Privacy Policy for Sleepy Notes

1. Who We Are#

Sleepy Notes is operated by Little Keeps. Little Keeps is the trading name of Ankita Ahuja, a sole proprietor based in India, who is responsible for the personal data described in this policy. In this Privacy Policy, "Sleepy Notes," "we," "us," and "our" refer to Little Keeps and the Sleepy Notes app.

You can contact us at hello@littlekeeps.in.

2. Who the App Is For#

Sleepy Notes is designed for use by parents and legal guardians. Children do not create accounts in the app and should not provide information directly to us. Child-related details are entered by the parent or legal guardian to personalise audio content and recommendations.

Users must be 18 or older and must be the parent or legal guardian of any child profile they create.

3. Information We Collect#

Account and authentication data#

We collect information needed to create and manage your account, such as your email address, authentication provider details, user ID, session information, account creation date, and which version of our Terms of Service you agreed to and when (recorded when you sign in with a current version of the app).

If you sign in with Google, Google also passes our sign-in provider, Supabase, the name on your Google account and a link to your Google profile picture. They are stored with your sign-in record because that is how the sign-in service works, but the app never reads or shows them, and we do not use them for anything.

Child profile data entered by you — stored on your device, not on our servers #

You may enter child profile details such as display name, pronunciation name, pronouns or gender selection, listening stage, and favourite theme. We use this information only to personalise the app experience and audio content.

These details are stored on your phone, not on our servers. For each child profile our servers hold a random identifier, the date you confirmed you are the child's parent or guardian, and settings that carry no information about the child: whether name personalisation is switched on, and which narrator voice you have chosen for them. The list of which stories your child has opened, which is what lets the app show you which stories are new, is kept on your phone only. Our record of each story generation notes which child profile it was made for, for up to two days (see "Generation records" below). Some stories come in a girls' and a boys' edition, and that record names the edition made, so it shows whether the story was made for a girl or a boy on your account. There is no name, no pronunciation spelling, no pronoun, no age range and no theme: our database holds no child names or ages.

To choose which stories to suggest, the app sends the age range and favourite themes you picked for your child to our server each time the suggestions load — with no name and nothing that identifies the child. They are used only to pick the suggestions and are not stored.

One necessary exception, and we would rather state it plainly than imply more than is true: when you generate a story, the finished story text — which contains your child's name if you have personalisation switched on — is sent to our speech provider, Cartesia, a third-party AI voice service, so it can be spoken aloud. The same happens when you play a pronunciation preview of the name. So the name is never stored on our servers, but it is processed by our speech provider at the moment a story or preview is made. We keep no record of what was previewed.

Because these details live on your device, we do not hold a copy. They may also be included in your phone's own device backup (iCloud or a computer backup), but we do not rely on that to bring them back. The app can export a backup file you keep yourself, which restores your child profiles, stories and audio onto a new device; that is the way we support.

Your Support ID#

Settings, under Help & support, has a Copy support ID button that puts a short Support ID on your clipboard, so you can paste it to us when you ask for help. (The app deliberately does not display the value on screen — there is nothing you need to read or type.) It is a one-way scrambled form of your account identifier — it cannot be turned back into your email address, and it is the same identifier our analytics are recorded against. It exists because if you sign in with Apple and hide your email address, it is the only way we can find your account to help you.

Signing in with Apple or Google#

We identify your account by the email address your sign-in provider gives us. If you sign in with Apple and choose "Hide My Email", Apple gives us a private forwarding address instead of your real one — which is a privacy feature working as intended, and we never see your real address.

One practical consequence is worth knowing: because that private address is not your real one, we cannot tell that an Apple sign-in and a Google sign-in belong to the same person. If you use both, they are two separate accounts, each with its own children, credits and voice profile. Where you shared your real address with Apple and it matches your Google address, both sign-ins reach the same account.

We are not able to join two accounts together, so we suggest using the same sign-in method every time. Nothing is lost either way — signing back in the way you did originally returns you to your account.

Voice recordings and voice profile data #

If you choose to record your own voice, your recording passes through our own service — which checks it and forwards it, keeping no copy — to our voice technology partner, Cartesia, to create a reusable voice profile. We do not store your raw voice recording — not on our servers, and not permanently on your device. It exists on your device only while it is being uploaded to Cartesia, and is deleted from your device once your voice profile has been created. On our side, all that is kept afterwards is a reference to the profile, not the recording. Cartesia is different: they retain the recording, or a voice model built from it, for as long as your profile exists — that is what lets future stories be narrated in your voice without you re-recording. Section 7 explains this and what we have done about it. We separately store voice profile metadata such as your chosen parent label (e.g. "Mum"), your consent record and its version, and related technical information needed to manage the profile. New voice profiles are named at Cartesia with a random code; older ones were given the parent label as their name there. You must only record your own voice unless you have explicit written consent from the speaker.

Generated audio and user content#

Generated story audio is created for you and saved only on your own device — we do not store your generated audio files on our servers. (If you choose background music, the narration is sent to our audio mixing service to be combined with the music track and returned; nothing is kept there.) Custom stories, custom messages, favourites, playback preferences, and short name-pronunciation previews you create are also stored only on your device, not on our servers. We do process the story template and any custom text you provide at the moment audio is generated, in order to produce that narration, but we do not retain that text afterwards.

Because none of this is on our servers, it does not follow your account to another device, and it does not survive deleting the app. The way to keep it is the app's own backup file, described above — that is the only path we promise. Our support page has the step-by-step guide.

Generation records#

Each time audio generation is attempted, we keep a short record on our servers so we can bill credits correctly, enforce limits, and investigate failures. It contains your account identifier, the story template identifier, the internal identifiers of the child profile and voice used, whether the attempt succeeded or failed and why, the number of characters narrated, and the time. It does not contain your child's name, the story text, or the audio itself. The child profile identifier is removed from each record within two days; it is needed only briefly, so a story that failed to reach your phone can be remade free. For a story that comes in a girls' and a boys' edition, the story template identifier names the edition, so the record shows which one was made on your account. The records themselves are kept for up to 12 months, and are deleted sooner if you delete your account.

Purchases#

Sleepy Notes offers one-time in-app purchases — story credit packs — rather than a recurring subscription. The first pack you buy also unlocks premium features, for as long as Sleepy Notes is offered; there is no separate unlock to purchase. When you make a purchase, we process purchase and transaction identifiers, your entitlement status (whether premium features are unlocked), and your story credit balance, through Apple and RevenueCat. We do not receive your full payment card details; payment is handled entirely by Apple.

If you ask Apple for a refund, Apple may ask us, through RevenueCat, how the purchase was used, such as whether its credits were spent, so that Apple can decide the request. If we answer, it is only for that purpose. Apple decides refund requests made to Apple.

Analytics, diagnostics, and support#

We may collect app interaction data, feature usage, crash reports, performance data, device/app version details, support emails, and attachments you choose to send. We may also collect a simple thumbs up/down rating if you choose to leave feedback. We do not use this data for advertising profiles.

Two analytics events also record the age range or ranges (listening stage) you chose for a child: the one recorded when you add a child profile, and the one recorded when you start a routine. Like all our analytics, they are recorded against your account, never against a child, and they are designed never to include a child's name.

IP address and approximate region#

Like any app that connects to the internet, Sleepy Notes reaches our providers over a network connection, and those providers see the IP address your device connects from. This is unavoidable — it is how a request reaches a server and how the answer gets back — and it is used to deliver the service, keep it secure, and prevent abuse.

We do not build a location profile from it. The app tells our analytics provider not to look up a location from your IP address, so events carry no country, region or city. We do not collect GPS or any precise location, and we never ask you which country you are in. Where your purchase happens, and in what currency, is determined by Apple from your App Store account — not by us.

We do not use IP address, inferred region, or anything else in this policy for advertising, ad targeting, or behavioural profiling — of you or of your child.

4. Information We Do Not Intentionally Collect #

Sleepy Notes is built around data minimisation. We do not intentionally ask for or collect a child's date of birth, photos, precise location, school name, class, medical information, developmental information, or advertising identifiers linked to a child.

5. How We Use Information#

• To create and secure your account.
• To save child profiles entered by a parent or legal guardian.
• To personalise notes, stories, recommendations, and generated audio.
• To create and manage voice profiles after explicit consent.
• To generate and play audio in the app.
• To process purchases and enforce entitlements, usage limits, and safety controls.
• To provide support and respond to privacy or deletion requests.
• To monitor reliability, prevent abuse, and improve the app.

Why we are allowed to use it#

• Your consent — for your voice profile, which is only created after you accept the consent notice in the app, and for the child details you enter as the child's parent or guardian. You can withdraw either by deleting the voice profile or the child profile.
• Providing the service you asked for — your account, your purchases, and generating and playing the stories you choose.
• Keeping the service secure and working — diagnostics, abuse prevention and product analytics, where the law of your country allows this without separate consent. Where it requires consent instead, we rely on consent.
• Legal obligations — for example keeping purchase records, and responding to lawful requests from authorities.

6. Third-Party Service Providers#

We use trusted service providers to operate Sleepy Notes. These providers process data to provide their services to us. Cartesia's terms also give it wider rights over what it receives, described in the box below and in Section 7.

• Supabase for authentication, database, storage, and serverless functions.
• Cartesia for text-to-speech and custom voice processing.
• Google Cloud Run for backend audio processing and mixing services.
• PostHog for privacy-conscious product analytics and error diagnostics.
• Apple and RevenueCat for purchases and entitlements.
• Expo/EAS for app build and update infrastructure where applicable.
• Cloudflare for hosting this policy and our support pages.
• Google as a sign-in provider, if you choose to sign in with Google. This is separate from Google Cloud Run above.
• GoDaddy for our email, so it holds the messages you send to hello@littlekeeps.in.
• Apple iCloud Drive, where the encrypted backups of our database described in Section 9 are kept.
• Anthropic for the AI developer tools we use to maintain Sleepy Notes and investigate faults. When we use them, they may process error reports and usage events, which are recorded against a scrambled account identifier, and the account records needed to look into a specific problem. They never receive voice recordings, and child names are not on our servers for them to receive. The reports these tools write for us are sent to our own Gmail account, so Google holds those too.

7. Voice Data and Consent#

Before creating a custom voice profile, Sleepy Notes shows an in-app consent notice. You must confirm that you are recording your own voice and that you have the legal right to do so. Misuse of the voice feature, including impersonation or recording someone else's voice without permission, is not allowed.

Your raw voice recording is not stored on our servers, and not in any cloud storage bucket of ours, private or otherwise. It is held only briefly on your device while it is uploaded to Cartesia to create your voice profile, is deleted from your device once that profile exists, and is not retained by us afterwards — nothing in the app keeps or re-reads a copy. On our side, all that remains is a reference to the voice profile.

Cartesia is different, and we want to be plain about it rather than let "we don't keep it" imply nobody does. Cartesia's own documentation states that voice cloning "require[s] retaining uploaded audio samples or derived voice artifacts to function". So your recording, or a voice model built from it, is held by Cartesia for as long as your voice profile exists. That is what makes future stories playable in your voice without you re-recording. Voices we create are marked private to our organisation.

Your voice profile reference is deleted, and Cartesia is asked to delete the underlying voice, when you delete the voice profile or your account, or when the profile is deleted automatically after 24 months unused (Section 9).

Cartesia and AI model training#

We want to be direct about this, because it concerns your voice and your child's name. Cartesia's standard terms allow them to use content sent to their service — including voice recordings, the text we send to generate a story, and the audio they produce — to train and improve their own AI models. Those terms also grant Cartesia a broad, long-lasting licence over that content. Cartesia's handling and retention of what it receives is governed by their own Terms of Service and Privacy Policy, which govern how Cartesia handles what it receives.

We have switched model training off for our Cartesia organisation. Cartesia describes that setting as covering text-to-speech generations — the story text we send and the audio produced from it — and speech-to-text transcriptions.

We would rather tell you where that setting stops than let you assume more from it than it gives. Cartesia excludes voice cloning from it, and from their no-retention option, on the stated grounds that cloning needs the uploaded sample or a model derived from it in order to work at all. Their policy also says an opt-out does not apply to content sent before it took effect, and the broad licence in their terms remains in place as a contractual matter regardless of the setting.

In short: the story text and the generated audio are covered; the recording you make to create your voice is not. If you are not comfortable with that, please do not record your voice — Sleepy Notes works with preset voices, which involve no recording of you at all.

7a. How AI Is Used, in Plain Terms#

Sleepy Notes uses AI to turn written stories into spoken audio. It does not use AI to write stories, and no story text is generated while your child is listening.

• Our preset narrators are AI voices. They have names and described personalities so you can tell them apart, but they are not recordings of real people and no person is being impersonated.
• Stories in your own voice are AI-generated speech. They are built from the sample you recorded and are designed to sound like you. They are not recordings of you reading those stories — you never read them.
• Story text is fixed. Every story in our library is written and reviewed before we publish it, and a story you write yourself is spoken exactly as you wrote it. No AI writes or alters a story at the moment your child hears it, and nothing your child does changes what a story says.

We say this because a voice that sounds like a parent is exactly the kind of thing people should not have to guess about.

8. Children's Data#

Children do not use Sleepy Notes — parents do. A child has no account, never signs in, and never types, taps, records or submits anything. There is no child mode, no child login, and no screen a child is meant to operate. A child listens; that is the whole of their involvement.

Everything we hold about a child was typed in by their parent or guardian: a first name, optionally how to pronounce it, a pronoun, an age range, and a favourite theme. That is the complete list of what you tell us about a child. We do not collect a child's date of birth, photograph, location, school, contact details, or voice.

All of it is kept on the parent's own device. Our servers store a random identifier for each child profile, the date the parent confirmed they are the child's parent or guardian, the narrator-voice and personalisation settings chosen for that profile, and our record of each story generation notes which child profile it was made for. None of it describes a child: no name, age or theme. The one exception is a story that comes in a girls' and a boys' edition: our record of making it names the edition, which shows whether it was made for a girl or a boy. The only times a child's name leaves the device are inside the story text sent to our speech provider when you generate a story, so that it can be spoken in your voice, and when you play a pronunciation preview of the name. That story text also carries the pronouns you chose for your child.

We do not build a profile of a child, and nothing about a child is used for advertising. There is no advertising in Sleepy Notes at all. To suggest stories, the app sends your child's age range and favourite themes to our server, with no name and nothing that identifies the child; they are used only to pick the suggestions and are not stored. Analytics are recorded against the parent's account, never against an individual child. Analytics recorded while a story plays are used only to keep the app working and to improve it, never to profile, advertise to or contact anyone.

Child-related data is used to personalise audio content and story recommendations. Parents and guardians can update or delete child profiles in the app at any time.

If you believe a child has provided information to us directly, contact us at hello@littlekeeps.in so we can review and delete it where appropriate.

9. Data Retention and Deletion#

• Account data is kept until you delete your account or request deletion.
• Child profile details (name, pronunciation, pronoun, age range, theme) are stored on your device and are kept until you delete the child profile or your account. Deleting the app removes them from that phone; a device backup you made earlier may still contain them. The profile's random identifier, guardian-confirmation date, and profile settings are removed from our service when you delete the child profile or your account. The identifier can stay for up to two days in our generation records (Section 3), and our backups are covered below.
• Your raw voice recording is not retained by us at any point, and is deleted from your device once your voice profile is created. Cartesia does retain it, or a voice model built from it, for as long as the profile exists — see Section 7. Your voice profile and the reference we hold to it are both deleted when you delete the voice profile or your account, or automatically after 24 months unused (see "Voice data" below). Our internal log of voice profile changes keeps the profile's random identifier, and nothing else about the voice, for 12 months.
• Generated audio, custom stories, and custom messages are stored on your device and are kept until you delete them, delete the related child profile, or delete your account — we do not hold copies of this content on our servers.
• Support emails are kept as part of our support records for as long as you have an account with us — this is what lets us recognise a problem you have reported before — and for a reasonable period afterwards, while a related billing, refund or legal question could still be raised. We do not use them for marketing, and you can ask us to delete them at any time.
• Analytics and diagnostics carry no child names, story text, voice identifiers, audio, or email addresses — they are recorded against a scrambled account identifier. We request deletion of your analytics record when you delete your account. Otherwise we keep this data only for as long as it remains useful for understanding how the app is used and fixing faults.
• Records of story generation, described in full under "Generation records" in Section 3, are used to bill credits correctly, enforce limits, detect abuse and investigate failures. They are kept for up to 12 months, and are deleted sooner if you delete your account.
• We keep encrypted backups of our database so that we can recover from a fault. When you delete something, it is removed from our service as described above, and copies of it in these backups are deleted on a short, fixed schedule. The backups are kept on our own computer and in Apple iCloud Drive. So that restoring a backup can never bring deleted data back, we keep the random identifier of a deleted account, child profile or voice profile, and nothing else about it, for a short, fixed period.

Voice data: retention schedule and destruction #

Because a voice profile is more sensitive than the rest, this is stated separately and precisely:

• The recording itself is never retained by us. It passes through our systems to reach Cartesia and is not written to any database or storage bucket. The copy on your device is deleted as soon as the voice profile has been created.
• The voice profile is retained while you use it, and for no longer. It is kept until you delete it, and is deleted automatically if no story has been made or played in it for 24 months. If you open the app in the month before, it shows a warning. Making a story in the voice keeps it, and so does playing one in an up-to-date version of the app.
• It is destroyed when you delete the voice profile, or when you delete your account — or when it reaches 24 months unused, whichever happens first. Deleting a voice profile or your account is available in the app at any time, and neither requires contacting us. Destruction means the profile reference is removed from our database and Cartesia is instructed to delete the voice and any model derived from your recording.
• Timeframe. When you delete a voice profile or your account, deletion is requested immediately — within seconds of you tapping delete, not on a batch or a schedule. A voice deleted for being unused is removed by a nightly job, and Cartesia is asked to delete it, usually the same night. If Cartesia cannot be reached at that moment, the deletion is queued and retried automatically once a day for five days. It is never silently dropped: if those retries do not succeed, the request is kept and flagged for our team to complete by hand. Your account deletion is not delayed while we wait.

Account deletion is available in the app settings. When you delete your account, Sleepy Notes deletes account data, child profiles, voice profile references, and related database records, and any remaining generated audio, custom stories, and custom messages on your device, subject to technical completion and any legal obligations that require limited retention.

We also ask Cartesia to delete each of your voices. If Cartesia cannot be reached at that moment, the deletion is queued and retried rather than dropped, and your account is still deleted immediately — a provider being down does not delay your right to have your data erased. We separately request deletion of the customer record held for you by our analytics provider and by our payments provider; as with Cartesia, your account deletion completes immediately and is never held up by one of these providers being unavailable. Analytics events already recorded are not tied to your name or email and are not deleted; they are retained as described above. If one of these providers cannot be reached, we keep the identifier it knows your account by — a scrambled identifier for analytics, your account's random identifier for payments — only until the deletion there has been completed.

10. Your Choices and Rights#

These rights apply to everyone, wherever you live. Rather than giving different people different rights depending on their country, we apply the same set to every user. You may ask us to:

• tell you what data we hold about you and your child, and get a copy of it;
• correct anything that is wrong;
• delete your data, your child's profile, your voice profile, or your account;
• withdraw a consent you previously gave, including voice consent;
• explain how and why your data is processed, and who it is shared with.

Most of these you can do yourself, immediately, in the app — deleting a voice profile, a child profile, generated audio, or your whole account are all in Settings and none of them requires asking us.

To make a request that the app cannot do for you, contact hello@littlekeeps.in. We respond within 30 days. We may need to verify your identity first, and we will normally do that by asking you to write from the email address on the account.

If another data protection law applies to you, the same rights above apply, and you may also have a right to complain to your local data protection authority. What that means where Sleepy Notes is available:

India#

We apply the rights in the Digital Personal Data Protection Act, 2023, including the right to nominate someone to exercise your rights if you die or become unable to. Our Grievance Officer is named in Section 14. If you are not satisfied with how we have handled a grievance, you may complain to the Data Protection Board of India.

United States#

We do not sell or share personal information, and we do not use it for targeted advertising. Because we do no tracking across other companies' apps or websites, we do not change anything in response to "Do Not Track" or similar browser signals. Sleepy Notes accounts are for adults. Children do not have accounts and do not give us information — they listen to audio a parent plays — and we do not knowingly collect personal information from a child. Information about a child is entered by their parent or guardian, as described in Section 8.

Some US state laws may treat a voice profile as a biometric identifier, or a "voiceprint". We create one only after you accept the written consent notice in the app, we use it only to narrate stories for your family, and we never sell, lease or trade it. How long it is kept and how it is destroyed is set out in Section 9, under "Voice data: retention schedule and destruction".

Australia#

You may ask for access to, or correction of, the personal information we hold about you. The overseas places where it is processed are listed in Section 12. If you are not satisfied with our response to a privacy complaint, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand#

You may ask for access to, and correction of, your personal information under the Privacy Act 2020. We collect your child's details from you, as their parent or guardian, and this policy is our notice of that collection. Our Privacy Officer is named in Section 14. You may complain to the Privacy Commissioner (privacy.org.nz).

Singapore#

You may ask for access to, or correction of, your personal data under the Personal Data Protection Act 2012, and you may withdraw consent; withdrawing consent for your voice profile or a child profile means deleting it. Our Data Protection Officer is named in Section 14. You may complain to the Personal Data Protection Commission (pdpc.gov.sg).

If there is a data breach#

If a breach of our security affects your personal data, we will notify you and the relevant regulator wherever the law of your country requires it. If an incident could affect voice profiles, we will also contain it and, where that protects you, ask Cartesia to delete the voices affected.

We do not sell your personal information, and we never have. We do not share it for advertising or for any cross-context behavioural advertising, and we do not use it to profile you or your child.

11. Security#

We use technical and organisational safeguards designed to protect your data, including authenticated access, private storage, server-side processing for sensitive operations, and access controls. Traffic between the app and our services is encrypted in transit using TLS. Secret keys for our voice and payment providers are held server-side and never shipped inside the app.

Our database, authentication, and file storage run on Supabase, which is hosted on Amazon Web Services. Supabase states that all customer data is encrypted at rest with AES-256 and in transit via TLS, and that it is SOC 2 Type 2 compliant. Those are their commitments about their platform rather than ours about our own code, which is why we attribute them.

No online service can guarantee absolute security, but we work to protect the data you trust us with.

12. International Processing#

Sleepy Notes is operated from India, and our service providers process data in several countries — which will not be the country you live in. Rather than say that vaguely, here is where each part actually sits:

• Database, sign-in and file storage — Supabase, running on Amazon Web Services in Tokyo, Japan.
• Voice profile creation and narration — Cartesia, a United States company. Cartesia has not told us where its processing takes place.
• Background music mixing — Google Cloud Run, in Mumbai, India.
• Analytics and error reporting — PostHog, in the European Union.
• Purchases and entitlements — Apple and RevenueCat, in the United States.
• These legal pages — Cloudflare, served from its global network.
• App updates — Expo (EAS), a United States company, delivered through its global network.
• Our server functions — Supabase runs them in the region nearest you, so a request (including a voice recording or story text on its way to Cartesia) may pass through that region before it reaches our database or Cartesia.
• Email — GoDaddy, a United States company.
• Database backups — encrypted, on our own computer in India and in Apple iCloud Drive.
• AI developer tools — Anthropic, a United States company; their reports reach us through Gmail (Google).

Where a transfer of personal data between countries requires a specific legal safeguard, we put appropriate contractual and technical safeguards in place with the provider concerned, including data processing agreements where the provider offers them. Cartesia's data processing terms form part of its standard terms of service rather than a separately signed agreement. Cartesia also uses what it receives under its own terms, including for its own purposes as described in Section 7, and the United States may not protect your information in a way that, overall, matches the privacy law where you live. We tell you this so that you can decide whether to record your voice; the preset narrators involve no recording of you.

Our analytics are configured to reduce what leaves the app: the app tells our analytics provider not to look up a location from your IP address, and session recording is disabled. Our analytics are designed never to include child names, story text, voice identifiers, audio, or email addresses.

13. Changes to This Policy#

We may update this Privacy Policy as Sleepy Notes changes or as legal requirements evolve. Before a material change takes effect, we will give at least 30 days' notice in the app, saying what is changing, unless the law requires the change sooner or it is a change of service provider needed to keep Sleepy Notes running, which we will tell you about as soon as we can.

14. Contact#

For privacy questions, deletion requests, or support, contact Little Keeps at hello@littlekeeps.in.

Person responsible for data protection. Ankita Ahuja is our Grievance Officer (India), Privacy Officer (New Zealand) and Data Protection Officer (Singapore), responsible for how we handle personal data and for privacy complaints. Write to hello@littlekeeps.in. A grievance — a complaint about how we have handled your data — should have "Grievance" in the subject line; we acknowledge it within 48 hours and aim to resolve it within 15 days. Requests to exercise your rights are answered as described in Section 10.