Privacy Policy
Last updated: 9 September 2026
This policy explains how Sleepy Stories collects and uses your personal data when you use sleepystories.uk, in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Who is responsible for your data
The data controller is Flavio Gheri, an individual entrepreneur (micro-entrepreneur) registered in France under SIRET 10964230600012, trading as "Sleepy Stories", address Cami del pendut, 31320 Pechbusque, France, contactable at lucy@sleepystories.uk.
2. What we collect
- Account data: your name and email address.
- Book content you provide: the child's drawing you upload and the details you enter (such as the recipient's name and story preferences).
- Order & delivery data: shipping address, phone number, and order history. Card details are handled by Stripe — we never see or store your full card number.
- Technical data: basic usage and device information, and cookies (see section 8).
3. How we use it, and our legal bases
- To create, print and deliver your book, and to run your account — performance of our contract with you (GDPR Art. 6(1)(b)).
- To take payment and meet accounting/tax obligations — legal obligation and contract (Art. 6(1)(b)–(c)).
- To keep the service secure and improve it — our legitimate interests (Art. 6(1)(f)).
- For any marketing or non-essential cookies — your consent(Art. 6(1)(a)), which you can withdraw at any time.
4. AI processing of your drawing
To generate your book's story and illustrations, the drawing you upload and the details you provide are sent to our generative-AI provider for processing. This is necessary to create the book you ask us to make. See our Terms of Service for more on how AI is used.
5. Who we share data with
We do not sell your data. We share it only with the service providers we rely on to run Sleepy Stories, each acting on our instructions:
- Stripe — payment processing.
- Lulu — printing and shipping your book (receives your delivery details).
- Google (Gemini) — generating the AI story and illustrations.
- Supabase — accounts, database and file storage.
- Vercel — website hosting.
- Resend — sending order and account emails.
- Pinterest — advertising and measurement (only with your cookie consent).
6. International transfers
Some of these providers are based outside the European Economic Area (for example in the United States). Where data is transferred outside the EEA, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.
7. How long we keep it
We keep your account and book data for as long as your account is active or as needed to provide the service, and order/invoice records for as long as tax and accounting law requires. You can ask us to delete your data (see section 9), subject to those legal retention rules.
8. Cookies
We use cookies that are strictly necessary for the site to work. Any non-essential cookies — such as those used for advertising or measurement — are only set with your consent, which you can give or refuse and change at any time.
9. Your rights
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. To exercise these rights, email lucy@sleepystories.uk. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).
10. Children's data
Sleepy Stories is bought by adults. Any information about a child — such as their drawing or first name — is provided to us by a parent or guardian, who confirms they have the authority to share it for the purpose of creating the book.
11. Changes and contact
We may update this policy from time to time; the current version is always published here. For any privacy question, contact lucy@sleepystories.uk.