Privacy Policy

1. Who we are

DreamsComeTrue(“we”, “us”, “our”) operates the website at dreamscometrue.aiand creates personalised children’s books. We are the data controller for personal data processed through the service.

Registered address: [ADD: registered company address — e.g. country of incorporation]. For any privacy question or data-subject request, contact us at hello@dreamscometrue.ai.

2. What we collect

We collect only what we need to create and deliver your book.

• Account data: email address, optional name, authentication tokens (when you sign in with Google we receive your Google account email; we do not receive your Google password).
• Child profile data you provide:the child’s first name, age, gender (optional), and any reference photos you upload. We treat this as sensitive and apply extra care.
• Order data: shipping name and address, phone number (when provided for delivery), book selections, language, format.
• Payment data: processed by Stripe. We never see or store full card numbers. We retain only the last four digits, brand, and a transaction ID for reconciliation and refunds.
• Usage data: log files, IP address, browser type, pages viewed, timestamps. Used for security and debugging.
• Analytics and advertising cookies:only with your consent. See “Cookies” below.

3. How we use it

• To create your personalised book (the core service).
• To process payment, print, and ship your order.
• To send transactional emails — order confirmations, shipping updates, reminders about unfinished books.
• To improve the product (debugging, anonymous analytics where you have consented).
• To run advertising and measure its performance, only with your consent.
• To comply with legal obligations (accounting, tax, responding to lawful requests).

4. Lawful basis (GDPR)

We rely on the following lawful bases under GDPR Article 6:

• Contract — to create, print, and ship the book you ordered.
• Legitimate interest— security, fraud prevention, basic service analytics, sending you reminders about a book you started but didn’t finish.
• Consent — analytics and advertising cookies, marketing emails beyond transactional ones. You can withdraw consent any time.
• Legal obligation — tax records, responding to regulatory requests.

5. Children’s data

Our service creates books for children, but the account holder must be an adult (18+) acting on behalf of the child. Children should not create accounts or place orders directly.

Child information you provide (name, age, photos) is used only to generate the book’s text and illustrations. We do not use it for advertising, profiling, or any purpose unrelated to producing the book you ordered. Reference photos are stored only as long as needed to complete and reprint the book.

6. Sharing — who processes your data

We share data only with vetted processors who help us deliver the service. Each is bound by a data-processing agreement.

• Stripe — payment processing (stripe.com).
• Gelato — printing and worldwide shipping of physical books (gelato.com).
• Google— sign-in (where used), and Gemini image-generation models used to render illustrations. Reference photos are sent to Google’s Gemini API as part of generating the book.
• Cloudflare R2 — object storage for generated illustrations and book PDFs.
• Resend — transactional email delivery.
• Railway — application hosting and database.
• Analytics & ad platforms — Google Analytics, Google Tag Manager, Meta, TikTok, when you have given consent.

Some of these processors operate outside your country. International transfers rely on Standard Contractual Clauses (EU/UK) or equivalent safeguards.

We do not sell your personal data. We do not share data with advertisers except via the consent-based pixels listed above.

7. How long we keep it

• Account data: until you ask us to delete it, or 3 years of inactivity (whichever is sooner).
• Order & payment records: 7 years for tax/accounting purposes (statutory retention).
• Reference photos: retained for 60 days after the order is marked complete so you can request edits, support, or reorder without re-uploading. Deleted automatically after that, unless you ask us to keep them longer.
• Marketing analytics cookies: 13 months maximum, in line with CNIL/ICO guidance.

8. Your rights

Under GDPR, UK GDPR, and similar laws, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”), subject to our legal retention obligations.
• Restrict or object to processing.
• Receive your data in a portable format and transmit it to another controller.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@dreamscometrue.ai. We respond within 30 days.

9. Cookies

We use a small number of cookies, grouped into three categories:

• Essential — needed for sign-in, the checkout, and to remember your cookie preferences. Cannot be disabled.
• Analytics — Google Analytics, Microsoft Clarity. Help us understand what works and where users get stuck. Off by default; on only with consent.
• Advertising — Meta Pixel, TikTok Pixel, Google Ads. Let us measure ad performance and show relevant ads. Off by default; on only with consent.

You can change your choice any time by clearing the consent cookie (named dct-consent-v1) — the banner will reappear on your next visit.

10. Security

We protect your data with HTTPS in transit, encrypted storage at rest, strict access controls, and regular security review. No system is perfectly secure; if a breach occurs that affects you, we will notify you and the relevant regulator without undue delay, as required by law.

11. Changes to this policy

We may update this policy as the service evolves. The “Last updated” date at the top reflects the most recent change. Material changes will be notified by email or a prominent banner.

12. Contact

Privacy questions, data-subject requests, or anything else: hello@dreamscometrue.ai.