1. Who We Are

This Privacy Policy explains how Personalized Story Group Inc., a Delaware corporation doing business as Story Bug (“Story Bug,” “we,” “us,” or “our”), collects, uses, discloses, stores, and protects personal information when you visit storybug.com or a localized version of our website, create an account, communicate with us, or purchase or use our products and services (collectively, the “Services”).

For purposes of applicable data protection law, Personalized Story Group Inc. is generally the controller or business responsible for the personal information described in this Policy.

Our online store is hosted on Shopify. Shopify processes certain personal information to provide the ecommerce platform and related services. Shopify’s own privacy notices may also apply to its independent processing activities.

2. Scope

This Policy applies to personal information collected through the Services, including information used to create personalized books and other products. It does not apply to a third party’s website, product, or service that has its own privacy policy.

Additional notices may be provided at the time information is collected. If an additional notice conflicts with this Policy, the additional notice will apply to the specific processing it describes.

3. Personal Information We Collect

The personal information we collect depends on how you interact with us and may include:

·         Identity and contact information, such as your name, email address, telephone number, billing address, shipping address, and account details;

·         Order and transaction information, such as products purchased, personalization selections, order history, delivery information, discounts, refunds, and payment status;

·         Payment information processed by Shopify or other payment providers. We generally receive transaction details and limited payment information rather than complete payment-card numbers;

·         Personalization information, such as a recipient’s name, age or age range, pronouns, interests, relationships, dedication text, and other details you choose to provide;

·         Uploaded content, including photographs and other images;

·         Generated content, including personalized previews, illustrations, avatars, production files, and other artwork derived from uploaded content (“Generated Artwork”);

·         Communications and customer-support information, including messages, feedback, reviews, and information supplied for corrections, replacements, or refunds;

·         Device, usage, and online activity information, such as IP address, browser type, device identifiers, operating system, pages viewed, referring URLs, interactions, approximate location, and cookie or advertising identifiers;

·         Marketing preferences, consent records, and responses to promotions or surveys; and

·         Fraud-prevention, security, and compliance information.

4. Children’s Personal Information

Story Bug products are often created for children, but the Services and purchasing process are intended for adults. We do not knowingly allow children under 13 to create accounts or place orders directly.

A photograph or personalization information provided by an adult may relate to a child. By submitting that information, you confirm that you are the child’s parent or legal guardian, or that you have permission from the child’s parent or legal guardian, and that you have authority to provide the information for the purposes described in this Policy.

Do not submit a child’s information if you do not have the required authority. A parent or legal guardian may contact us to request access to, correction of, or deletion of eligible information relating to their child.

5. How We Collect Personal Information

We collect personal information:

·         directly from you when you use the Services, place an order, upload a photograph, create an account, contact us, subscribe to marketing, or participate in a promotion;

·         automatically through cookies, pixels, local storage, server logs, and similar technologies;

·         from service providers and business partners, including Shopify, payment providers, fraud-prevention services, analytics providers, advertising partners, printers, fulfillment providers, and delivery carriers;

·         from another person who purchases a product for you or submits information with appropriate authority; and

·         from public sources where permitted by law.

6. How We Use Personal Information

We may use personal information to:

·         provide, operate, maintain, and improve the Services;

·         create and display personalized previews and Generated Artwork;

·         manufacture, fulfill, ship, and deliver orders;

·         process payments, discounts, refunds, replacements, and reprints;

·         manage accounts and maintain order history;

·         communicate about orders, deliveries, service changes, and customer-support matters;

·         authenticate users and protect accounts;

·         detect, investigate, and prevent fraud, abuse, security incidents, prohibited content, and unlawful activity;

·         analyze performance and improve our products, Website, customer experience, and business operations;

·         send marketing communications where permitted and manage marketing preferences;

·         administer our email and mobile messaging programs, maintain consent and opt-out records, and send promotional communications where permitted by law;

·         provide optional personalized marketing where you have given any consent required by law;

·         comply with legal obligations and respond to lawful requests; and

·         establish, exercise, or defend legal claims.

7. Photograph and Image Processing

When you use a photo-enabled product, we process the photograph and related personalization information to create previews, illustrations, avatars, and other Generated Artwork. This processing may include automated image analysis and transformation.

We use contracted technology providers to assist with image processing. These providers process uploaded content on our behalf under contractual confidentiality, security, and data-processing requirements. We do not identify individual technology providers in this Policy because providers may change, but further information about relevant categories of recipients is available on request where required by law.

Story Bug does not authorize its contracted image-processing providers to use Customer Content submitted through the Services to train or improve their general-purpose or foundation artificial intelligence models.

We do not use uploaded photographs or Generated Artwork to make decisions that produce legal or similarly significant effects about an individual.

8. Generated Artwork

Generated Artwork may remain personal information if a person can be identified from it. Deleting an original photograph does not automatically make related Generated Artwork anonymous or remove it from every production file, order record, or secured backup.

We may retain Generated Artwork separately from the original photograph for customer support, quality review, corrections, replacements, reprints, order history, fraud prevention, and legal compliance, subject to the retention periods below.

We do not sell uploaded photographs or Generated Artwork, and we do not disclose them for cross-context behavioral advertising.

9. Personalized Marketing and Publicity

We may use order information, browsing activity, and marketing preferences to recommend products or personalize communications as permitted by law.

We will not use an uploaded photograph or a person’s identifiable likeness in public advertising, social media posts, product examples, testimonials, or marketing directed to other customers unless we have obtained separate permission.

If we offer an optional feature that uses an uploaded photograph or Generated Artwork to create marketing shown or sent only to you, we will explain the use and obtain any consent required by law. Declining or withdrawing that consent will not prevent you from purchasing a personalized product.

Consent may be withdrawn by contacting us at hello@storybug.com or through any withdrawal method provided when consent is requested. Withdrawal does not affect processing that occurred before consent was withdrawn.

10. Legal Bases for Processing

Where the European Union General Data Protection Regulation, UK GDPR, or similar law applies, our legal bases may include:

·         Contract: processing necessary to take steps at your request, create the selected personalized product, and perform our contract with you;

·         Legitimate interests: operating and improving our Services, providing customer support, securing our systems, preventing fraud, understanding business performance, and establishing or defending legal claims, where those interests are not overridden by individual rights;

·         Consent: optional marketing, certain cookies and tracking technologies, and other processing where consent is requested; and

·         Legal obligation: processing necessary to comply with applicable law, tax, accounting, regulatory, and lawful government requirements.

You may withdraw consent at any time. Where we rely on legitimate interests, you may have the right to object to the processing.

11. How We Disclose Personal Information

We may disclose personal information to:

·         Shopify and ecommerce-platform providers;

·         payment processors and financial institutions;

·         cloud hosting, database, storage, security, and technical-service providers;

·         contracted image-processing and personalization providers;

·         printers, manufacturers, fulfillment partners, delivery carriers, and address-validation providers;

·         customer-support and communication providers;

·         analytics, cookie, advertising, and marketing providers;

·         fraud-prevention and identity-verification providers;

·         professional advisers, auditors, insurers, and financing providers;

·         our affiliates and entities under common control;

·         government authorities, courts, law enforcement, or other parties when required or permitted by law; and

·         a buyer, investor, successor, or adviser in connection with a proposed or completed merger, acquisition, financing, reorganization, insolvency, or sale of assets.

We require service providers acting on our behalf to process personal information for contracted purposes and subject to applicable privacy and security obligations.

We may also disclose information at your direction or with your consent.

12. Cookies, Analytics, and Advertising

We and our providers use cookies, pixels, tags, local storage, and similar technologies to operate the Website, remember preferences, understand Website usage, measure campaign performance, prevent fraud, and provide or measure advertising.

These technologies may collect identifiers, IP address, device information, browser information, Website activity, approximate location, and interactions with advertisements or communications. They do not receive uploaded photographs or Generated Artwork for behavioral advertising.

Where required, non-essential cookies are used only after consent. You can manage available choices through our cookie-preference tool and browser settings. Disabling certain technologies may affect Website functionality.

Some disclosures of identifiers and online activity to advertising partners may be considered a “sale,” “sharing,” or use for targeted advertising under certain U.S. state privacy laws, even when no money is exchanged. Where applicable, you may opt out through our cookie-preference tool or a “Do Not Sell or Share My Personal Information” link made available on the Website. We process recognized browser-based opt-out preference signals where required by applicable law.

13. Marketing Communications

Email marketing. We send promotional emails where permitted by law. You may unsubscribe at any time by clicking the “Unsubscribe” link in a promotional email. We will process your request promptly and within the period required by applicable law.

SMS, MMS, and text-message marketing. If you separately opt in, Story Bug may send recurring promotional SMS, MMS, or other text messages to the mobile telephone number you provide. Consent to receive marketing text messages is optional and is not a condition of purchasing any product or service.

Message frequency may vary. Message and data rates may apply. You may opt out at any time by replying STOP to a marketing message. You may reply HELP for assistance or contact us at hello@storybug.com.

After you opt out, we may send one final message confirming that your request has been processed. We will honor text-message opt-out requests promptly and as required by applicable law.

We may continue to send non-marketing messages that are necessary to provide a service you requested, such as order, delivery, account, or security messages, where permitted by law.

We do not sell mobile telephone numbers or disclose mobile opt-in information, consent records, or text-message originator data to third parties or affiliates for their own marketing or promotional purposes. We may provide this information to service providers that help us deliver messages, but only to provide services on our behalf and subject to appropriate contractual restrictions.

We may retain limited suppression-list information to ensure that email and mobile opt-out requests continue to be respected.

For additional information about the Story Bug messaging program, including eligibility, supported carriers, message frequency, opt-out instructions, and carrier disclaimers, please review our Mobile Terms of Service available on the Website.

14. International Transfers

Story Bug operates internationally and uses providers located in multiple countries. Personal information may be transferred to, stored in, or processed in Australia, Canada, the European Economic Area, New Zealand, the United Kingdom, the United States, and other countries where we or our providers operate.

Those countries may have privacy laws different from the laws where you live. Where required, we use recognized safeguards such as adequacy decisions, approved standard contractual clauses, the UK International Data Transfer Addendum or other lawful transfer mechanisms.

Information about applicable transfer safeguards may be requested by contacting us, subject to appropriate redactions.

15. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, customer support, security, accounting, legal compliance, and dispute resolution.

Unless a longer period is reasonably required:

·         original uploaded photographs are ordinarily deleted within 30 days after the relevant order is fulfilled;

·         temporary image-processing files and unsuccessful generation files are ordinarily deleted within 30 days;

·         Generated Artwork and production-ready files may be retained for up to 24 months after fulfillment to support customer service, corrections, replacements, and reprints;

·         account information is retained while the account remains active and for a reasonable period afterward;

·         customer-support records may generally be retained for up to three years after the matter is closed;

·         transaction, tax, accounting, fraud-prevention, and legal records may generally be retained for up to seven years or for the period required by applicable law; and

·         marketing information is retained until you unsubscribe, withdraw consent where applicable, or the information is no longer required, subject to retention of suppression records.

If you separately authorize another use of a photograph or Generated Artwork, the applicable content may be retained until the earlier of the stated consent period, withdrawal of consent, or the date it is no longer reasonably required.

Deleted information may remain in secured backups for a limited period until those backups are overwritten through our normal backup cycle. During that period, the information is not used for another purpose unless restoration is required for security or disaster recovery.

16. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures may include access controls, encryption in transit, authentication, logging, provider assessments, and incident-response procedures.

No method of transmission or storage is completely secure. You are responsible for protecting account credentials and notifying us if you suspect unauthorized account activity.

If a personal-data breach occurs, we will investigate and provide notifications as required by applicable law.

17. Your Privacy Rights

Depending on where you live and subject to legal exceptions, you may have the right to:

·         know whether we process your personal information and request access to it;

·         request correction of inaccurate personal information;

·         request deletion of eligible personal information;

·         request restriction of processing;

·         object to processing based on legitimate interests or direct marketing;

·         receive certain personal information in a portable format;

·         withdraw consent at any time where processing is based on consent;

·         opt out of targeted advertising or certain sales or sharing of personal information;

·         limit certain uses or disclosures of sensitive personal information, where applicable;

·         appeal a refusal of a privacy request, where applicable; and

·         complain to an applicable privacy or data-protection authority.

You have the right to object at any time to processing for direct-marketing purposes.

To make a request, email hello@storybug.com. Please describe the request and the individual or order concerned. We may verify your identity and, where a request concerns a child, your authority to act for that child. Authorized agents may submit requests where permitted by law, subject to verification of their authority.

We will not discriminate against you for exercising an applicable privacy right. If we deny a request, we will provide an explanation and any available appeal instructions as required by law.

18. Additional U.S. State Disclosures

Residents of California and certain other U.S. states may have additional rights concerning access, correction, deletion, portability, targeted advertising, and the sale or sharing of personal information.

In the preceding 12 months, we may have collected the categories described in Section 3 and disclosed them to the recipient categories described in Section 11 for business purposes. We do not sell uploaded photographs or Generated Artwork. Certain advertising-cookie disclosures involving identifiers and online activity may be treated as sale or sharing under state law, as explained in Section 12.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of children under 16.

Where applicable, requests to opt out may be submitted through the Website’s privacy or cookie controls or by contacting hello@storybug.com.

19. Australia

If the Australian Privacy Act 1988 and Australian Privacy Principles apply, you may request access to or correction of personal information we hold about you and may complain about our handling of personal information by contacting hello@storybug.com.

We will investigate privacy complaints and respond within a reasonable period. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

Personal information may be disclosed to overseas recipients in the countries described in Section 14.

20. European Economic Area and United Kingdom

Individuals in the European Economic Area or United Kingdom may exercise the rights described in Section 17 and may lodge a complaint with the supervisory authority where they live or work, or where an alleged infringement occurred. UK residents may contact the Information Commissioner’s Office at ico.org.uk.

Where legally required, we will provide details of our applicable EU or UK representative through this Policy or in response to a request.

21. Changes to This Policy

We may update this Policy to reflect changes to our practices, Services, or legal obligations. We will post the updated Policy with a revised effective date. If a change is material, we will provide additional notice where required by law.

The Policy in effect when information is processed will govern that processing, subject to applicable law.

22. Contact Us

Personalized Story Group Inc.
Doing business as Story Bug

United States
Email: hello@storybug.com
Website: www.storybug.com