Privacy Policy
ChildHeroStoryBooks.com
Last updated: 14 September 2026
1. Who we are
1.1 ChildHeroStoryBooks.com ("we", "us", "our") is the data controller for the personal data described in this policy. We are responsible for how your data is collected and used.
1.2 ChildHeroStoryBooks is a social community brand created by partners PAD-CIC (company number 13168668) and AiConsultancy.org.uk. Registered address: 6 Gleneagles, Waltham, Grimsby, North East Lincolnshire, DN37 0XD.
1.3 Contact for any privacy question or request: [email protected].
1.3 This policy explains what we collect, why, how we protect it, and the rights you have. It covers our website https://ChildHeroStoryBooks.com and any order you place.
2. The data we collect
2.1 Data you give us
- Contact details — name and email address.
- Order details — which book you ordered, page count, and any delivery details for printed books.
- Personalisation Data — the child's first name, age or age range, pronouns, appearance details, chosen theme, illustration style, dedication and any story notes you type.
- Photographs — images you upload so we can create illustrated characters.
- Communications — messages you send us through the contact form or by email.
- Payment confirmation — we receive confirmation that payment succeeded. We do not receive or store your full card details; these are handled by our payment provider.
2.2 Data collected automatically
- Technical data — IP address, browser type, device type, and operating system.
- Usage data — pages viewed, time on page, and interactions, collected via analytics.
2.3 Please do not send us sensitive data. Our forms are not designed for special category data (for example health, ethnicity or religious information). Please do not describe these in free-text fields.
3. Children's data — our approach
3.1 Our books are for children, but ordered by adults. Orders and accounts are placed and held by a parent, guardian or other responsible adult.
3.2 We do not knowingly collect personal data directly from children. There are no child accounts, no sign-in for children, no messaging or social features, and no advertising on our site.
3.3 The child's details and photographs we hold are provided by you, the adult placing the order. You confirm when ordering that you have the authority to provide them.
3.4 We collect the minimum needed to create the book. We do not use a child's data to build profiles, and we never sell it.
3.5 Child data is treated as a high-sensitivity category internally, with restricted access, and is deleted or anonymised on the retention schedule in section 7.
4. Why we use your data, and our lawful bases
Under the UK GDPR and the Data Protection Act 2018, we rely on:
| Purpose | Lawful basis |
|---|---|
| Creating your account and processing your order | Performance of a contract (Art. 6(1)(b)) |
| Processing Personalisation Data and photographs to create your book | Consent (Art. 6(1)(a)) |
| Sending order confirmations and service messages | Performance of a contract |
| Customer service and handling complaints | Legitimate interests (Art. 6(1)(f)) |
| Fraud prevention, security and keeping our site reliable | Legitimate interests |
| Tax, accounting and other legal duties | Legal obligation (Art. 6(1)(c)) |
| Our newsletter and marketing (only if you opt in) | Consent (Art. 6(1)(a)) |
| Understanding how the site is used, to improve it | Legitimate interests |
4.1 Where we rely on consent, you may withdraw it at any time. Withdrawing consent for Personalisation Data means we cannot create your book — if that happens before delivery, contact us and see our Refund Policy.
5. AI processing
5.1 We use generative artificial intelligence to create illustrations and draft story text from the details and photographs you provide.
5.2 Where we use third-party AI providers, we send only what is necessary to generate your book. We do not permit these providers to use your content to train their models, and we do not share more than is needed for the task.
5.3 AI-generated illustrations are artistic interpretations, not exact likenesses. See our Terms and Conditions.
6. Who we share data with
6.1 We never sell your personal data.
6.2 We share it only where necessary, with:
- Payment providers — to take payment securely.
- Hosting and infrastructure providers — to run the website and store your order.
- AI providers — to generate illustrations and story text.
- Analytics providers — to understand website usage. Where possible this data is aggregated or anonymised.
- Print partners — only if you order a printed book.
- Professional advisers and authorities — where we are legally required, or to establish or defend legal claims.
6.3 Every provider acts under a contract that requires them to protect your data and use it only for the purpose we specify.
7. How long we keep it
| Data | Retention |
|---|---|
| Account data | Until you ask us to delete it |
| Order records and invoices | 7 years (tax and accounting rules) |
| Personalisation Data and uploaded photographs | Deleted within 10 weeks of your book being delivered, unless you ask us to keep your details for a future order |
| Contact form messages | 24 months |
| Analytics data | As configured by our analytics provider, aggregated where possible |
| Newsletter subscription | Until you unsubscribe |
8. International transfers
8.1 Some of our providers may process data outside the UK or EEA. Where that happens we rely on appropriate safeguards — such as the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses — and we assess the risk before transferring.
9. Keeping your data secure
9.1 We protect your data with:
- encryption in transit (HTTPS) and, where appropriate, at rest;
- access controls limiting who can see order and child data;
- secure, hashed storage of any account credentials;
- server-side validation of form submissions; and
- regular review of our systems and providers.
9.2 No online service can promise perfect security. If a breach affects your rights, we will notify you and the ICO where we are required to.
10. Your rights
10.1 You have the right to:
- be informed about how we use your data;
- access a copy of your personal data;
- rectify inaccurate or incomplete data;
- erase data we no longer need (the "right to be forgotten");
- restrict how we use it;
- object to processing based on legitimate interests;
- data portability — receive your data in a portable format;
- withdraw consent at any time, where consent is the basis;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and
- complain to a supervisory authority.
10.2 To exercise any of these, email [email protected]. We will respond within one month. There is normally no charge.
10.3 You can ask us to delete a child's data at any time. We will do so unless we are legally required to keep it.
11. Cookies
11.1 We use cookies and similar technologies. See our Cookies Policy for the full list, what each is for, and how to control them.
11.2 We do not use advertising or tracking cookies on any part of the site directed at children.
12. Marketing
12.1 We only send marketing email if you have opted in. Every email includes an unsubscribe link.
12.2 We do not sell or rent your contact details to anyone.
13. Complaints
13.1 Please contact us first at [email protected] so we can put things right.
13.2 If you are not satisfied, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
14. Changes to this policy
14.1 We may update this policy. The current version is always published here, with the "last updated" date at the top. Material changes affecting how we use child data will be highlighted.
15. Contact
ChildHeroStoryBooks.com
Email: [email protected]
Website: https://ChildHeroStoryBooks.com
Registered address: 6 Gleneagles, Waltham, Grimsby, North East Lincolnshire, DN37 0XD
ChildHeroStoryBooks is a social community brand created by partners PAD-CIC (company number 13168668) and AiConsultancy.org.uk.