Privacy Policy

Controller and scope

The legal operator identified above will be the controller for Nelly's Hart account, Studio and order processing. Its identity, address and establishment must be confirmed before paid launch. This policy describes the implemented service, not a certification of UK GDPR compliance.

Information we process

Parent account email and authentication records; uploaded photographs and artwork; book layouts, captions and optional names you choose; private project and file identifiers; order references, payment status, totals and school referral codes; support correspondence and technical security/error information. No child's full name, date of birth or school identity is required to create a book. Avoid unnecessary or sensitive details and upload other people's images only when you have authority to do so.

Purposes and proposed lawful bases

Providing parent accounts, saving projects and supplying downloads is intended to rely on contractual necessity for the parent relationship. Payment and tax records may be required by legal obligation. Proportionate account security and support may rely on legitimate interests following a documented assessment. Processing identifiable children or other people in photos needs a separately assessed lawful basis; a parent's contract is not automatically the lawful basis for every depicted person. Optional referral-code persistence is consent-controlled. The operator must confirm these assessments, and any special-category data conditions, before launch.

Children's content and AI

Parents or guardians control uploads, accounts and purchases, with two-step sign-in before checkout. Project and photo storage is private by default; schools receive fundraising information, not family photos or book contents. The implemented Studio and PDF export do not send uploaded customer content to an AI model. No customer content is used by this application for marketing or AI training. Future changes would require fresh assessment, clear notice and any necessary separate consent.

Service providers and recipients

Lovable Cloud provides authentication, database and private file storage, with the underlying hosting and subprocessor chain subject to the operator's contract review. Stripe processes payments and receives payment details, parent email, order references and purchase information; this application does not receive complete card details. Google Fonts receives font requests and related network information. Hosting and security/error services may receive technical request data. Etsy handles separate physical purchases. Our printing partner receives only content and order information necessary for a verified physical order; there is no direct printing API in this site. Schools receive only the information needed for attributed contribution accounting.

The operator must verify and document processor/controller roles, data processing agreements and subprocessors. Confidential commercial supplier names are not displayed here, but confidentiality does not override required transparency or rights to recipient information; request further information by email.

International transfers and security

We do not claim UK-only hosting, certified security or a verified hosting region. The operator must identify processing countries and verify applicable adequacy decisions, UK IDTA or UK Addendum and transfer risk assessments before launch. Controls implemented include parent-specific storage access, restricted owner roles, two-step checkout and signed payment verification. These controls reduce risk but do not guarantee absolute security; authenticated access and provider contractual safeguards still require final verification.

Retention and unfinished books

Online source photos are scheduled for deletion after 30 days by a daily cleanup task. The Studio warns when seven days or fewer remain. Photos tied to a pending payment are temporarily protected for up to 24 hours from order creation, or for 48 hours after payment while files are prepared. This is not indefinite production retention. Unfinished layouts may remain, but expired source photos are removed or unavailable, leaving missing images; buy, generate and save your PDF before expiry.

Purchased PDFs are retained for repeat downloads, including the photos flattened into those files. There is currently no automatic PDF, layout, account or order-record deletion period. The operator must document appropriate account, purchase, support, accounting and backup retention periods. Local IndexedDB copies stay on your device and are checked for photo expiry when a book is opened; clear site data to remove local copies sooner. Cloud deletion does not erase your own downloaded files. Backup retention and restoration handling have not been verified, so immediate deletion from every backup is not promised.

Your rights and deletion requests

Subject to UK GDPR conditions, individuals may request access, correction, erasure, restriction, portability or object to processing. Where consent is used, it can be withdrawn without affecting prior lawful processing. Email a request and we will verify identity proportionately and normally respond within one month; lawful extensions and record-retention exceptions may apply. Ask for deletion of photos, projects or an account, identifying relevant book references without emailing children's images. You can delete a project in the Studio and clear local site data; operational follow-through and paid-record exceptions require review. There is no automated account-erasure tool.

Complaints and incidents

Contact us first if you wish, or complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. The operator must adopt the prepared incident-response draft: contain and investigate incidents, assess risks, record decisions, notify the ICO without undue delay and within 72 hours of awareness where required, and notify affected individuals without undue delay where high risk requires it. ICO fee registration or exemption and DPIA approval have not been confirmed.