MemoryTales

Privacy Policy

Last updated: March 2026

MemoryTales Ltd ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our website at memorytales.co.uk and our personalised children's storybook service.

MemoryTales Ltd is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions about this policy or your personal data, please contact us at contact@memorytales.co.uk.

1. What Data We Collect

We collect the following personal data when you use our service:

Information you provide directly

  • Name — your full name, and the name of the child the book is for
  • Email address — used for order confirmation, shipping updates, and customer support
  • Shipping address — used to deliver your personalised book
  • Photographs — photos of your child uploaded to create personalised illustrations
  • Story preferences — character name, story choices, and other customisation details

Information collected automatically

  • Payment information — processed securely by Stripe. We do not store your full card details on our servers.
  • Cookies and usage data — session identifiers, browser type, and basic analytics data (see our Cookie Policy)
  • Device and browser information — IP address, browser type, operating system, and referring URL

2. Why We Collect Your Data

We use your personal data for the following purposes, each with a lawful basis under UK GDPR:

  • To create your personalised storybook (contract performance) — we use your child's name, story preferences, and uploaded photos to generate custom illustrations and assemble your book.
  • To process and fulfil your order (contract performance) — including taking payment, printing, and shipping your book to the provided address.
  • To send transactional emails (contract performance) — order confirmation, shipping notifications, and delivery updates.
  • To provide customer support (legitimate interest) — responding to queries, handling refund requests, and resolving issues with your order.
  • To comply with legal obligations (legal obligation) — maintaining records for tax and accounting purposes as required by UK law.
  • To improve our service (legitimate interest) — analysing usage patterns to enhance the user experience.

3. How We Handle Your Photos

We understand that photos of your child are highly sensitive. We take the following measures to protect them:

  • Photos are used solely for the purpose of creating your personalised book. They are never used for marketing, shared publicly, or sold to third parties.
  • During the book creation process, photos are temporarily stored on our secure servers and with our image processing provider (UploadThing).
  • Photos are sent to OpenAI for illustration generation. OpenAI processes the images solely to generate illustrations and does not retain or store your photos after processing.
  • All uploaded photos are deleted within 30 days of order completion. This includes removing them from our servers and from third-party storage.
  • You may request early deletion of your photos at any time by contacting us.

4. Cookies

We use cookies for session management and basic analytics. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

5. Third-Party Services

We share your data with the following trusted third-party service providers, each of whom processes data on our behalf and in accordance with their own privacy policies:

  • Stripe (payment processing) — processes your card payments securely. Stripe is PCI DSS Level 1 certified. We do not store your full card details. Stripe Privacy Policy
  • Resend (transactional emails) — sends order confirmation and shipping notification emails on our behalf. Resend Privacy Policy
  • Vercel (website hosting) — hosts our website and application infrastructure. Vercel Privacy Policy
  • UploadThing (file storage) — temporarily stores uploaded photos during the book creation process. Photos are deleted within 30 days of order completion.
  • OpenAI (illustration generation) — photos are sent to OpenAI's API to generate personalised illustrations for your book. OpenAI processes the images for this purpose only and does not retain or store your photos after processing. OpenAI's API data is not used to train their models. OpenAI Privacy Policy

We do not sell your personal data to any third party. Data is only shared with the providers listed above and solely for the purposes described.

6. Data Retention

We retain your personal data for only as long as necessary to fulfil the purposes for which it was collected:

  • Order data (name, email, shipping address, order details) — retained for 6 years from the date of the transaction, as required by HMRC for UK tax and accounting obligations.
  • Uploaded photos — deleted within 30 days of order completion from all our systems and third-party storage providers.
  • Payment data — Stripe retains transaction records in accordance with their retention policy and applicable financial regulations.
  • Analytics data — aggregated and anonymised data may be retained indefinitely. Identifiable analytics data is deleted within 26 months.

7. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights regarding your personal data:

  • Right of access — you may request a copy of all personal data we hold about you.
  • Right to rectification — you may request that we correct any inaccurate or incomplete data.
  • Right to erasure — you may request that we delete your personal data, subject to our legal obligations to retain certain records.
  • Right to data portability — you may request your personal data in a structured, commonly used, and machine-readable format.
  • Right to restrict processing — you may request that we limit how we use your data in certain circumstances.
  • Right to object — you may object to processing based on legitimate interests.

To exercise any of these rights, please contact us at contact@memorytales.co.uk. We will respond to your request within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Encryption of data in transit using TLS/SSL
  • Secure payment processing through Stripe (PCI DSS Level 1)
  • Regular review of data access and security practices
  • Limiting access to personal data to personnel who require it

9. Children's Privacy

Our service is designed to create personalised books for children, but all orders must be placed by an adult (aged 18 or over). We do not knowingly collect personal data directly from children. The photos and names provided are submitted by a parent or legal guardian, who is responsible for ensuring they have the right to share that information.

10. International Data Transfers

Some of our third-party service providers (including Stripe, Vercel, UploadThing, and OpenAI) are based in the United States. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Government, or that the recipient is in a country deemed to provide an adequate level of data protection.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: