Privacy notice

Last updated: [date of publication]

This notice explains what we collect, why, who we share it with, how long we keep it and how to delete it. It covers the UK GDPR, the EU GDPR and the US state laws in section 13.

You make our books with photos and details of a child. We take that seriously. In short:

• We only use your photos to make your book.
• We delete your photos 7 days after we approve your book.
• We never use photos to recognise faces, and we never let anyone train AI tools on them.
• We never use your child, or your book, in our marketing.
• You can delete your data at any time from your account.

1. Who we are

The controller of your data is [Seller legal name], trading as Under One Arm.

• Address: [address]
• Email for privacy questions: [privacy email]
• ICO registration number: [ICO data protection fee registration number]

Our representative in the EU

We're based in the UK. Our representative in the EU is [EU representative name, address and email] (GDPR Article 27). You can contact them about anything in this notice.

2. What we collect

When you make a book

• About your child: their first name, their age, the pronouns you choose and, if you add them, their interests.
• About their toy: its name, the kind of toy and a short written description of it, which we make from the toy's photo.
• Photos: a photo of your child and a photo of their toy.
• Family members, if you add them: each person's name, role (for example "Grandma"), and a photo or a short description of how they look.
• Your choices: the story, the setting, the outfit and the other options you pick, and any notes you add when you change a page.
• The book we make: the story text, the drawings of your characters and the pages.
• Your permission: a record that you ticked the photo permission box and confirmed you're 18 or over, with the date and the wording you saw.
• Always draw (health information): if you ask us to always draw something about your child, such as a health aid, that choice is health information. We keep a record that you ticked the box agreeing to it, with the date and the wording you saw.

When something is wrong with your book

• The kind of problem you pick (damaged, a printing fault, the wrong book, or not arrived).
• Your note, if you add one (up to 1,000 characters), and up to three photos of the book. We remove location and camera details from the photos before we keep them.
• Your email address, to confirm we've received your report.

When you sign in or order

• Your email address, to sign you in and send you your order.
• Your order: what you bought, the price, the date and the record that you read the cancellation notice.
• Your delivery name and address, for a hardcover.
• Payment: Stripe takes your payment on its own secure page. We never see or store your card details. We get a payment reference and the amount.

When you buy a gift code

• Your email address and your order.
• If you add them: the name of the person it's for, your name, and your message. These go on the printable card.

When you use our site

• Cookies that keep you signed in and keep the site safe. See our cookie notice.
• Security data. We use your IP address and a random device code to stop misuse, such as people guessing gift codes. We scramble both before we store them. We never store your IP address as it is.
• Error reports. When something breaks, our error reporting tool records what went wrong. We remove names, emails, photos and messages from these reports first.
• Simple counts. We count how many visits, previews and orders we get. These counts have no cookies and no personal data in them.

When you join the waitlist or write to us

• Your email address, and the date you confirmed you want to hear from us.
• What you write to us, and our reply.

When you suggest something we should add

• What you suggest, what it's about, and whether you'd buy a book if we added it.
• Your email address, only if you ask us to tell you when we add it (then as for the waitlist).
• We ask you to leave out your child's name and any health details. Only we read suggestions; they are never published.

When you review a book

• Your first name, your star rating and any comment you write. We publish these with your first name, and only with your permission.
• Your relationship to the child, and their age band, if you choose to tell us.
• A private note, if you write "what should we improve?". We never publish it.
• Two choices: whether we may quote your review, with your first name, in our adverts, emails and posts. This is optional.
• Your email address, which we use to send you the request and one reminder.

We never publish a child's name. If one appears in a review, we take it out.

3. Why we use it, and our lawful basis

We never sell your data. We don't use it for advertising. We don't make profiles of you or your child.

Automatic checks

Our safety checks are automatic. They can refuse a photo, a name or a message. A refusal only stops that step: you can try another photo or other words. If you think a check got it wrong, write to us and a person will look.

4. Your child's data

• We only collect it from you, the adult. Children can't have an account, and our site and marketing are for adults.
• We ask your permission first. You can't add a photo until you've ticked the box: "I'm this child's parent or guardian (or have their permission), and I'm 18 or over. I agree my photos can be used to make this book and printed." Each family member's photo needs its own tick.
• We collect as little as we can. A first name, an age and the photos. We don't need a surname, a birthday or a school.
• We remove hidden details from photos. When you upload a photo, we make a fresh copy and remove the location and camera details stored inside it.
• We never recognise faces. We don't measure faces or make face templates. We don't try to identify anyone. So we don't treat photos as biometric data.
• We never use your child in marketing. No customer's child appears in our ads, reviews or social media posts. Our sample books use made-up children.
• No public links. A person checks your book before it is printed, and the printer gets the print files (section 5).
• Family members' photos, including a brother or sister, are treated in the same way as your child's photo.
• Health information. An always-draw choice, such as a health aid, is health information. We draw it only because you asked, we ask for your explicit consent with a tick, and we delete it with the book's photos (section 6).

5. How photos are used to make your book

1. Checking. A safety service (OpenAI's moderation tool) checks each photo and each piece of text you type.
2. Describing the toy. An AI service (Google Gemini) looks at the toy photo and writes a short description of it.
3. Drawing your characters. An AI service (Google Gemini) uses your child's photo, the toy photo and any family photos to draw your characters once. After you approve the drawings, your child's photo and the family photos are never sent to an AI service again. Only the toy photo is used after that, so the toy looks right in every picture.
4. Writing the story. An AI service (Anthropic Claude) writes the story from our template, using your child's first name, age, pronouns, interests and the toy's name. A second AI service (OpenAI) checks the writing. We don't send photos to the writing services.
5. Making the pictures. The same AI service (Google Gemini) draws every page from your approved characters and the toy photo; a book is never drawn by two different services. Each picture is checked for safety by OpenAI's moderation tool, and against the toy description by Google Gemini.
6. A person checks the book before it is printed or sent. That person may see the pages and, if needed, the drawings of your characters.

Every AI service we use is under a contract that stops it training on your data. They keep data only for a short time, or not at all: [retention for each service, from spike S5].

6. How long we keep it

Backups

Our database is backed up so we can recover it if something breaks. When we delete something, it may stay in a backup for up to [7] days [confirm against the Supabase plan] before the backup is replaced. We never restore deleted data from a backup except to recover from a fault, and then we delete it again.

7. Who we share it with

We use these companies to run our service. Each one acts on our instructions, under a data processing agreement. None of them may use your data for their own purposes.

Stripe also uses some payment data for its own legal duties, such as fraud checks and money-laundering rules. For that, it is a controller in its own right, and its own privacy notice applies.

Carriers deliver hardcovers for our printer. They receive your delivery address.

Authorities. We share data when the law requires it. This includes reporting suspected child abuse material to [NCMEC, and the UK body counsel names].

8. Sending data outside the UK

Some of the companies above are in the United States or store data there. [Name the hosting regions for Supabase and Vercel once chosen.]

When data leaves the UK or the EU, we protect it with one of these:

• a country the UK or the EU has found to protect data properly;
• the UK Extension to the EU-US Data Privacy Framework, for a US company that has signed up to it;
• the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses.

[Record which one applies to each company once the agreements are signed (SEC-13).] You can ask us for a copy.

9. Gifts: for the buyer and the family

If you buy a gift code, we keep your email, the order and anything you put on the card. Your account shows whether the code has been used and how many books are left. You don't see the child's name, photos or book.

If someone gave you a code, we don't show them your child's name, photos or book. Before you use the code, we don't show you the buyer's name, email or message, except what they put on the card. When you use the code, you become our customer for that book, and this whole notice applies to you.

10. Your rights

You have the right to:

• see the data we hold about you, and get a copy;
• correct data that's wrong;
• delete your data;
• limit how we use it;
• object to us using it for our legitimate interests;
• move it to another service, in a common file format;
• withdraw your consent at any time, where we rely on it. This doesn't affect what we did before.

How to delete your data

Go to your account and choose "Delete my data". We show you what will be removed and what can't be recalled. Then we email you a link to confirm.

When you confirm, we delete your books, photos, pages, previews, PDFs and gift cards, the notes and photos of any problem reports, your email address and your account. We remove your name, email and address from orders and gift codes. We unlink your account from the email send log. We keep your email address on our suppression list, with no end date, so that we never email you again: it is the one record we keep after you delete your data. We usually finish within 24 hours, and always within 30 days. We email you when it's done.

Some things can't be undone:

• a hardcover that's already being printed;
• order records we must keep for tax, with your personal details removed;
• permission records, kept as evidence but no longer linked to you;
• copies our payment providers keep under their own legal duties;
• copies in backups, until the backup is replaced (section 6).

How to use your other rights

Email [privacy email]. We may ask you to sign in, or reply from the email address on your account, so we know it's you. We'll reply within 1 month. If your request is complex, we may need up to 2 more months, and we'll tell you why.

It's free, unless a request is clearly unfounded or excessive.

11. Keeping your data safe

• All our storage is private. Links to your files stop working after a short time: 10 minutes for a download. The colouring book link in your email works for a year, so you can print it again.
• We never put photos, names or messages in our logs or error reports.
• Admin access needs a second sign-in step.
• If a breach puts your data at risk, we'll tell the ICO within 72 hours, and tell you without delay where the law requires it.

12. Cookies

We only use cookies that our site needs to work. See our cookie notice.

13. If you live in the United States

Illinois and Texas

Illinois and Texas have strict laws about face data. We don't collect face data: we never measure faces or make face templates, and we use a photo only to make the book. We also refuse photo uploads from Illinois and Texas. When you upload a photo, we work out where your internet connection is, and we refuse the upload if it shows Illinois or Texas, or if we can't tell where it is. That check can be wrong, for example when someone uses a VPN, so please don't upload a photo of a child who lives in either state.

You can still buy a gift code. The person who uses it can't add photos from Illinois or Texas, so they can't make the book from there.

Your rights under US state laws

Several US states give you rights over your data. Wherever you live in the US, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct it;
• delete it.

We don't sell your data. We don't share it for targeted advertising. We don't use it for profiling. So there's nothing to opt out of.

We treat your child's data as sensitive data. We only use it to make the book you asked for, with your permission.

To use your rights, email [privacy email]. If we say no, you can appeal by replying with "Appeal" in the subject. We'll answer within [45] days. If you're unhappy with our answer, you can contact your state's attorney general.

We won't treat you differently for using your rights.

Children's privacy (COPPA)

Our site is for adults. We don't knowingly collect data from children under 13. A child's details and photos come only from their parent or guardian, or someone with their permission.

14. Changes to this notice

If we change this notice, we'll update the date at the top. If a change affects how we use data you've already given us, we'll email you first.

15. Questions and complaints

Please write to us first at [privacy email]. We'd like the chance to put things right.

You can also complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk, or call 0303 123 1113.

If you live in the EU, you can complain to the data protection authority in your country.