Privacy Policy

Epic Little Hero ("we", "us", or "our") operates the Epic Little Hero website and personalized children's book creation service. This Privacy Policy explains what information we collect, why we collect it, and how we protect it. By using our service you agree to the practices described here.

Because our service involves uploading photos of children, we take privacy especially seriously. We never sell your data or use children's photos for advertising. If you separately join the launch list, we use that email address for one launch notification.

Purchases are made without customer accounts. We do not ask buyers to create a password.

Information you provide directly:

• Name and email address (required to process your order and deliver your book)
• Payment details — card number, expiry, and CVC (processed in-session only; we do not store raw card data)
• Photos of your child that you upload for personalization
• Story preferences: theme, age, favorites, and special requests

Information collected automatically:

• Basic server logs (IP address, browser type, pages visited) retained for up to 30 days for security purposes
• Session data necessary to maintain your workflow across steps

• Generate your personalized illustrated book using AI (Google Gemini)
• Process payment and send your order confirmation
• Store your completed book PDF for download for 30 days from when it is first ready
• Respond to support enquiries
• Detect and prevent fraud or misuse of the service

We do not use your child's photos to train AI models or for advertising. Order information is used to deliver your book and support you. The optional launch-list email is used for the one notification described above.

If you choose to join the waitlist, we use your email address only to send one message when book creation opens. The legal basis is your explicit consent. We store the consent wording version, signup date, and source page with your address. We do not send an email when you sign up.

You can withdraw consent using the removal link in the launch email or by contacting us. We delete an entry 30 days after the launch announcement is marked sent, or 12 months after signup, whichever comes first. Any other promotional messages would require a separate consent choice.

Our service is intended for parents and guardians who are at least 18 years old. We do not knowingly collect personal information directly from children under 13. Photos you upload of your child are used to create and personalise your book. We delete them when the completed PDF is verified, or seven days after the order was created if the book remains unfinished.

If you believe we have inadvertently collected information from a child without parental consent, please contact us through our contact form.

Book illustrations and stories are generated using Google's Gemini API. Your input data (story preferences and character photos) is transmitted to Google's servers for this purpose. Google's use of this data is governed by their API Terms of Service and Data Processing Addendum. We do not permit Google to use your data for purposes beyond processing your immediate request.

To run the website we also use these service providers: Hostinger (our hosting provider, which stores the site and its data on its servers); Cloudflare (which delivers the website and protects it from attacks, and so processes visitors’ IP addresses and requests); and, only if you accept analytics cookies, Google Analytics (see Cookies & Analytics below). We do not sell your personal information or share it with anyone else except where required by law.

• Uploaded photos are deleted when the completed PDF is verified, or seven days after the order was created if unfinished
• Private character sheets and illustrations are deleted after the PDF is built and verified
• The PDF, story text, child names and character descriptions are deleted 30 days after the PDF is first ready
• If a book is never completed, its character sheet, story text and any illustrations are deleted 30 days after the order was created
• Contact form messages are deleted 12 months after they are sent
• Analytics about how visitors move through the site keep an email address for no more than 30 days and are deleted after 12 months
• Order and payment records, including buyer contact details, purchase dates and amounts, payment identifiers, delivery and download dates, and issue categories, are retained for the applicable accounting period, generally at least seven years
• To ask about your data or request deletion, use our contact form. Some order records must be kept for accounting.

The mb_consent cookie remembers your choice. During checkout, session storage holds your order access token so you can resume your book in this tab. Administrators use separate, strictly necessary sign-in cookies.

If you accept analytics, we set an mb_sid cookie and may store campaign information in session storage. We record which book-creation steps you reach and, if you provide it, your email address. We never send your child's photos, names, or story content to analytics. We may use this information to improve the experience and show relevant offers.

If you accept analytics, we also use Google Analytics 4 (Google LLC) to measure visits and how pages are used. It sets the _ga and _ga_* cookies (kept for up to 2 years) and receives your IP address, browser and device details, and the pages you view; Google does not store full IP addresses for Google Analytics 4. We do not send Google your email, order details, or anything about your child. Google Analytics is not loaded at all unless you accept, and withdrawing consent turns it off and deletes those cookies.

You can accept or decline using the banner, and change your choice anytime through Cookie settings in the footer. Declining or withdrawing consent removes the analytics identifier and stops future tracking without affecting book creation. We do not sell your data.

We use HTTPS/TLS for data transmitted to and from our service and restrict access to customer photos and books. No internet transmission is entirely secure.

Depending on your location, you may have rights to access, correct, or delete your personal data; to object to or restrict certain processing; and to data portability. To make a request, use our contact form.

We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated date. Continued use of the service after changes constitutes acceptance of the new policy.

If you have questions about this Privacy Policy, use our contact form.