the honest version, in full
Privacy policy
Last updated: 26 August 2026 · This is the EN-GB edition, published on fablebook.co.uk.
This policy is written to be read, not survived. Where the law needs a precise phrase we use it, and then say the same thing again in ordinary words. Because the service turns on photographs of children, we have written it to a stricter standard than the legal minimum, and every commitment in it is one we have built into the software rather than merely promised.
Who we are: Fablebook, e-mail support@fablebook.nl ("Fablebook", "we"). We are the data controller for the processing described here.
This policy is written for the UK GDPR and the EU GDPR. The Dutch edition on fablebook.nl says the same thing in Dutch.
On this page
- What Fablebook does with personal data — the short version
- What we collect
- Children’s data — our specific commitments
- Purposes and legal bases
- Who receives data
- What we never do
- Automated checks, and why they are not decisions about you
- Retention — the automatic deletion schedule
- International transfers
- Your rights
- Security
- Cookies
- Changes to this policy
What Fablebook does with personal data — the short version
You upload photos of your family and answer questions about your child. We use this to create one personalised picture book, using artificial-intelligence image tools operated under our instructions. You see a proof, and only what you approve gets printed. We keep the photos only as long as needed to make and deliver your book, then delete them automatically. We never use your family’s photos to train AI models, never sell them, and never show them to other customers.
What we collect
You provide: account and contact details (name, e-mail, delivery address, phone optional); order details; the questionnaire answers (names, ages, relationships, story preferences, dedication text); and the photos you upload, which typically show your child, other family members, pets and your home.
Generated by us: the illustrated book pages created from your photos; internal quality-control notes.
Automatically: order and payment metadata (payment itself is processed by Stripe — we never see card numbers); basic technical data (IP-derived country for showing you the right site, device and browser type, essential cookies). We do not use advertising trackers on the order flow. [To be adjusted if analytics or marketing tools are added — a cookie consent banner is required for anything non-essential.]
Children’s data — our specific commitments
- The Fablebook service is offered to and used by adults (parents and guardians). Children do not create accounts or interact with our service.
- We only process a child’s photos on the basis of consent given by that child’s parent or guardian. During upload you confirm that you are the parent or guardian of each pictured child, or have their parent or guardian’s explicit permission, and that every pictured adult has agreed. We log this consent.
- We apply data minimisation: upload only the photos we ask for. We do not extract, store or analyse biometric identifiers or face templates — photos are used solely to draw the illustrations for your book.
- We apply strict retention (section 6) and delete rather than archive.
- We do not use children’s data for marketing, profiling or automated decision-making, and we never train AI models on it.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating your personalised book from uploaded photos (including AI-assisted illustration and human quality control) | Consent (Art. 6(1)(a); for children’s images, parental consent). You may withdraw consent any time before printing — this cancels the order. |
| Order handling, proof approval, printing, delivery, service e-mails | Performance of a contract (Art. 6(1)(b)) |
| Payment, invoicing, tax records | Legal obligation (Art. 6(1)(c)) — financial records kept [7 years NL / 6 years UK] |
| Optional storage of your family’s book assets for future books or a subscription | Separate opt-in consent (Art. 6(1)(a)) — off by default |
| Service improvement using aggregated, non-identifiable data; fraud prevention; defence of legal claims | Legitimate interests (Art. 6(1)(f)) — never using identifiable children’s data |
| Marketing e-mails to you, the adult customer | Consent or soft opt-in under e-Privacy rules; every message has an unsubscribe link |
Who receives data
We share personal data only with processors bound by a data-processing agreement, and each receives only what it needs to do its job. This is the complete list.
- Google (Gemini API) — illustration. Receives the uploaded photographs and our drawing instructions. Under the paid API terms Google does not use these inputs to train its models. United States; see section 7.
- Peecho B.V., Amsterdam — printing and delivery. Receives the approved print file and your delivery address. Netherlands.
- Stripe Payments Europe, Ltd., Dublin — payment and fraud screening. Receives your e-mail address, delivery address and payment details. We never see your card number. Ireland, with onward transfer to the United States.
- Supabase — the database and the encrypted storage holding your photographs. European Union (Frankfurt).
- Vercel — hosting. Runs the website itself, so it processes the technical data in every request. Our server functions run in Frankfurt. United States company.
- Resend — transactional e-mail: the proof link, your order confirmation, the shipping notice. Receives your e-mail address and the contents of those messages, never a photograph or an illustration. European region (Ireland).
- Google and Meta — only if you choose to sign in with a Google or Facebook account. They confirm your identity to us; we ask them for nothing beyond your name and e-mail address. If you do not use those buttons, neither receives anything.
We never sell personal data, never share your photographs with other customers or advertisers, and never allow any of the above to use your family’s photographs to train an AI model.
What we never do
Most of a privacy policy describes what a company does. For a service built on photographs of children, what it refuses to do matters at least as much, so here it is in one place.
- We never use your family’s photographs to train AI models — not ours, and not anybody else’s. Our illustration provider’s paid terms forbid it on their side too.
- We never sell personal data, and we never share it for anyone else’s marketing.
- We never show your photographs or your book to another customer. Nothing you upload appears in an example, a gallery or an advertisement unless you have separately and explicitly agreed to it.
- We never build biometric templates. The photographs are used to draw from and nothing else; we do not extract or store face measurements that could identify your child elsewhere.
- We never market to children. Our customer is an adult, every message goes to that adult, and nothing in the service is designed to be used by a child.
- We never profile you, and no decision with a legal or similarly significant effect is taken about you by software alone — see the next section.
Automated checks, and why they are not decisions about you
Software checks every page we draw — whether the style matches, whether the text is readable, whether a sentence has landed over somebody’s face. Those are judgements about an illustration, not about a person, and a page that fails is redrawn or sent to one of us to look at.
There is no automated decision-making producing legal or similarly significant effects concerning you within the meaning of Article 22 GDPR. A person reviews every book before it is printed.
Retention — the automatic deletion schedule
- Uploaded photos and generated pages for completed orders: deleted 60 days after delivery (kept briefly for the reprint and defect guarantee), unless you opt into asset storage for future books.
- Uploaded photos for proofs that do not become orders: deleted 30 days after the proof.
- Subscription asset storage (opt-in): kept while your subscription is active; deleted within 30 days of cancellation.
- Order, invoice and consent records: kept as legally required seven years for Dutch orders, six for UK orders, without the photos.
- You can request earlier deletion at any time (section 8); backups purge on a fixed cycle the provider’s rolling backup window, and we never restore deleted personal data from a backup except where a restore is lawful and unavoidable.
International transfers
Your photographs, your book and your order data are stored in the European Union (Frankfurt) and are not moved out of it.
Three of the processors above are United States companies, so some data reaches the US: Google receives the photographs in order to draw from them, Stripe receives payment data, and Vercel receives the technical data in each request. Each transfer relies on the European Commission’s Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the recipient is certified under it. For UK orders the UK Addendum applies alongside. Copies of the safeguards are available on request.
Your rights
You have the right to access, rectify, erase, restrict, object, and to data portability, and to withdraw consent at any time (without affecting processing that was lawful before you withdrew it). Deleting your family’s data is also a one-click control in your account. We respond within one month. Contact: privacy@fablebook.co.uk.
Complaints: you may complain to the Information Commissioner’s Office (ico.org.uk) in the UK or the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) in the Netherlands — though we would appreciate the chance to resolve it first.
Security
Encryption in transit and at rest; short-lived signed URLs for photo access; access to customer photos restricted to trained staff performing quality control; no photos in system logs; EU-region infrastructure; regular access reviews. In the unlikely event of a breach involving your data we will notify the supervisory authority and, where required, you, within the statutory deadlines.
Changes to this policy
We will post changes here with a new date. Material changes affecting how we handle photos will be e-mailed to active customers.
Questions about this page
If you would rather talk to a person than read a legal text, e-mail us and we will reply in plain language.
Privacy and your data: privacy@fablebook.co.uk · Orders and complaints: support@fablebook.nl