Privacy policy
Last updated:
Draft pending legal review. Details in square brackets are still to be completed.
Who is responsible for your data
[COMPANY LEGAL NAME], Tax ID [NIF], registered at [REGISTERED ADDRESS]. For any privacy question, write to [CONTACT EMAIL].
This website
This website has no forms or user accounts and uses no cookies. We count visits with Umami, a cookieless analytics tool installed on our own server, which does not store your IP address or follow you across websites. Our hosting provider, Cloudflare, processes the IP address of each visit to serve the website and protect it from attacks (legitimate interest, art. 6(1)(f) GDPR).
What data we process in the app, and why
When you create a book in the app we process:
Your account (email address and name): to give you access and keep your books. Legal basis: the contract you accept when you sign up (art. 6(1)(b) GDPR).
The characters (name, age, description and the interests you tell us about each child or pet): to write and illustrate the story. Legal basis: the consent you give us as a parent or legal guardian (art. 6(1)(a) GDPR), which you can withdraw at any time by deleting the character.
Photos: only to create the character's illustrated sheet. We delete them when you approve the sheet, and at the latest 30 days after upload if you never approve it. We do not run facial recognition or use the photos to identify anyone. Legal basis: the same consent.
Your order (delivery address, recipient's name, gift message and dedication): to print and ship the book. Legal basis: the contract (art. 6(1)(b) GDPR).
Payment: handled by Stripe. We never see your card number.
Emails: we send you service messages (confirmations, order status). We only send marketing news if you expressly ask for it.
Invoices: kept because the law requires it (art. 6(1)(c) GDPR).
Children's data
Cuentakos is used by adults. Children have no account and do not use the app. By uploading a child's photo or details, you confirm that you are their parent or legal guardian, or that you have their permission.
We do not use photos or text to train any artificial intelligence model, and we choose providers that are contractually bound not to do so with the data we send them.
How long we keep it
Photos: until you approve the character sheet, 30 days at most. Account, characters and books: until you delete them or close your account (we keep them so you can reorder the book). Orders and invoices: six years, as required by law.
Who can see it
Only the providers we need to make the book, under a data processing agreement (art. 28 GDPR):
[IMAGE AI PROVIDER]: generates the illustrations and character sheets (receives the photos and character descriptions) · [TEXT AI PROVIDER]: writes the story text · [PRINT PARTNER]: prints and ships the book (receives the laid-out book and the delivery address) · Stripe: takes the payment · Resend: sends emails · [APP HOSTING PROVIDER]: hosts the app and the database · Cloudflare: hosts this website.
When a provider is outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework, where the provider is certified, or on standard contractual clauses approved by the European Commission. We never sell or share data with anyone else.
Your rights
You can ask to access, correct, delete, restrict, object to or port your data, or withdraw your consent, by writing to [CONTACT EMAIL]. If you think we are not handling it properly, you can complain to the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.
How we protect it
Photos and books are kept in private storage. They can only be reached through temporary signed links, and every connection is encrypted.