Privacy Policy

Who we are

Once Upon You is operated from Hong Kong by an individual maker (currently a one-person studio). For all data-related questions, contact: kevin.larretche@gmail.com.

What we collect

• Order details: your email, name, shipping address, and phone number (collected at the Stripe checkout page).
• Book content: the hero’s name, age, interests, personality, physical description, the chosen setting, and any dedication, provided through our chat with Bookie.
• Reference photos: any images you choose to upload to help the illustrator. Uploading photos is entirely optional; we’ll happily work from a written description instead.
• Payment data: handled entirely by Stripe. We never see or store your card number.

How we use it

• To generate your personalised book using AI (Google Gemini for story and illustrations).
• To fulfil your order, printing the book and shipping it to the address you provided.
• To send you order updates by email.
• To respond to your questions or refund requests.

We do not use your data for advertising. We do not sell or share it with marketers.

Photos: how we handle them

• No AI training: we do not use your photos to train any AI model, ours or anyone else’s.
• Deleted within 30 days: reference photos are removed from our storage within 30 days of order delivery.
• Sent to Google Gemini for illustration only: photos are passed to Google’s Gemini API so the model can illustrate the book. Under the paid Gemini API terms, Google does not retain your prompts or images to train its models. If those terms ever change, we’ll update this policy and tell affected customers.
• No marketing reuse: we will never use your photos (or the resulting illustrations) in marketing without your explicit written permission.

Who processes your data on our behalf

• Stripe: payment processing. Your name, email, address, and phone number flow through Stripe.
• Google (Gemini API): AI generation. The book content and reference photos are processed by Google’s Gemini service under Google’s API terms.
• Supabase: database and storage hosting. Order data and photos are stored in the Asia-Pacific region.
• Vercel: website hosting and basic request logging.
• Print and shipping partners: receive your shipping address and the final PDF only.

How long we keep it

• Active orders: until the book is delivered, then for 1 year as a support / warranty record.
• Reference photos: deleted within 30 days of order completion.
• After 1 year: order metadata is retained in anonymised form for accounting; identifiable data and photos are removed.

Your rights under the Hong Kong PDPO

You have the right to:

• Access the personal data we hold about you.
• Correct anything that’s wrong or out of date.
• Delete your data (subject to legal obligations to keep transaction records).
• Withdraw consent for future use of your data.

To exercise any of these, email kevin.larretche@gmail.com. We’ll respond within 14 days.

Cookies

We use essential cookies only, for keeping your chat session alive and for Stripe Checkout. We do not use advertising or tracking cookies.

Data security

All data is encrypted in transit (HTTPS) and at rest. Access to your data is limited to the operator of this service. Database keys are stored in encrypted environment variables, not on any shared machine.

About children

Books are for children, but they’re not sold to children. The customer must be an adult (18+ in Hong Kong). The child’s name, age, and physical description are provided by the adult customer; the child does not interact with our service directly.

If you’re buying a book where the hero is an adult (partner, parent, friend, yourself), the same rules apply — you must be 18+ in Hong Kong to make a purchase.

Changes to this policy

We may update this policy from time to time. Significant changes will be emailed to recent customers. The “Last updated” date at the top will always reflect the current version.

Contact

For anything privacy-related, email kevin.larretche@gmail.com.