Privacy & Cookie Policy
This policy explains what we do with your information and your child’s — what we collect, why, who else sees it, how long we keep it, and the choices you have. It is written to be read, not skimmed past. If anything here is unclear, ask us and we will explain it in plain terms.
Last updated: 12 September 2026
1. Who we are
StoryBook Creator is a service for making personalised children’s books. When you use it, we decide how and why your information is handled, which makes us the “data controller” under the UK GDPR and the Data Protection Act 2018.
- Website: aistorybook.co.uk
- Privacy contact: support@aistorybook.co.uk
Write to that address for anything in this policy: a copy of your data, a correction, a deletion, or a question about how something works. We answer within one month, and we will tell you if we need longer.
2. What we collect
Information you give us
- Account details — your name, your email address, and a password. Passwords are stored only as a one-way hash, never as text we could read. If you sign in with Google we receive your name, email address and Google account id instead of a password.
- Child profiles — the name you give, and optionally an age, a gender and a photograph. This is the most sensitive information in the service and section 3 is about it specifically.
- What you create — story text, themes, dedications, the pictures you upload, drawings your child made, and the finished books, illustrations and videos generated from them.
- Payment details — your billing name and address, and the brand, last four digits and expiry of your card. We never see or store the full card number; that goes directly to our payment provider.
- Messages — anything you write to us, including print requests, which can be sent by someone who has only been given a link to a book and has no account.
Information we collect automatically
- Usage and analytics — which pages are opened and roughly where in the world from, via Google Analytics. You can turn this off; see section 5.
- Service records — a record of what you generated and what it cost, so we can bill accurately and look into it if something goes wrong.
- Security records — enough to detect misuse and investigate it, including the network address a password reset or email verification was requested from.
We do not buy personal information from anyone else, and we do not build profiles of you for advertising. Advertising signals are switched off in our analytics permanently, not as a setting you have to find.
3. Children’s information
The whole point of the service is a book with a real child in it, so we hold real children’s information: a name, sometimes an age and gender, and often a photograph. We treat that as the most sensitive thing we look after.
Accounts belong to adults
An account must be held by a parent or legal guardian aged 18 or over. By adding a child profile you confirm that you hold parental responsibility for that child, or have the permission of someone who does. Children do not hold accounts with us and we do not knowingly collect information directly from a child.
What happens to a child’s photograph
- It is used to work out what the character should look like, and to keep that character consistent from page to page.
- It is sent to the AI provider we use, for exactly that purpose, and for an automated safety check before it is accepted.
- It is never used to train any model of ours, never sold, never shared for marketing, and never shown to other users unless you choose to publish or share that book yourself.
- You can remove a child profile or a photograph at any time from your dashboard, and you can ask us to delete everything connected to that child.
Sharing a book shares what is in it
A share link is deliberately hard to guess, but it is not password-protected: anyone you send it to can open the book, and so can anyone they forward it to. Uploaded and generated pictures are served from links of the same kind. Treat a share link like the book itself — only send it to people you are happy to show it to, and ask us to revoke it when you no longer want it to work.
4. Why we use it, and our lawful basis
UK data protection law requires a specific reason for every use. Ours are:
| What we do | Why | Lawful basis |
|---|---|---|
| Create your account and keep you signed in | You asked for the service | Performance of a contract |
| Generate books, illustrations, drawings and videos | It is what you bought | Performance of a contract |
| Process a child’s name, age, gender and photograph | To put your child in the story | Your consent, as the parent or guardian |
| Read a story aloud | You pressed play | Performance of a contract |
| Take payment and issue receipts | To complete your purchase | Performance of a contract, and legal obligation for tax records |
| Send account email — verification, password resets, receipts | To run the account securely | Performance of a contract |
| Screen uploaded pictures automatically | To keep unlawful and harmful images off the service | Legitimate interests — child safety and platform safety |
| Keep security and administrative audit records | To detect abuse and investigate incidents | Legitimate interests — securing the service |
| Measure how the site is used | To see which pages work | Your consent |
Where we rely on consent — a child’s data, and analytics — you can withdraw it at any time, and withdrawing it is as easy as giving it was. Withdrawing consent does not undo anything done beforehand, and it does not affect the parts of the service that run on a different basis, such as keeping you signed in.
7. How long we keep it
We keep information for as long as we need it, and no longer — except where the law says we must keep something for a set period.
| What | How long |
|---|---|
| Your account, child profiles and books | Until you delete them, or until you ask us to close your account |
| Pictures and videos belonging to a book or a child profile | Deleted from our servers when you delete the book or the profile |
| Payment, invoice and transaction records | At least six years, because UK tax law requires it |
| Security records | Kept as a security record, and edited down rather than deleted |
| Password reset and verification links | Minutes and hours respectively, then they stop working |
When you close your account we remove your profile and your content. We keep the financial and security records described above, because we are required to — those are separated from your profile and are not used to contact you or to rebuild it.
8. How we protect it
- Everything travels over an encrypted connection.
- Passwords are stored in a form that cannot be read back — not by us, and not by anyone who obtained a copy of our database.
- Full card numbers never reach our servers; they go straight to our payment provider.
- Uploaded pictures are automatically screened before they are accepted.
- Access to accounts by our staff is restricted and recorded.
No system is perfectly secure, and we will not claim otherwise. If a breach happens that is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you directly where the law requires it.
Please remember the point made in section 3: links to books and pictures are unguessable but not password-protected, so anyone holding a link can open what it points to.
9. Your rights
Under UK data protection law you have the following rights, over your own information and over your child’s. Exercising them is free, and we will not treat you differently for it.
- Be told what we hold and get a copy of it.
- Have anything inaccurate corrected.
- Have your information deleted, where we have no overriding reason to keep it.
- Restrict what we do with it while a dispute is sorted out.
- Receive what you gave us in a portable format, or have it sent to another provider.
- Object to processing we base on legitimate interests.
- Withdraw consent at any time — for analytics, using the button below, and for a child’s data by removing the profile or contacting us.
- Not be subject to a decision made purely by automated means with a legal or similarly significant effect. We make no such decisions: the AI writes and illustrates books, it does not decide anything about you.
To exercise any of these, email support@aistorybook.co.uk. We may ask you to confirm who you are, so that we do not hand somebody else your child’s information.
10. Complaints, and changes to this policy
If you are unhappy with how we have handled your information, tell us first — we would rather fix it. You also have the right to complain to the UK’s data protection regulator at any time.
- Information Commissioner’s Office (ICO)
- ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We update this policy when the service changes. The date at the top is the version you are reading. If a change materially affects how we use your information, or your child’s, we will tell you before it takes effect rather than quietly republishing.