Privacy policy

Kids Own Story is run by [company name, registered address, company number]. We decide how your information is used, which makes us the “controller” under data-protection law. You can reach us at [privacy@ email] about anything on this page.

The photo is the most sensitive thing you give us, so here is exactly what happens to it.

• Before you pay, it doesn’t leave your device. When you pick a photo it stays in your browser tab. Nothing is uploaded, checked or stored until you have agreed and paid.
• Your payment confirms your consent. You tick the consent box next to the Pay button; the payment is how we verify that an adult who can consent for the child agreed. We keep a record of that consent (see “How long we keep it”).
• Then it goes to our server, briefly. It is held in memory only — never written to a disk or a database — and deleted the moment the film starts, or after 30 minutes at the latest.
• Our production partner makes the character from it. The photo is sent over an encrypted connection to [production partner], which checks it (one clear face) and draws your child’s character. A photo it turns away is not kept. Once the character is made the photo is deleted there too.
• Face data. To keep the character looking like your child, the production system measures the face in the photo (a “face template”). That is biometric data. It is used only for your film and deleted [after N days / when the film is finished].

We never use your child’s photo, face data or film to train AI models, for advertising, or to make anything other than what you ordered.

• Your account: email address and the name you give us.
• About the child, for the story: first name, age, how the story should refer to them (girl, boy or neither), the photo, and anything you write about what the story should be about.
• About you, for consent: your name, how you are related to the child, and your country.
• Orders: which film you ordered, its status, and the payment reference. Card details go to [payment provider] and never reach us.
• What we make: the character, the film and the images made along the way.
• Sign-in: one cookie that keeps you signed in, and a record of the session.

• To make and deliver your film — because you asked us to (a contract with you).
• To use the child’s photo and face data — only with the explicit consent you give at checkout on the child’s behalf. Each film has its own consent.
• To keep the consent and payment records — because the law requires us to be able to show consent was given, and for accounting.
• To keep the service secure — for example limiting how often sign-in links can be sent (our legitimate interest).
• Marketing email — only if you switch it on in Settings. It is off until you do. Emails about your own films (sign-in links, “your film is ready”) are sent either way.

• The photo: on our server 30 minutes at most; at the production partner until the character is made.
• Face data: [period].
• Your film and its character: [30 days after it’s ready], or until you delete it — whichever is first. Download it to keep it.
• Sign-in links: 15 minutes, one use. Sessions: 30 days.
• Account: until you ask us to close it.
• Consent and payment records: [period required by law], even after a film is deleted.

Every film has a Delete button. It erases the film, the character drawn for it and everything made along the way at the production partner, and then removes the order from your account. It can’t be undone. To close your whole account, write to [privacy@ email] and we will erase it within [30] days.

Only companies that help us run the service, under contracts that let them use the data for that alone:

• Hosting: Railway (our servers; the production system runs in the EU).
• Production: [production partner] and the AI and video services it uses: [list].
• Email: [email provider], for sign-in links and film notifications.
• Payments: [payment provider].

We don’t sell data and don’t share it for advertising. Where data leaves the UK/EEA it is protected by [standard contractual clauses / adequacy decision].

Kids Own Story is for parents and guardians. Children don’t use the site or have accounts. We only use a child’s information with the consent of an adult who can give it, verified by card payment. If you think we hold a child’s information without that consent, write to us and we will delete it.

One cookie, needed to keep you signed in. Your browser also keeps a copy of your characters and films so pages open quickly; signing out clears it. No analytics, no advertising, no tracking cookies.

You can ask to see the information we hold about you or your child, to correct it, to delete it, to restrict or object to its use, to receive it in a portable form, and to withdraw consent at any time (this doesn’t undo what was done before). Write to [privacy@ email]. You can also complain to your data-protection authority — [e.g. the ICO in the UK].

If we change how we handle data we’ll update this page and, for anything significant, email you first. Questions: [privacy@ email], [postal address].