Privacy policy

The controller within the meaning of the GDPR and the revised Swiss Data Protection Act (revDSG) is: Miraix Creators by M. Rötzer, Birkenstrasse 9, 4123 Allschwil, Switzerland. Email: hello@heldio.ch.

(a) Account: email address, optional name, country, language. If you sign in with Google, Google passes your name and email address to us. Basis: contract (Art. 6(1)(b) GDPR). (b) Book data: details about your child you enter in the wizard or the free sample (name, age, gender, appearance features, family information). Legal basis: contract (Art. 6(1)(b) GDPR); the book cannot be made without them. (c) Photo data: photos of your child you upload. We use them as a visual reference for the illustrations and do not train any models with them ourselves; the providers in section 4 carry out the processing. Legal basis: your explicit consent as the person with parental responsibility (Art. 6(1)(a) GDPR; Art. 6 revDSG), given before the first upload in the wizard and in the free sample. You can withdraw it at any time with effect for the future; this does not affect the lawfulness of processing up to that point. A message to hello@heldio.ch is enough; you can also delete the photos yourself at any time in your account under “Privacy”. (c2) Photos of other people and pets: if you upload photos of other characters in the wizard (e.g. siblings, grandparents, parents, friends or pets), we process them exactly like your child's photos: only to check the image and as a visual reference for this book's illustrations, by the providers in section 4, partly outside Europe (see sections 3 and 4), and deleted automatically 30 days after upload. Only upload photos of people who agree to it; for children, their parents must agree. Legal basis: our legitimate interest in creating the book the way you want it (Art. 6(1)(f) GDPR); in doing so we rely on the people shown having agreed. (d) Payment: handled by Stripe; we never see full payment details. (e) Technical: hashed/truncated IP, user-agent, timestamp. (f) Order and gift data: when you order, your delivery address (name, street, postcode, city, country and, where needed, state or province), your email address at the time of the order. To print and ship a printed book, we transmit the delivery address, your email address and your book's print file to our print partner Gelato; the print file contains your child's name, the illustrations in which your child can be recognised, and the dedication. Gelato and the partner print shop that prints and ships the book in or near the delivery country receive this information for that purpose (see section 4). Gelato never receives the uploaded photos. When you buy a gift card, additionally the name and email address of the person you are gifting, used solely to deliver the voucher code to them. Legal basis: contract (Art. 6(1)(b) GDPR). (g) Newsletter: if you sign up for the newsletter (in the footer or in the notice window on the website), we store your email address, language, the time of sign-up and the version of the consent wording. We then send you an email with a confirmation link (double opt-in). Only once you use it are you signed up; we also store the time of confirmation. Unconfirmed sign-ups are deleted after seven days. After confirming you receive a discount code; we store the code and its expiry date. We create the code with our payment provider Stripe, without your email address. Basis: consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time, via the link in every email or by writing to hello@heldio.ch. Delivery runs through Resend (see section 4). (h) Contact form: if you write to us via heldio.ch/en/kontakt, we store your name, email address, message, language, timestamp and a truncated, hashed IP address (spam protection). We use these details solely to answer your request and delete them no later than twelve months after the request is closed. Basis: pre-contractual steps or our legitimate interest in replying (Art. 6(1)(b) and (f) GDPR). (i) Birthday reminder: if you set up a birthday reminder for a child on your bookshelf, we store the day and month of the birthday (never the year of birth), which child it belongs to, when and under which wording you gave your consent, and whether you confirmed it by email. Purpose: until you unsubscribe, we send you one neutral email a year, three weeks before the birthday, with a book idea (no discount and no offer). Legal basis: your consent (Art. 6(1)(a) GDPR), which you confirm through a link in an email (double opt-in); we never send anything to an unconfirmed sign-up and delete it after seven days. You can withdraw your consent at any time: with the unsubscribe link in every reminder, on your bookshelf or by writing to hello@heldio.ch. We then delete the reminder together with the birthday, as we also do when you delete the child or your account. Emails are sent via Resend (see section 4). (j) Help chat with Heldino: if you use the chat on the website, we send your messages and the conversation so far to our text model (Anthropic via AWS Bedrock, see section 4: the request goes to AWS in the USA, and AWS may route it to an AWS data centre in another country for processing) so Heldino can answer. Heldino is an automated helper, not a person. If you are signed in, we also pass on the status of your books (for example "being painted" or "ready to check"), but no names and no photos. We do not store the conversation; it stays only in your browser until you close the tab. To prevent abuse, we count requests per truncated, hashed IP address. If you send us a message from the chat, we treat it like a message sent through the contact form (see h). Legal basis: our legitimate interest in helping you quickly (Art. 6(1)(f) GDPR). We base the transfer to the USA on the certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Please do not enter sensitive data in the chat.

Because children's photos are particularly sensitive, the following binding rules apply:

• Storage location: photos, illustrations and PDFs live in Cloudflare R2 storage restricted to data centres in the EU (EU jurisdiction). Account and book data live on a server we operate in Frankfurt, Germany, hosted with Hostinger. To print an ordered book, we transmit its print file (with the illustrations, not the uploaded photos) to Gelato and the partner print shop in or near the delivery country, which depending on that country may be outside the EU (see sections 2(f) and 4). • Processing: for the image analysis and the illustrations we pass the photos (including those of other characters) to our service providers (see section 4). Part of this processing takes place outside Europe, namely with Amazon Web Services in the us-east-1 region (USA), with Google and with WaveSpeed (Singapore/Hong Kong). Google LLC, Amazon Web Services, Inc. and Anthropic PBC are certified under the EU-U.S. Data Privacy Framework (EU Commission adequacy decision); WaveSpeed deletes uploaded images after 7 days. In addition, we obtain your explicit consent before a photo is transferred for the first time (Art. 49(1)(a) GDPR) – in the wizard and in the free sample. Without that consent no photo is sent to any provider. There is no adequacy decision for Singapore or Hong Kong, where WaveSpeed is based, so the transfer to WaveSpeed rests on this consent alone. • Retention: 30 days from upload, then automatically deleted via an hourly cron. • Force-delete: available in your account under "Privacy" any time. • Free sample without an account: if you upload a photo for the free sample, the same rules apply – with shorter periods. The photo and every picture made from it are deleted automatically 24 hours after upload; the remaining preview data (first name, age, story text) no later than 7 days after you started it. As there is no account, both run automatically; write to hello@heldio.ch if you want it sooner. • Purpose: the photo is used solely as a visual reference so your child stays recognisable in your book's illustrations. We do NOT train a lasting model of your child. • No cross-user face recognition, no face database. • Access by us: nobody at Heldio looks at the photos as a matter of routine. Only if something goes wrong while your book is painted, or you ask us for help, can the operator open a single photo in the protected admin area to find the fault. Every such access is logged with its time and reason. • No sharing beyond the service providers listed in section 4, no sale, no advertising use. • After the 30 days elapse, the uploaded photo is deleted. For books that were never ordered, we delete the illustrations made from it as well. If you bought the book, its illustrations remain; they are the product you own. Delete your account and those go too. • Appearance note: so your child looks the same on every page, we store a short text description of their appearance (e.g. hair and eye colour) with the book. It is deleted together with the photos – after 30 days or on force-delete for books that were never ordered, and with the book or your account for purchased books.

• Hostinger (server hosting, Frankfurt, Germany data centre: runs the application and the database with account and book data) • Cloudflare, Inc. (R2 object storage for photos, illustrations and PDFs; storage restricted to data centres in the EU) • Google LLC (image generation with the Gemini image models; processing also in the USA; certified under the EU-U.S. Data Privacy Framework) • Amazon Web Services, Inc. (text generation, image analysis and the answers in the help chat via AWS Bedrock, us-east-1 region/USA; AWS may also route chat requests to AWS regions in other countries for processing; certified under the EU-U.S. Data Privacy Framework) • Anthropic PBC (text models, run via AWS Bedrock; certified under the EU-U.S. Data Privacy Framework) • WaveSpeed (WaveSpeedAI PTE. LTD., Singapore, and WaveSpeedAI LIMITED, Hong Kong; image generation; uploaded images are deleted there after 7 days; processing outside the EU and Switzerland) • Stripe Payments Europe Ltd. (payments) • Resend.com (based in San Francisco, USA; email delivery, including the newsletter; processing in the USA; certified under the EU-U.S. Data Privacy Framework, plus standard contractual clauses) • Umami Software, Inc. (cookieless reach measurement; EU data region, servers in Frankfurt, Germany; IP addresses are not stored) • Gelato ASA, Oslo/Norway (printing and shipping via partner print shops in or near the delivery country; for our delivery countries these are currently print shops in Germany, Spain, Denmark and Norway (EU/EEA), Switzerland, the UK, the USA, Canada, New Zealand and Singapore; Gelato and the partner print shop concerned receive the delivery address, email address and the book's print file with your child's name, the illustrations and the dedication, see section 2(f))

Some of these providers process data in the USA: Google, Amazon Web Services, Anthropic and Resend. For Google, Amazon Web Services and Anthropic we base the transfer on their certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and additionally on your explicit consent (Art. 49(1)(a) GDPR). For Resend we base it on its certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and on standard contractual clauses (Art. 46(2)(c) GDPR; for Switzerland Art. 16(2)(d) revDSG).

WaveSpeed is based in Singapore and Hong Kong. For these countries there is neither an EU Commission adequacy decision nor recognition under Annex 1 of the Swiss Data Protection Ordinance. We therefore base the transfer of photos to WaveSpeed solely on your explicit consent (Art. 49(1)(a) GDPR; Art. 17(1)(a) revDSG).

For printed books, the order data and print file go to Gelato in Norway (EEA) and, depending on the delivery country, to a partner print shop in the EU, Norway, Switzerland, the UK, Canada, New Zealand, the USA or Singapore. For Switzerland, the UK, Canada (for organisations subject to the Canadian privacy law PIPEDA) and New Zealand, the EU Commission has found the level of data protection adequate (Art. 45 GDPR); under Swiss law, the EU and EEA states, the UK, Canada and New Zealand are likewise considered to provide adequate protection (Annex 1 of the Swiss Data Protection Ordinance). For partner print shops in the USA and Singapore, Gelato states that it bases the transfer on standard contractual clauses (Art. 46(2)(c) GDPR; Art. 16(2)(d) revDSG). Independently of this, the transfer to the print shop is necessary to perform our contract with you; without it the book cannot be printed and delivered (Art. 49(1)(b) GDPR; Art. 17(1)(b) revDSG).

Art. 28 GDPR data processing terms apply with all providers.

You have the right of access, rectification, erasure, restriction, portability and objection at any time. Consent, for example to the processing of your child's photos or to the newsletter, can be withdrawn at any time with effect for the future; this does not affect the lawfulness of processing up to that point. A message to hello@heldio.ch is enough; you can also delete the photos yourself at any time in your account under “Privacy”. Complaints can be filed with the FDPIC (Switzerland) or any EU data protection authority. Questions or requests: hello@heldio.ch.

We use only strictly necessary cookies: your login (heldio_session), your progress in the book wizard (heldio_wizard_book_id, heldio_wizard_child_id) and in the free sample (heldio_probe_id, heldio_probe_converted), your currency choice (heldio_currency), the delivery country you last chose (heldio_country), your language choice (NEXT_LOCALE), a redeemed gift credit (heldio_gift_credit) and a short-lived security cookie during Google sign-in (g_oauth_state). We set no tracking or advertising cookies. Your browser also keeps a few things locally (local storage), and they stay on your device: your child’s first name if you type it on the home page, so you don’t have to type it twice in the wizard; what you enter on the first step of the wizard (world, story idea, value, language, first name and age, plus the ideas last shown), so nothing is lost if you leave the page (deleted once “Continue” has saved your draft or when you log out, discarded after 7 days at the latest); and whether you have seen the cookie notice. For the length of your visit only (session storage), your browser also remembers whether you closed the reminder to continue your book. When you log out we delete the first name and the first step from this browser; you can also delete these entries any time in your browser settings. To measure reach we use Umami (see section 4), without cookies, without storing your IP address and without a profile across other websites. It records the page you open (without page titles, book or order numbers, or access codes from links; of the link parameters only campaign tags such as utm_source are kept), the website you came from, browser, operating system, device type, screen size and language, as well as country, region and city. Umami derives country, region and city from your IP address when the page is requested; the IP address itself is not stored. We also count a few clicks without their content: whether the reminder to continue was shown, tapped or closed, and whether entries from the first step were restored (only the kind of reminder, never names or texts). Legal basis: our legitimate interest in a data-minimal analysis of how our website is used (Art. 6(1)(f) GDPR).

• Photos of your child and of other characters: 30 days from upload, 24 hours in the free sample, or immediately, as soon as you delete them in your account under “Privacy”. • Illustrations and PDFs: for books that were never ordered, together with the photos. For purchased books they stay until you delete the book or your account; they are the product you own. • Account and book data: for as long as your account exists. Delete it and they are removed from our live system immediately. • Order data: for as long as your account exists. Delete your account and they go with it. • Contact form: no longer than twelve months after your enquiry is closed. • Newsletter: until you unsubscribe; unconfirmed sign-ups after seven days. • Help chat: we do not store conversations. Messages you send us from the chat are handled like the contact form. • Proof of consent: together with the account it belongs to. • Birthday reminder: until you unsubscribe or delete your account; unconfirmed sign-ups after seven days. • Backups: we back up our database every night so nothing is lost if something fails. We keep at most the last 30 nightly backups and delete older ones automatically. Deleted account, book and order data therefore also disappears from the backups after about a month; until then we use the backups only to restore after a failure.