Privacy Policy
Last updated: November 1, 2026
Stories for Grandkids (“we”, “us”) is operated by [LEGAL ENTITY NAME], [ADDRESS]. We make personalized picture books and read-aloud videos that grandparents give to their grandchildren. This policy explains what we collect, why, how long we keep it, and your choices.
The short version
- We use a child’s photo only to draw them as the hero of their book.
- We delete the original photo as soon as the illustrated face is approved, and never later than 30 days after delivery.
- We never use photos, children’s information or voices to train AI, and our providers are contractually barred from doing so.
- We never sell personal information, and we don’t run advertising pixels on the upload, preview, recording or book pages.
- No accounts. You get private links by email instead.
What we collect
- About you (the buyer): your email, name, billing and (for the hardcover) shipping address, what your grandchild calls you, and your 18+ confirmation. Payments are handled by Stripe; we never see your card number.
- Your saved card (one-click offer): at checkout, Stripe keeps your card on file so the page after checkout can offer another grandchild’s book in one click without re-entering it. We store only Stripe’s reference to the card, its brand and last 4 digits, and the billing address Stripe gives us (for sales tax). We charge it only when you click to buy; the one-click offer ends when you leave that page. To have the saved card removed, email hello@storiesforgrandkids.com and we’ll delete it from Stripe.
- About the child: first name, age range (2–4 or 5–9), the US state they live in, optionally one thing they love, and one photo.
- About the child’s parent (when needed): their email address, so they can approve the book and add the photo themselves.
- What we make: the illustrated portrait, the book pages, the video, and print files.
- Your voice: if you choose to read the story yourself, your recordings.
- Consent records: who agreed to what, their relationship to the child, the exact wording shown, the time and the IP address. We keep these as proof of consent.
- Technical data: standard server logs (IP address, browser type) kept for security. We don’t use analytics or advertising cookies on order, upload, preview, recording or book pages. The book page sets no cookies at all.
We never collect anything from children directly. We never record or accept a child’s voice.
How we use it
- To make, deliver, print and ship your order, and to send you emails about it.
- To get a parent’s consent (and the photo) directly from the parent where the law requires it, and to keep proof of consent.
- To provide support, re-dos and refunds, prevent fraud and misuse, and meet legal obligations (tax, accounting, safety reporting).
We don’t use your information for marketing unless you separately opt in, and we never use a child’s likeness in marketing without a separate, revocable written release signed by the parent.
Face data & biometric privacy
To draw a child so that family recognize them, an AI model analyzes the child’s face in the photo (shape, features, skin tone, hair). Some state laws (including Illinois BIPA, Texas CUBI, Washington’s My Health My Data Act and Colorado’s biometric rules) may treat this as biometric data. Whether or not they apply, we follow these rules:
- Purpose: only to draw that child as the hero of the book that was ordered. Never to identify anyone, never for facial recognition, never to build a database of faces.
- Consent first: the person uploading confirms the parent or guardian agrees. For children who live in Illinois, Texas or Washington, we accept a photo only from the child’s parent or legal guardian, through their own approval link, after they read this notice and agree. Nobody else can upload a photo of those children, and we receive nothing until the parent does.
- No sale, no profit, no sharing of face data, except with the AI providers who draw the book, under contracts that forbid training and require deletion.
- Destruction: any face data (the photo, crops, or intermediate files) is destroyed when its purpose is done: as soon as the illustrated face is approved, and in every case within 30 days after delivery, or sooner on request. We never keep face templates or embeddings.
- Security: photos are stored in a private, encrypted bucket and accessed only through short-lived signed links.
Retention schedule
| What | How long |
|---|---|
| Original photo | Deleted as soon as the illustrated face is approved. Unpaid drafts: deleted after 7 days. Hard limit: 30 days after delivery. A daily job and storage rules enforce this. |
| Face crops, embeddings, intermediate files | Never stored beyond the generation job. |
| Illustrated portrait and book pages | 12 months after delivery so you can re-download or reprint, then deleted. You can ask us to delete them any time. |
| Read-aloud video (if ordered) | Kept for as long as its listen link is active, because the link is printed in the hardcover as a scan-to-listen code. The listen page shows only first names and the book title, and isn’t indexed by search engines. Ask us and we’ll delete the video and switch the link off. |
| Your raw voice recordings | Up to 90 days (until the video is made and approved). Your voice remains in the finished video, kept with the book. |
| Hardcover print files | Up to 90 days after shipping, for reprints. |
| Consent records | 3 years after the last order, as proof of consent. They contain no images. |
| Order and payment records | 7 years, for tax and accounting. |
| Backups | Purged within 35 days. |
AI and your content
Illustrations and narration are AI-generated, stylized interpretations. We don’t train AI models on your photos, your child’s information or your voice, and our providers are contractually barred from doing so. We don’t clone voices: if you record the story, we use your actual recording.
Who we share it with
Only the service providers that help make and deliver your order, listed on Who helps us make your book: OpenAI and Google (illustration), MiniMax (motion for illustrated pages only), ElevenLabs (storyteller narration, adult voices only), Stripe (payments), Cloudflare (database and storage), Vercel (hosting), Resend (email), and our print partner (RPI Print, or Lulu as backup). We may also disclose information if required by law, or to report child sexual abuse material to NCMEC and law enforcement. We don’t sell or “share” personal information for advertising.
Children’s privacy
This site is for adults. We don’t knowingly collect personal information from children, and the book page collects nothing from whoever is watching: no logins, no comments, no voice or text input, no third-party scripts or pixels. A child’s parent or legal guardian can ask us to delete their child’s information at any time, even if they weren’t the buyer: email hello@storiesforgrandkids.com.
Your rights
Depending on where you live, you may have the right to know what we hold about you, get a copy, correct it, delete it, withdraw consent, and opt out of sale or targeted advertising (we don’t do either). Email hello@storiesforgrandkids.com. We’ll verify the request and respond within 45 days. You can appeal a decision by replying to our response. Washington residents: see our Consumer Health Data Privacy Policy.
Security
Data is encrypted in transit and at rest; photos and books live in private storage reachable only through short-lived signed links; private links in our emails are unguessable and can be revoked. If a breach affects your information, we’ll notify you and the authorities as the law requires.
Changes
If we change this policy in a meaningful way, we’ll update the date above and, for open orders, email you.
Contact
[LEGAL ENTITY NAME], [ADDRESS] · hello@storiesforgrandkids.com