Privacy policy

Last updated: 21 July 2026

This Privacy Policy explains how mybibblio [full legal entity to be added] (“mybibblio”, “we”, “us”, “our”) collects, uses, and protects personal information when you visit or buy from this store. We are the “data controller” of your personal data under UK data protection law (UK GDPR and the Data Protection Act 2018).

Because our products are personalised books for children, we know you are trusting us with sensitive information — including a photo of your child. This policy sets out exactly what we do with it.

Contact: hello@mybibblio.com · business address available on request.

1. The information we collect

a) Information you give us to place an order

Your name, email address, billing and delivery address, and phone number (if provided).
Your payment is handled securely by our payment provider — we do not see or store your full card details.

b) Personalisation details about your child (provided by you)
To create the book, you give us:

Your child’s first name
Your child’s age
Your child’s pronouns (he/him or she/her)
A few of your child’s favourite things
An optional dedication message
A photograph of your child

c) Information collected automatically
Basic technical and usage data (e.g. device/browser information and how you use the site), handled through our store platform. Cookie and consent settings are managed separately via our cookie banner.

2. How and why we use your information (and our legal basis)

What we do	Why	Legal basis (UK GDPR)
Create your personalised book (including generating an illustrated likeness from the photo)	To deliver what you ordered	Consent (for the child’s photo and details) and performance of a contract
Process your order, payment, and delivery; provide customer service	To fulfil and support your purchase	Performance of a contract
Keep records for tax, accounting and legal compliance	Legal requirement	Legal obligation
Protect against fraud and keep the service secure	To run our business safely	Legitimate interests
Send you marketing (only if you opt in)	To tell you about new stories/offers	Consent (you can opt out any time)

We do not use your child’s photo or details for advertising, and we do not sell them.

3. Children’s data and your photo — our specific commitments

The information and photo about your child are provided by you, the parent or legal guardian, who confirms you have the authority and consent to share them with us.
We use the photo and details only to create your book.
Your child’s photo is processed by AI image tools to create an illustrated, story-book likeness. We do not use your child’s photo to train our own AI models or for any purpose other than making your book. Where we use third-party AI tools, we choose providers and settings intended to prevent your content being used to train their models.
Every book is reviewed by a person before printing.
Your child’s book and photo are never made public or used in our marketing without your explicit, separate permission.

4. Who we share your information with (our sub-processors)

We share personal data only with the service providers that help us run the store, create your book, and deliver it — and only as far as needed. We do not sell your personal data to anyone.

Provider	What we use it for	Data involved
Shopify	Store, checkout and order processing	Contact, order and personalisation details
Shopify Payments	Taking your payment	Payment details (we never see or store full card numbers)
Supabase	Secure storage of the uploaded photo	Your child’s photo
Replicate	AI image generation of your child’s story-book likeness	Your child’s photo (passes through transiently to create the illustrations)
OpenAI	AI personalisation of the story text	Your child’s name and details
Bookvault	Printing and shipping the finished book	Delivery name/address and the finished book
Render	Hosting our order-processing service	Order and personalisation data (in transit/processing)
Delivery couriers & our email provider	Delivering your order and sending order updates	Name, address, email

We require these providers to protect your data and use it only to provide their service to us. Some (such as Replicate) process your child’s photo only transiently to generate the artwork rather than keeping it.

5. International transfers

Some of our providers (for example Shopify, Replicate, OpenAI, and our hosting/storage providers) are based outside the UK/EEA, including in the United States. Where your personal data is transferred internationally, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement/Addendum, EU Standard Contractual Clauses, or an adequacy decision.

6. How long we keep your information

We keep your child’s photo and personalisation details only as long as needed to create and deliver your book, plus a short safety window in case you need a reprint — 90 days after your order is completed — after which they are securely deleted.
You can ask us to delete your child’s photo and details at any time (see Your Rights), and we’ll confirm once done.
We keep basic order and transaction records for longer where required by law (e.g. tax/accounting — typically 6 years in the UK).

7. How we protect your information

Information is transmitted over an encrypted (SSL/HTTPS) connection.
Access to personal data is limited to those who need it to make your book.
Each book is reviewed by a person before printing.

8. Your rights

Under UK data protection law you have the right to: access your data; correct it; request deletion; restrict or object to processing; data portability; and withdraw consent at any time. To exercise any right, contact us at hello@mybibblio.com.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO) — ico.org.uk.