Privacy Policy
May 26, 2026
At Looma Stories, protecting your personal data is a priority. This policy describes the data we collect, how we use it, and the rights you have under the General Data Protection Regulation (GDPR).
1. Data Controller
The data controller for your personal data is:
- Company name: [COMPANY_NAME]
- Address: [ADDRESS]
- SIRET: [SIRET]
- Contact: [email protected]
2. Personal Data We Collect
2.1 Data you provide directly
- Account data: name, email address, password (encrypted)
- Order data: billing and delivery addresses
- Personalisation data: character names, narrative choices, text instructions
- Uploaded images: photos processed by our technology to generate character references, book illustrations, previews, and any regeneration requests you make
- Communication data: information exchanged when you contact our customer support team
- Payment data: processed by our secure payment provider; we only receive a transaction confirmation
2.2 Data collected automatically
- Technical data: IP address, browser type, operating system
- Usage data: pages visited, browsing behaviour, visit duration
3. Purposes of Processing
Your personal data is processed for the following purposes:
- Creating and managing your user account
- Processing, producing, and managing your orders
- Generating personalised books using our artificial intelligence technology
- Allowing you to preview, edit, regenerate, finalise, and order your personalised book
- Verifying the compliance of submitted content
- Shipping physical products and making digital versions available
- Communications relating to your orders and customer support
- Improving our products and services
- Analysing website usage
- Complying with our legal obligations
- Preventing fraud and abuse
4. Legal Bases for Processing
In accordance with Article 6 of the GDPR, we process your data on the following legal bases:
- Performance of a contract (Art. 6(1)(b)): order processing, product delivery, account management
- Consent (Art. 6(1)(a)): use of your photos and personalisation data to create your book; you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal
- Legal obligation (Art. 6(1)(c)): administrative and tax obligations
- Legitimate interest (Art. 6(1)(f)): fraud prevention and service improvement
5. Sharing Data with Third Parties
We never sell your personal data. Sharing is strictly limited to what is necessary to provide our services, and each service provider is bound by a data processing agreement (DPA):
- Secure payment provider
- Printing and shipping partners
- IT hosting providers
- Artificial intelligence technology providers
- Website analytics services
- Competent authorities, where required by law
6. International Transfers
Your data is hosted on servers located in Europe. Where processing requires a transfer outside the European Economic Area, such transfer is governed by standard contractual clauses approved by the European Commission or by the EU-US Data Privacy Framework.
7. Data Retention Periods
- Account data: for as long as your account remains active, or until you request deletion
- Order and billing data: a minimum of 7 years (tax obligations)
- Personalisation data (photos, generated character references, illustrations, story content): kept only for the time needed to create, edit, deliver, and support your book, and deleted no later than 10 weeks after creation
- Communication data: up to 2 years after your enquiry has been resolved
9. Data Security
We implement appropriate technical and organisational measures to protect your data:
- SSL/TLS encryption for all data transfers
- Hosting on secure servers in Europe
- Strict access controls
- Regular security updates
No data transmission over the Internet can be guaranteed to be completely secure. In the event of a data breach, we will notify you in accordance with our legal obligations.
10. Your Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15): obtain a copy of your personal data
- Right to rectification (Art. 16): correct inaccurate data
- Right to erasure (Art. 17): request deletion of your data, subject to our legal obligations
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20): receive your data in a structured format
- Right to object (Art. 21): object to the processing of your data
- Right not to be subject to automated decision-making (Art. 22)
To exercise these rights, please contact us at [email protected]. We will respond within one month, which may be extended by a further two months for complex requests.
You also have the right to lodge a complaint with a supervisory authority, such as the CNIL (Commission Nationale de l'Informatique et des Libertés) or any other competent data protection authority.
11. Artificial Intelligence and Image Processing
By uploading images to our platform, you expressly authorise us to process them through our artificial intelligence systems in order to generate the illustrations for your personalised book.
Your uploaded photos are used to create and review your personalised book. They are not used for general marketing, public galleries, or artificial intelligence model training unless you give a separate explicit authorisation.
Photos and generated personalisation assets are retained only according to Section 7, so you can preview, edit, regenerate images, download your digital book, and, if you choose, order a printed copy.
12. Children's Data
Our products are designed for children but are ordered by adults. We do not knowingly collect data directly from children without parental consent. Children's data (first name, appearance via photo) is processed solely for the purpose of product personalisation, on the basis of consent given by the adult placing the order.
The adult placing the order is responsible for ensuring they have the necessary authority to provide the child's information and images.
13. Changes to This Policy
We reserve the right to amend this privacy policy. In the event of a material change, we will notify you by email or through a prominent notice on our website.
14. Contact
For any questions regarding this policy or your personal data, please contact us at [email protected].