Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:

Germany

Email: hallo@little-big-dreams.com

Phone: +49 9401 8845 5160

Given the size of our company we are not required to appoint a data protection officer. Questions about privacy reach us at the email address above.

2. The short version

• We use no analytics or tracking services and embed no ad networks or social networks.
• Your child's photo is used for one drawing only: the hero's reference sheet. It is sent reduced in size, kept in a protected store in the EU until then, and deleted straight afterwards, usually within minutes of the purchase.
• To make the book we pass the child's first name, your questionnaire answers and, for that one drawing, the photo to AI services. Those services do not receive your email address.
• We only send emails that belong to your order or your sign-in. There is no newsletter.
• Your data is not used to train AI models, neither by us nor, under the terms of the interfaces we use, by our providers.

3. Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, Vercel necessarily processes your IP address, the date and time, the page requested, the amount of data transferred, and your browser and operating system. These details appear in server logs and serve the secure and stable operation of the site.

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel. Transfers to the USA rely on the EU-US Data Privacy Framework, under which Vercel is certified. More: vercel.com/legal/privacy-policy

4. Database and file storage

Orders, customer accounts and the finished books live in a database and a file store provided by Supabase Inc., USA, and run in a data centre in Frankfurt am Main, Germany. A book's pictures are stored under addresses that cannot be guessed and are reachable only through the link in your email or through your account.

We have a data processing agreement with Supabase. The data itself stays in Germany; any access by Supabase for maintenance from a third country is covered by the EU Commission's standard contractual clauses.

5. Your order and the making of your book

When you order a book we process the following:

• your email address, where we send the link to the book,
• the child's first name and age group,
• your questionnaire answers: hero type, traits, companion, setting, adventure, ending and the story's message,
• an optional dedication,
• the chosen book length, the language of the book and the language of the website,
• any discount code you used.

The story and the pictures are made from these details. We also store the finished book, its pictures, the progress of its creation and the details it was made from, so that you can open it at any time and so that we can remake it at your request.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). We keep the book and its details for as long as you can open the book, and at least twelve months from purchase. We delete a book earlier on request. Details we need for our accounts (order, amount, payment reference, billing address) must be kept for ten years under German tax and commercial law (§ 147 AO, § 257 HGB).

An order that is started but not paid contains the same details. We use it for nothing else and delete it on request.

6. Payment

Payment is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details, such as a card number, directly on Stripe's payment page. They never reach us.

We pass to Stripe your email address, the amount, an order reference and the product name, which contains the child's first name. From Stripe we receive confirmation of the payment, a payment reference and, in the case of a refund, its amount. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Stripe is partly a controller in its own right for payment processing and also processes data in the USA (Stripe, Inc.), relying on the EU-US Data Privacy Framework. More: stripe.com/privacy

7. Creation with artificial intelligence

The story and the pictures are made with third-party services that we use through their programming interfaces:

• The story is written by a language model from OpenAI (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland, and OpenAI, L.L.C., San Francisco, USA). OpenAI receives the child's first name, the age group and your questionnaire answers.
• The pictures are drawn by an image model through the fal.ai platform (Features and Labels, Inc., San Francisco, USA). fal.ai receives the picture descriptions, which contain the child's first name, and the previously generated drawing of the hero that all pictures are drawn against. For that one drawing of the hero, fal.ai also receives the uploaded photo; the copy fal.ai holds for it temporarily is deleted automatically after a short time under the terms of the interface. On every further picture the hero is recognised from that drawing only, not from the photo.

Your email address and the dedication are not sent to any of these services. Under the terms of the interfaces we use, the content sent is not used to train the models and is kept only briefly for abuse monitoring.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework for OpenAI and on the EU Commission's standard contractual clauses for fal.ai. More: openai.com/policies/privacy-policy and fal.ai/privacy

8. Your child's photo

While creating a book you upload a photo of your child. From it we draw the hero's reference sheet: a single drawing that every page and the cover are then drawn against, so that the main character resembles your child and stays the same on every page.

Before it is sent, your browser scales the photo down to about a thousand pixels on its long side and strips the file's metadata, such as where it was taken, in the process. Until you order, it sits only in your browser's memory; the draft we keep for you locally in the browser does not contain it.

With the order, the reduced photo is sent to us and placed in a non-public store at Supabase in the EU (section 4) under an unguessable path. It has no web address and can be read only by our server. It is sent once to fal.ai for the drawing of the hero (section 7). As soon as that drawing exists we delete the photo from our store, usually within minutes of the purchase. If creation fails or the payment is abandoned, we delete it as well, without any drawing being made. Independently of that, a daily automatic run deletes every photo older than 30 days, so no photo stays with us for longer than 30 days, whatever became of the order. The photo itself is never written to the database, does not appear in the book, and is not used to train AI models.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We keep the hero drawing together with the book (section 15), because redrawing a single page later without it would show a different child.

By choosing a photo you confirm that you are the child's parent or guardian, or have the express consent of the parent or guardian.

9. Customer account and sign-in

An account is created when you sign in with your email address. There is no password: we send you a six-digit code that is valid for five minutes. In your account you see every book ordered with that email address.

For the account we store the email address, the times you signed in and your chosen language. For each sign-in we store a shortened identifier of your browser (user agent), the time of last use and a hash of the session cookie. Requested sign-in codes are stored only as a hash, together with the number of failed attempts, to detect excessive requests and guessing; they are deleted after 30 days at the latest.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for abuse protection, our legitimate interest in the security of accounts (Art. 6(1)(f) GDPR). A session ends after 60 days or when you sign out. We delete your account on request to the email address above; your books then remain reachable through the link in your email until you ask for their deletion too.

10. Emails

We only send emails that belong to your order or sign-in: the sign-in code, the message that your book is ready, and in rare cases the message that something went wrong while making it. There is no newsletter and no advertising by email.

Delivery is handled by Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend receives the recipient address, the subject and the body of the email, which includes the book's title and the child's first name. We have a data processing agreement with Resend; transfers to the USA rely on the EU Commission's standard contractual clauses. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

11. Discount codes and partner links

If you open a partner's link, for example from a social media post, we remember the discount code it carries in a cookie for 30 days so that it is applied automatically at checkout. When you buy, we record which code was used so that we can settle the agreed terms with the partner. The partner only learns how often the code was used, not by whom.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). The cookie is necessary for the discount you asked for (§ 25(2) no. 2 of the German TDDDG).

12. Cookies and local storage

We only set cookies that are necessary to run the website and to provide the functions you ask for (§ 25(2) no. 2 TDDDG). That is why we need no consent and show no cookie banner. There are no third-party cookies.

The website also keeps in your browser's local storage things that concern only you and never reach our servers:

• your questionnaire answers without the photo, so that you can continue after an interruption. They are deleted after purchase, or when you clear the site data in your browser.
• a flag that you have already seen the welcome animation on the home page.

The website's fonts are served from our own servers. No connection is made to Google Fonts or any other font provider.

13. Abuse protection

To protect the checkout and the discount code check against automated requests, we count requests per IP address over a 15-minute window. Anyone over the limit has to wait a short while. These counters are normally deleted within a day after the window ends. The legal basis is our legitimate interest in undisturbed operation (Art. 6(1)(f) GDPR).

14. Transfers to third countries

Some of our providers are based in the USA or process data there: Vercel (hosting), Stripe (payment), OpenAI and fal.ai (creation) and Resend (email). Transfers rely on an adequacy decision of the EU Commission (the EU-US Data Privacy Framework) where the provider is certified under it, and otherwise on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR). A copy of the clauses is available on request.

15. Retention at a glance

16. Your rights

Regarding your personal data you have the following rights against us:

• access to the data we hold (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless a statutory retention duty stands in the way,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on our legitimate interest (Art. 21 GDPR).

Write to hallo@little-big-dreams.com for any of these. We reply within one month.

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also contact the authority where you live.

17. Children

Our service is aimed at adults. The details about a child, that is the first name, the age group and the questionnaire answers, are given by you as a parent or guardian. We use them solely for the book you ordered and pass them only to the services named in sections 6 and 7, as far as payment and creation require.

18. Changes

We update this policy when our service or the law changes. The version published here applies; the date at the top shows when it was last updated.