional character names of up to 30 characters and may submit safety reports through a parent-gated flow.

Purchases are handled through the app store and may be subject to Apple, Google, device-level, and parental approval settings.

Account deletion and safety-report submission are protected by a parent gate, such as a simple math question, to make accidental use by younger children more difficult. This gate is not a verified parental-consent mechanism and does not replace any legally required consent of a parent or legal guardian.

Users should not enter personal data about children or third parties into character names or safety reports.

If you believe a child has provided personal data that should be removed, please contact us at hello@wunderliapp.com.

6. In-App Purchases, Subscriptions, and Payments

Wunderli offers:

• auto-renewing subscriptions
• one-time consumable credit packs

Subscriptions and credit packs are purchased through the relevant app store provider.

RevenueCat helps us validate purchases, process purchase events, manage subscription status, and manage credits.

We use purchase and credit data to:

• grant purchased credits
• grant subscription credits
• deduct credits when stories are generated
• keep a credit ledger
• process renewals
• process cancellations and expirations
• process refunds
• prevent duplicate purchase processing
• prevent fraud or abuse

We do not store full payment details. Payment information is handled by Apple, Google, or the relevant app store provider.

7. Temporary Purchase Processing Logs

To ensure reliable processing of in-app purchases, subscriptions, refunds, and credits, we temporarily store technical purchase processing events.

These records are kept only as long as needed for debugging, reliability, fraud prevention, and purchase validation, and are normally deleted within 7 days, unless a longer retention period is required for security, fraud prevention, legal, accounting, or dispute-handling reasons.

8. Fraud Prevention

To protect Wunderli from abuse and fraud, we process limited fraud-prevention data, such as hashed or pseudonymized device-related or transaction-related signals.

This data is used to detect suspicious activity, duplicate purchase events, refund abuse, repeated account creation, or attempts to misuse credits.

Fraud-prevention data is used only for security and abuse prevention and is retained for up to 12 months, unless a longer period is required to investigate abuse, resolve disputes, or comply with legal obligations.

9. Data Sharing

We do not sell personal data.

We share data only where necessary with service providers who help us operate the App, including:

• app store providers, such as Apple and Google, for purchases, subscriptions, and refunds
• RevenueCat for purchase validation, subscription status, and credit management
• cloud hosting and database providers
• AI service providers used for story generation
• speech or narration service providers used for audio generation
• safety service providers used for content safety checks
• technical service providers used for reliability, crash reporting, and error logging
• authorities, courts, or regulators where legally required

For the Website, we additionally share data with:

• Google Ireland Ltd (Google Analytics 4) — only if you accept analytics cookies
• Meta Platforms Ireland Ltd (Meta Pixel) — only if you accept advertising cookies
• MailerLite UAB (waitlist email storage and delivery) — only if you sign up to the waitlist
• Web3Forms (contact form handling and delivery to ArvenX by email) — only if you submit a contact form
• our web host (technical hosting and content delivery)

Where service providers act as processors for us, they process personal data only on our instructions and under appropriate contractual agreements. Some providers, in particular app store providers such as Apple and Google, may also process personal data as independent controllers under their own privacy terms.

10. International Data Transfers

We are based in Switzerland.

Data may be processed in Switzerland, the European Economic Area, the United Kingdom, the United States, or other countries where our service providers operate.

Where personal data is transferred to countries without an adequate level of data protection, we use appropriate safeguards, in particular adequacy decisions, Standard Contractual Clauses, or other safeguards permitted under applicable law.

11. Data Retention

We keep data only as long as necessary for the purposes described in this Privacy Policy.

Some records are retained longer where required by law, accounting rules, fraud prevention, dispute handling, security investigations, or app store obligations.

12. Account Deletion

You can permanently delete your account from within the App.

To reduce accidental deletion by younger children, account deletion is protected by a parent gate, such as a simple math question.

When your account is deleted, we delete or anonymize personal data associated with the account, including:

• account profile data
• linked Apple, Google, or Microsoft Entra External ID identities
• saved stories
• character names
• credit balance and wallet data, where deletion is legally permitted

We also instruct relevant service providers, such as RevenueCat, where possible and necessary, to delete the data associated with your account, except where they are legally required to retain it or where further retention is legally permitted.

Important:

• deleted accounts cannot be restored
• signing in again with the same Apple ID, Google account, or Microsoft Entra External ID account creates a new account
• previous credits and saved content are not recoverable
• some purchase, subscription, refund, fraud-prevention, security, accounting, tax, or dispute-related records may be retained where legally required or necessary to protect the App from abuse

13. Your Rights

Depending on where you live, including under the GDPR, UK GDPR, and Swiss Federal Act on Data Protection (nFADP), you may have the right to:

• access your personal data
• request correction of inaccurate data
• request deletion of your data
• restrict or object to processing
• withdraw consent where processing is based on consent
• receive a copy of your data in a portable format
• lodge a complaint with a data protection authority

You can exercise some rights directly in the App, such as account deletion.

For other requests, contact us at: hello@wunderliapp.com

We may need to verify your identity before responding to certain requests.

14. Legal Bases for Processing

Where the GDPR, UK GDPR, or similar laws apply, we rely on the following legal bases:

• Contract performance: to provide the App, manage accounts, generate stories, manage credits, process subscriptions and credit packs, and deliver purchased features.
• Legitimate interests: to operate the App securely and reliably, prevent fraud and abuse, fix bugs, improve safety, ensure correct purchase and credit processing, and analyze aggregated or pseudonymized product interaction, usage, and diagnostic data, where your interests or fundamental rights do not override these interests.
• Consent: where required for optional features or communications.
• Legal obligations: to comply with tax, accounting, consumer protection, app-store-related, regulatory, or legal requirements.

15. Data Security

We use appropriate technical and organizational measures to protect personal data, including:

• secure storage
• access controls
• purchase event validation
• transaction deduplication
• account deletion safeguards
• separation of account data and fraud-prevention data where appropriate
• automated safety checks for character names and generated content

No system is completely secure, but we work to protect your data against unauthorized access, loss, misuse, or alteration.

16. No Third-Party Advertising or Cross-App Tracking in the App

In the App, Wunderli does not show third-party advertising.

We do not sell personal data.

The App does not use personal data to track users across apps or websites owned by other companies.

The App does not use third-party advertising identifiers for advertising or cross-app tracking.

On the wunderliapp.com Website, we use Google Analytics and Meta Pixel only with your explicit consent via the cookie banner (see Section 2.7). If you reject consent, the Website runs without these trackers and no analytics or advertising cookies are set.

17. Changes to This Policy

We may update this Privacy Policy from time to time.

If we make important changes, we will inform users in the App or through another appropriate method.

The "Last updated" date at the top of this Privacy Policy shows when it was last changed.

18. Contact

If you have questions or concerns about privacy or data protection, contact us at:

ArvenX GmbH
Wehrenbachhalde 47
8053 Zürich
Switzerland
Email: hello@wunderliapp.com
Website: https://wunderliapp.com