Privacy Policy

1. Data Controller

This Privacy Policy explains how your personal data is collected, used, and protected when you use the services provided by:

• Business name: talesofus.ai (Eenmanszaak)
• KvK-nummer: 98879200
• Address: Elzenhagensingel 1051, 1022 LA Amsterdam, Netherlands
• Email: hi@talesofus.ai
• Website: talesofus.ai

We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our services, you acknowledge that you have read and understood this Privacy Policy.

2. What We Do

TalesOfUs creates personalized AI-generated storybooks. You provide one or more character names and reference photos, story preferences, and customization choices. We use artificial intelligence to generate a unique illustrated story, which we produce as a professionally printed hardcover book and ship to your address. You do not need to create an account: we handle each order on a one-off basis.

3. Personal Data We Collect

3.1 Information You Provide

• Contact information: Name, email address, shipping address, and phone number, collected during checkout by our payment processor
• Email updates: If you opt in during checkout, we send the email address and billing name collected by Stripe, the checkout interface language, and a timezone estimated from the billing country to Brevo to send occasional Tales of Us news and offers. We record your consent with your order
• Payment information: Handled securely by our payment provider (Stripe) under the PCI DSS security standard
• Story customization data: Character names and pronouns, story preferences, the free-text details you provide about your story, style and genre choices, and an optional personalized message
• Photographs: Reference photos you upload for character illustration (see Section 4 for details)
• Communications: Messages you send to our customer support

3.2 Information Collected Automatically

• IP address: Processed by our security and anti-abuse providers to help protect the service
• Device and browser information: Browser type, operating system, and device type
• Usage data: With your optional consent, pages visited, product interactions, referring URLs, approximate location, and checkout events collected through Google Analytics / Firebase Analytics
• Technical diagnostics: With your separate optional consent, technical error information (such as the error type and your browser and device) collected through Sentry

4. Photographs and Image Data

Photo storage and retention: Uploaded photos are stored privately and are not publicly accessible. We keep them so that a character can be reused consistently across previews and books, and we delete them when you ask us to (see Section 10).

Consent for photos of others: If you upload a photo of another person (including a child), you confirm that you have obtained their consent (or, for a minor, the consent of their parent or legal guardian) to use their likeness for creating a personalized story.

5. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b)): Processing necessary to fulfill your order, including generating your story, printing your book, shipping, and customer support
• Legal obligation (Art. 6(1)(c)): Processing required to comply with tax, accounting, and other legal requirements
• Legitimate interests (Art. 6(1)(f)): Fraud and abuse prevention, security, and improving the quality of our generated content, balanced against your rights and interests
• Consent (Art. 6(1)(a)): Optional website and order-funnel analytics, optional technical diagnostics, optional email news and offers, and, where you upload a photo of another person, your confirmation of their consent

6. How We Use Your Data

We use your personal data exclusively for:

• Processing and fulfilling your book orders
• Generating personalized AI stories and illustrations based on your inputs
• Communicating order confirmations, shipping updates, and delivery notifications
• Providing customer support and responding to inquiries
• Preventing fraud and automated abuse
• Complying with legal and tax obligations
• Understanding and improving how our service is used (with your optional analytics consent)
• Sending occasional Tales of Us news and offers by email if you opt in during checkout

We do not: Sell your personal data, use it for third-party advertising, or share it with third parties for their own marketing.

7. Third-Party Service Providers (Data Processors)

To deliver our services, we share your data with trusted third-party providers who act as data processors under GDPR. These providers process your data only on our instructions and are contractually bound to protect it:

AI and Content Generation

• OpenAI (USA): Generates your story's written text. Receives: character names and pronouns and the story details you provide. Privacy Policy
• Google Gemini (USA): Creates your story's cover and chapter illustrations. Receives: your uploaded reference photos and the associated character and story details. Privacy Policy
• Leonardo.ai (Australia): Enhances the generated cover image to print quality. Receives: the generated cover illustration, which may depict a likeness from your reference photos. Privacy Policy
• Langfuse Cloud (EU): Helps us monitor and improve the quality of our AI-generated stories. Receives: character names and generated story content. Privacy Policy

Payment Processing

• Stripe (USA): Securely processes your payment in compliance with PCI DSS and collects your checkout details. Receives: name, email, phone number, billing and shipping address, and payment details. Privacy Policy

Printing, Fulfillment and Email

• Cloudprinter.com B.V. (Netherlands): Routes the printing and shipping of physical books. Receives: your name, shipping address, phone number, email address, and the book files (which contain your story and illustrations). Privacy Policy
• Email delivery provider: We use a third-party email provider to send you order confirmations and shipping notifications. Receives: your email address and the contents of those messages (such as book titles and tracking links).
• Brevo (France): Manages our optional marketing email list and sends occasional news and offers if you opt in during checkout. Receives: your email address, billing name, checkout interface language, and a timezone estimated from the billing country. You can unsubscribe using the link in a marketing email. Privacy Policy

Infrastructure and Supporting Services

• Google Cloud / Firebase (USA): Hosts our services and securely stores your photos, story data, and order records (see Section 8). Privacy Policy

We also rely on a few supporting providers that receive only limited technical or pseudonymous data: Cloudflare for content delivery and security, Google reCAPTCHA for protection against automated abuse, Google Analytics for optional usage analytics, Sentry for optional error diagnostics, and Slack for internal operational notifications. The optional analytics and diagnostics are only used with your consent, as described in Section 12.

Optional voice dictation: Some story fields let you dictate text instead of typing. This uses your browser's built-in speech-recognition feature, which in some browsers (such as Google Chrome) sends the recorded audio to Google for transcription. Dictation is entirely optional.

8. International Data Transfers and Data Location

We are based in the Netherlands (EU), but we store your photos, story data, and order records on Google Cloud infrastructure located in the United States, and several of our other service providers are also outside the European Economic Area (EEA), primarily in the United States and Australia. When we transfer your data outside the EEA, we ensure appropriate safeguards are in place:

• Transfers to the USA: Our US-based providers (Google Cloud/Firebase, Stripe, OpenAI, Cloudflare, Slack) participate in the EU–U.S. Data Privacy Framework or have implemented Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to Australia: Leonardo.ai processes approved cover illustrations under appropriate contractual safeguards, including Standard Contractual Clauses where required
• Processing within the EU: Sentry (Germany) and Langfuse (EU) process their limited data inside the EEA
• We regularly review our providers' compliance with data protection requirements

By using our services, you acknowledge that your data may be processed in these countries. You can request information about the specific safeguards in place by contacting us.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• SSL/TLS encryption for all data in transit
• Encryption at rest for stored data
• Private, access-controlled storage on a need-to-know basis
• Regular security reviews of our systems and providers

While we take reasonable precautions, no system is completely secure. We cannot guarantee absolute security of your data during transmission or storage.

10. Data Retention

We keep your personal data for as long as it is needed to provide the service and to meet our legal obligations. In practice:

• Order and transaction records: Kept for approximately 7 years, as required by Dutch tax law
• Uploaded photos, story data, and generated book files: Kept so we can fulfill, reprint, and support your order, and so you can reuse characters in future books; deleted when you ask us to (see Section 11)
• Customer support communications: Kept for as long as needed to handle your request and any follow-up
• Email marketing contacts: Kept in Brevo until you withdraw your consent or ask us to remove your email address; the checkout consent record follows the order retention period
• Analytics and diagnostics data: Held by Google Analytics and Sentry under their own retention periods (Google Analytics event data is retained for up to 14 months)

You can ask us to delete your personal data at any time, and we will do so except where we are legally required to keep certain records (such as tax-relevant order data). Deleted data may remain in our backups for up to 90 days, until those backups expire. We use backups only to recover from technical failures and re-apply your deletion after any restore. See Section 11 for how to make a request.

11. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten"), subject to legal retention requirements
• Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at hi@talesofus.ai. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

12. Cookies and Tracking

We use minimal cookies and tracking technologies:

• Essential cookies: Required for the website to function (e.g., language preference and abuse-prevention tokens)
• Consent choices: First-party cookies separately remember your analytics and diagnostics choices for about 6 months
• Analytics: Google Analytics is loaded only after you accept. It measures pages, product interactions, referrals, approximate geography, and checkout events so we can improve the service
• Diagnostics: Sentry is loaded only after you separately accept diagnostics
• reCAPTCHA: Google reCAPTCHA may set cookies to distinguish humans from bots

We use cookies only for the purposes above, not for advertising or ad personalization. You can reject both optional purposes, accept analytics only, or accept both in the first-visit banner. The “Manage cookies” link in the website footer lets you decide again.

13. Children's Privacy

Our service is designed to create children's storybooks, but the service itself is intended for use by adults aged 18 or older (parents, guardians, gift-givers). We do not knowingly collect personal data from anyone under 18. If you are under 18, please ask a parent or guardian to use our service on your behalf.

Photos of children: If you upload a photo of a child to create a personalized story, you represent that you are the parent or legal guardian of that child, or that you have obtained consent from the parent or guardian.

14. Legal Disclosure

We may disclose your personal data if required by law or in the good-faith belief that such action is necessary to:

• Comply with legal obligations, court orders, or valid legal process
• Protect and defend our rights or property
• Prevent fraud or investigate potential violations of our terms
• Protect the safety of our users or the public

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, services, or legal requirements. When we do, we will update the "Last updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

• Email: hi@talesofus.ai
• Address: talesofus.ai, Elzenhagensingel 1051, 1022 LA Amsterdam, Netherlands

We aim to respond to all inquiries within 30 days.