This policy explains how StoryMello handles information when you use our website, save a draft, upload reference photos, or order a personalized book.
1. Information we collect
- Story details you enter, such as a child’s name, age, appearance, interests, relationships, chosen adventure, and dedication.
- Optional reference photos of children, family members, friends, pets, or other characters.
- Your selected book options, market, and draft and order identifiers.
- Partner application and account details, including organization and contact information.
- Contact, shipping, payment status, and transaction information supplied through checkout, plus messages and proof approvals you send us.
- Technical information needed to operate and protect the site, such as session identifiers, requests, and hosting logs. A country hint from our hosting provider may set your initial US or UK market.
Stripe handles payment card information through its hosted checkout. StoryMello does not store your full payment card number.
2. How we use information
We use your information to save and recover your draft, create and revise your storybook, send proofs, process payment, print and deliver your book, answer support requests, prevent misuse, and meet legal and accounting obligations.
Where UK data protection law applies, relevant legal bases include performing our contract with you, meeting legal obligations, and legitimate interests in operating a secure service and supporting orders. Processing information about other people, including children, requires an appropriate basis too; permission to submit a photo does not remove their privacy rights.
3. Children’s information and photos
The ordering service is intended for adults. Only provide a child’s information if you are their parent or guardian or have appropriate permission. Share only what is needed to make the book; reference photos are optional and descriptions can be used instead.
Uploaded photos are stored in private storage with access controls. We resize and normalize uploaded images and remove embedded metadata from the stored copy. Photos are not stored in the browser’s recoverable text draft.
4. Service providers and sharing
We use Vercel for hosting, Supabase for private draft storage, photos, and anonymous sessions, Stripe for payments, and Resend for order, application, and account emails. Automated notifications do not include children’s photos or story personalization. Authorized people and providers involved in creating, communicating about, printing, or delivering your order receive the information needed for their role.
Information may also be disclosed where required by law or needed to address fraud or security incidents. We do not sell your personal information. Our site does not include advertising SDKs. Providers may process information outside your country; applicable transfer safeguards depend on the provider arrangements and relevant law.
When you use a school or childcare partner code, we record the organization associated with your purchase. Partners see funds raised and anonymous purchase details, such as book format, eligible amount, date, and earnings status. They do not receive customer or child names, email addresses, shipping addresses, photos, or personalization details.
5. Cookies and browser storage
A market preference cookie remembers your US or UK selection for up to one year. When connected, authentication cookies maintain an anonymous session so you can access your own drafts and photos without a customer login.
Separate authentication cookies keep partners signed in to their portal. A promotional code from a shared link is remembered in browser session storage until removed or that browser session ends. Once checkout begins, the applied offer and partner attribution are stored with the order.
Your browser stores a recoverable text draft for up to seven days after your last edit. The app discards expired drafts when it checks for recovery and clears the local draft after verified payment. Local draft storage is not encrypted by the app, so take care on shared devices.
You can clear cookies and local storage through your browser settings, but doing so may remove access to your draft.
We automatically count clicks on selected buttons on the homepage, book creation pages, and review page. A random browser identifier lets us count each button only once per visitor. The identifier is stored in a cookie for up to one year. We do not include names, email addresses, photos, story text, draft identifiers, or full page URLs in these analytics records. We use Supabase to store the button identifier and first-click date. Click records have no automatic expiry schedule. We do not track the partner portal. There is no analytics consent banner or preference control. You can block cookies through your browser settings or contact us about these records. Clearing cookies does not erase previously collected click records. We honor browser Do Not Track and Global Privacy Control signals for this tracking.
We also use Vercel Web Analytics to understand visits to public pages and Vercel Speed Insights to measure loading speed and responsiveness. These services do not use cookies for tracking. We exclude admin and partner pages and remove query strings and URL fragments from reported page addresses. We do not send children’s information, photos, story text, or form contents to these services. We honor browser Do Not Track and Global Privacy Control signals for this collection.
6. Retention and security
The seven-day browser recovery period does not delete cloud drafts or uploaded photos. Cloud records are not currently removed by an automatic expiry schedule. Order information may also be retained for fulfillment, support, accounting, and legal obligations. Contact us to ask about retention or request deletion.
We use private photo storage, authenticated access, and restrictions on draft and order access. No storage or transmission method can guarantee complete security. Anyone with access to your active browser session may be able to access your draft.
7. Your choices and rights
You can edit a draft and remove its photos before checkout locks it. You can ask us to access, correct, or delete personal information, including information about a child you are authorized to represent. Depending on your location, you may also have rights to portability, restrict processing, object to certain uses, or withdraw consent where consent is the basis for processing.
We may need to verify your identity and authority before acting. Some records may need to be kept to meet legal obligations, and deletion during fulfillment may prevent us from completing your book. You may complain to your local data protection authority; in the UK this is the Information Commissioner’s Office.
For questions or requests, email contact@storymello.com. If your request concerns an order, include your order reference, but do not email payment card details.
8. Policy updates
We may update this policy when our service or information practices change. The date above identifies the latest revision.