Privacy policy

Who is responsible

UAB „Ros albus“, company code 304295661, VAT number LT100010327210, I. Simonaitytės g. 9-25, LT-06294 Vilnius, Lithuania. For anything about your data, write to [email protected].

We have not appointed a data protection officer; at our size and with the data we handle, one is not required.

What we process and why

Making the book on the website. We use the child's first name you type, the look you choose (skin tone, hairstyle, hair colour) and your dedication to show and print the book. The name goes into the story and onto the cover; the drawing service receives only the scene and a description of the chosen look, never the name. Basis: performing the contract and the steps before it.

Ordering and payment. We receive your name, e-mail address and shipping address from the payment form; Stripe handles the payment and we never see card details. We use these to print and ship the book, send the confirmation and meet our accounting duties. Basis: performing the contract and legal obligation.

The book link by e-mail. If drawing is deferred and you ask for the book by e-mail, we use the address only to send that link. Basis: your request (consent).

Newsletters. We send marketing e-mails only with your separate consent; you can withdraw it any time with the link at the bottom of every e-mail or by writing to us. Basis: consent.

Technical data and security. To run the site, prevent abuse and keep statistics we process your IP address (for rate limits we keep only an irreversible hash of it), browser and device type, the pages you view and your actions on the site. Basis: our legitimate interest in a working, secure website.

Cookies and tracking

Essential cookies are always on: they keep your book's state and your cart. Analytics and marketing tools – Google Tag Manager, Google Analytics 4, the Meta Pixel and Omnisend – only run where the law requires consent after you accept them in the cookie banner; elsewhere they run by default and the banner lets you turn them off. You can change your choice any time in the banner's settings.

Analytics data helps us understand how the site is used; marketing tools measure our advertising. These providers may process data outside the EU; transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Who we share data with

• Stripe – payments.
• Supabase (database) and Railway (hosting) – servers in the US.
• Google Cloud – the drawing service for the illustrations and file storage (US).
• OpenAI – draws the child into the scenes from the chosen look; the name and other personal data are not sent.
• Resend – order confirmation and book-link e-mails.
• Omnisend – newsletters, with consent only.
• Cloudflare – protection and speed of the website.
• Postal and courier services – delivery (they receive the recipient's name and address).
• Our accounting provider – bookkeeping.

We print and bind the books ourselves in Vilnius. We never sell data and never use it for anything other than what is described here. For transfers outside the European Economic Area we rely on standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep data

• Order data – 10 years from the order, as accounting law requires.
• A name and look typed without an order – 30 days.
• Marketing contacts – until you unsubscribe.
• Technical and analytics data – per the tools' settings, at most 26 months.

Your rights

You can ask to see your data, correct it, delete it, restrict its processing, receive it in a portable format, object to processing based on our legitimate interest, and withdraw consent at any time. Write to [email protected] and we answer within 30 days.

If you believe we handle your data wrongly, you can complain to the Lithuanian State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, [email protected]) or to the supervisory authority in your country.

Children

The website and orders are for adults. A child's name and look are provided by parents or guardians; we collect nothing from children directly.

Changes

When this policy changes, we publish the new version here with its date.