Privacy policy

Last updated: 5 November 2026

This policy explains what personal data Paper & Sun (StoryStar, Timeless and RoomGlow) collects, why, and what rights you have. Contact: hello@paperandsun.com.

What we collect

• Photos you upload: a photo of a child for a storybook, an old family photo, or a room photo. Location data (EXIF/GPS) is removed when the photo is uploaded.
• Details you type: for example the child's first name, age and story preferences, or your room style and budget.
• Order data: what you bought and the results we created.
• Payment details are collected and processed by Paddle, not by us. We receive your email address and order status from Paddle.
• Technical data: IP address and basic request logs, used for security and to prevent abuse.

Why we use it

Only to create, deliver and support your order, to send you a link to your order, to prevent fraud and abuse, and to meet legal obligations. The legal bases are performing our contract with you and our legitimate interest in running a secure service. We do not use your photos to train models, we do not identify people in photos, and we do not sell your data. We measure ad performance as described under “Cookies, analytics and advertising”.

How long we keep it

• Previews you don't buy: deleted automatically after 1 hour.
• Paid orders, including photos and results: deleted automatically after 30 days.
• Payment and invoice records: kept by Paddle as required by tax law.

Who processes it for us

• Paddle (payments, Merchant of Record).
• Anthropic and Google (image and text generation, under their API terms, which do not use the data for training).
• Render (hosting and database, United States).
• Resend (sending your order email, if you bought something).
• Meta (ad measurement) and PostHog (analytics), as described below.

Some of these providers are outside your country. Transfers are covered by their standard contractual safeguards.

Children

The Service is for adults. A storybook may include a child's photo and first name, which must be provided by the child's parent or legal guardian or with their permission. That data is used only to create the book and is deleted on the schedule above.

Cookies, analytics and advertising

We measure how people find and use the site so we can improve it and our ads:

• Meta Pixel and Conversions API (Meta Platforms): tells Meta which visits came from our ads and when a visit leads to a free preview or a purchase. Meta may set cookies (for example _fbp). For purchases we also send Meta the order value, your IP address, browser type and a one-way hashed (SHA-256) version of your email address, so the purchase can be matched to an ad.
• PostHog (product analytics): counts page views, previews made and purchases using a random visitor ID stored in your browser.

We never send names, photos, story text, room details or anything you type into a form to Meta or PostHog. You can opt out of personalised ads in your Meta ad settings, and you can block cookies in your browser at any time. Your browser may also store a small note (for example a photo-pack code) so your order works when you come back.

Your rights

You can ask to access, correct or delete your data, or object to its use, by writing to hello@paperandsun.com with your order link. If you are in the EU or UK you may also complain to your data protection authority.