Privacy Policy

Once Upon Your Story is a trading name of Once Upon Your Story Company Limited, a company registered in Hong Kong (Business Registration No. 77750612-000-02-25-1). Registered office: 19E, Tower 5, The Lustre, Chianti, Discovery Bay, Lantau, NT, Hong Kong SAR.

We are the data controller for the personal information described in this policy. If you have any question about how we use your information, email support@onceuponyourstorybooks.com and a person will reply.

• We use photos uploaded to create a book or card only to make and deliver that product.
• We delete those product-creation photos automatically within 24 hours of upload.
• We never use your photos to train AI models, and our providers are contractually barred from doing so.
• Review photos may appear in review features across our website with your publication permission. We only reuse them in other marketing, including social media, if you separately opt in.
• We do not sell your personal information to anyone.
• Analytics cookies are off until you say yes.

Information you give us

• Your name and email address
• Photos you upload to be turned into artwork
• Reviews and any review photos you choose to submit
• Your choices about publishing a review photo and using review content in marketing
• The hero's first name, age and details you type into the story form
• Dedications and personal messages you write
• Delivery name and address, and the recipient's if different
• Your account password, stored in a hashed form we cannot read

Information we create

• The AI-generated illustrations made from your photo
• The personalised story text
• Your order history and delivery status

Information collected automatically

• Your IP address and approximate country, used to show the right currency and delivery options
• Device and browser information
• How you move through the site, but only if you accept analytics cookies

We do not collect payment card details. Your card goes directly to Stripe, our payment processor, and we never see or store the number.

Under UK and EU data protection law we have to have a lawful basis for using your information. Ours are:

• To perform our contract with you. Making your book or card, taking payment, delivering it and handling support.
• Our legitimate interests. Creating artwork from a photo of someone other than you, at your request and on your instruction, keeping the site secure, and preventing fraud and abuse. We have weighed these against the rights of the people involved, which is why we limit the use of photos so tightly and delete them quickly.
• Your consent. Analytics cookies, marketing emails, and optional use of a review and any attached photos in our marketing. You can withdraw consent at any time by contacting us.
• Legal obligation. Keeping order and tax records for the period the law requires.

Many of our books are gifts for children, so the photo you upload often shows a child. We treat those photos with particular care.

• When you upload, we ask you to confirm that you are the child's parent or guardian, or that you have their parent's or guardian's permission. We record that confirmation.
• We use a photo uploaded to create a product only to create and deliver the artwork you ordered.
• We never use that product-creation photo for marketing or publish it.
• Separately, you may choose to submit a photo with a review. We display a review photo in review features across our website only if you confirm that you have the right to share it, including any image of a child. We reuse a review or review photo in other marketing, including social media, only if you give separate, optional marketing consent.
• Marketing consent is never required to buy from us or publish a review. You can withdraw it at any time by contacting us; we will stop future use and remove the content from channels we control.
• We never allow it to be used to train AI models.
• We delete the original product-creation photo automatically within 24 hours of upload. The artwork made from it follows the separate periods in the table above, and review photos follow their own.

Our website is intended for adults buying gifts. We do not knowingly collect personal information directly from children, and we do not offer accounts to under 18s. If you believe a child has given us their information, or you are a parent or guardian who wants a child's image removed, email support@onceuponyourstorybooks.com and we will delete it promptly. You do not need an account to ask.

To create your artwork and story we send your uploaded photo and the details you provide to specialist AI providers: Replicate, OpenAI and Anthropic. They process it on our instructions to produce your illustrations and story text.

• Your photos are not used to train their models.
• Generation is automated, but it does not make any decision that has a legal or similarly significant effect on you. A person can review any result if you ask.
• AI artwork is a creative interpretation of your photo, not a photographic reproduction, and every generation differs slightly. You always see a full preview before you order.
• We run automated checks to block unlawful or inappropriate uploads. If something is flagged, a person reviews it before we refuse an order.

We do not sell your personal information. We share it only with service providers who help us run the business, and only as much as they need. They act on our instructions under a written contract.

We may also share information where the law requires it, or to establish or defend legal claims.

We are based in Hong Kong and several of our providers are in the United States, so your information is transferred outside the UK, the EEA and Australia.

Where we transfer personal information out of the UK or the EEA we rely on the UK International Data Transfer Agreement, or the European Standard Contractual Clauses together with the UK Addendum, and we assess whether extra safeguards are needed. For Australian customers, we take reasonable steps under Australian Privacy Principle 8 to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.

We delete things on a schedule, and the deletions run automatically rather than depending on somebody remembering.

Depending on where you live, you have the right to:

• Ask for a copy of the personal information we hold about you
• Have inaccurate information corrected
• Ask us to delete your information
• Object to, or ask us to restrict, how we use it
• Ask us to transfer it to another provider
• Withdraw consent, where we relied on consent
• Complain to your data protection regulator

Email support@onceuponyourstorybooks.com and we will respond within 30 days. There is no charge.

If you are unhappy with how we have handled your information you can complain to the regulator where you live: the Information Commissioner's Office in the UK (ico.org.uk), the Office of the Privacy Commissioner for Personal Data in Hong Kong (pcpd.org.hk), the Office of the Australian Information Commissioner (oaic.gov.au), or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

We only send marketing emails if you have opted in, and every one has an unsubscribe link that works immediately. We will always send you transactional messages about an order you have placed, such as confirmations and delivery updates, because you need those.

If you submit a review, your separate publication permission lets us display it and any attached photos in review features across our website. You can then separately choose whether we may reuse that content in other marketing, including on social media such as Instagram and TikTok. The marketing option is unchecked by default and is not required to publish your review on our website. You can withdraw that permission at any time by emailing us. We will stop future marketing use and remove the content from channels we control.

• Encrypted in transit and at rest
• Access limited to the people who need it, protected by two-factor authentication
• Payment card details never touch our systems
• Automatic deletion so we do not hold data we no longer need

No system is perfectly secure, but if a breach affects your rights we will tell you and the relevant regulator as the law requires.

We use essential cookies to make the site work, and analytics cookies only if you accept them. Full detail and controls are on our cookie policy page.

If we make a material change we will update the date at the top of this page and, where the change significantly affects you, tell you by email.