Privacy Policy

Birthday Hero Book (“we”, “us”, “our”) creates personalised digital children’s storybooks through birthdayherobook.com. We are the controller of the personal information described in this policy. If you have any question or request about your information, please contact us at hello@birthdayherobook.com.

To create your order we collect the purchaser’s name and email address, the payment reference from our payment provider, and the personalisation details you give us about the birthday child: their first name, the age they are turning, a general description of their appearance, their interests and favourite things, the chosen adventure, and any optional extras you add such as a pet, family members to include, details to avoid and a dedication.

We do not ask for, and ask that you do not provide, a child’s surname, full date of birth, school, home address or precise location.

A photograph is entirely optional — you can describe the child’s appearance in words instead. If you choose to upload one, it is used only to illustrate the book you have purchased. Photographs are held in private, access-controlled storage, are never made public, and are deleted once your order is complete and any correction period has passed.

• To verify your payment and fulfil your order.
• To personalise the story text and illustrations.
• To deliver your digital book and handle any corrections.
• To send essential order updates and your receipt.
• To keep the records we need for tax and accounting.
• To keep our website secure and prevent misuse.

Under UK data protection law we rely on:

• Performance of a contract — to take and fulfil your order, including creating the book from the details you provide.
• Consent — for optional marketing emails, analytics cookies and referral cookies, each of which you can withdraw at any time.
• Legal obligation — to keep transaction records for tax and accounting.
• Legitimate interests — to keep our website secure and prevent fraud and misuse.

A child’s details are provided by the purchasing parent, guardian or authorised adult and are processed to create the book they have ordered.

Our books are bought by adults for a child. We collect only the limited details needed to personalise the story, we ask purchasers not to include sensitive information, and we never use a child’s photograph, name, story or details for marketing.

Marketing email consent is optional, separate and never pre-selected. We will not use a child’s photograph, story or details for marketing without a further, explicit permission process.

We use a small number of first-party cookies to make the site work and, only with your consent, Google Analytics to understand how the site is used and a referral cookie to credit partners who introduce customers. You can accept, reject or change these choices at any time — see our Cookie Policy for full details.

We do not sell your information. We share it only with the trusted providers that operate our service, acting on our instructions:

• Stripe — payment processing. Stripe handles your card details directly; we never see or store your full card number.
• Supabase — secure database and file storage for your order and any photograph.
• Resend — sending your order and account emails.
• Vercel — website hosting and delivery.
• Google Analytics — website usage measurement, used only if you accept analytics cookies.

Each provider may use your information only to provide its service to us.

Your information is sent over encrypted connections and stored on secure, access-controlled infrastructure reachable only by our server — order details and photographs are not publicly accessible. Some of our providers process data outside the UK; where they do, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

We keep your personalisation details and any photograph only for as long as we need them to create, deliver and support your book, after which they are deleted. Basic transaction records — such as your name, email, order reference and amount — are kept longer where we are required to for tax and accounting, typically up to six years.

You have the right to ask for a copy of the information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw any consent you have given. To exercise any of these, contact hello@birthdayherobook.com and we will respond within the time limits set by law. If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.