1. Who we are
MyMagicalStory ("we", "our", "us") is a family-run Australian business that creates personalised children's storybooks. We serve customers in Australia, the United States, the United Kingdom, New Zealand and Canada. This policy explains what information we collect, why, and the choices you have. For anything privacy-related, contact us at info@mymagicalstory.com.au.
2. Photos of your child
Photos are the heart of our service, so they get the strictest treatment:
- Used only to make your books. Uploaded photos are used to create your characters and illustrate your stories — nothing else.
- Never used for advertising, and never used to train AI models — not by us, and our technology providers process them only to deliver our service.
- Never sold or shared except with the service providers listed in section 5, strictly to operate the service.
- You can delete them at any time. Deleting a character or photo from your account removes it from our active systems.
- Uploaded with consent. By uploading a photo of a child, you confirm you are that child's parent or guardian, or have their parent's or guardian's permission.
3. What we collect
- Account details: name, email address and password (passwords are stored only as secure hashes by our authentication provider).
- Book content: the photos, names, ages and story details you provide, and the stories and illustrations we create from them.
- Payment details: handled entirely by Stripe — we never see or store your card number. We keep records of your orders and subscription status.
- Shipping address: for delivering printed books.
- Usage information: device and browser information, pages visited and actions taken (via Google Analytics), plus error logs that help us fix problems. A small cookie also remembers which country's store you chose.
- Support messages: anything you send us when you get in touch.
4. How we use it
- Creating your personalised stories and illustrations, and printing and delivering your books
- Processing payments, subscriptions and refunds
- Keeping your digital library available to you
- Sending service emails — order confirmations, delivery updates, account notices
- Answering support requests
- Understanding aggregate usage so we can improve the service (we do not use your photos or story content for this)
- Keeping the platform secure and preventing fraud
- Meeting our legal obligations (for example, tax and consumer-law record keeping)
5. Service providers we share data with
We don't sell or rent personal information. We share it only with the providers that make the service work, each limited to its purpose:
- Supabase — secure database, authentication and photo/book storage
- Google — the technology that generates your stories and illustrations, and site analytics
- Stripe — payment and subscription processing
- CloudPrinter — printing and delivering physical books (receives your name, shipping address and the book files)
- Cloudinary — image handling
- Resend — sending service emails
- Vercel & Render — hosting the website and its systems
We may also disclose information where the law requires it, or to protect our users or the public.
6. Where your data lives & how long we keep it
Our providers operate internationally, so your information may be processed outside your country (including in the United States). We choose reputable providers with strong security practices and contractual data protections.
- Photos, characters and stories: kept while your account is active, or until you delete them — whichever comes first.
- Account data: deleted when you close your account, except where we must keep records.
- Order and payment records: kept as required by tax and consumer law (generally up to 7 years).
7. Your rights
Wherever you are, you can ask us to access, correct, export or delete your personal information, or close your account — email info@mymagicalstory.com.au and we'll action it promptly. Depending on where you live you may have additional rights: under the Australian Privacy Principles, the UK/EU GDPR (including the right to complain to your local regulator) and US state privacy laws (for the avoidance of doubt: we do not sell personal information). You can also delete photos, characters and stories yourself from your account at any time, and opt out of analytics using your browser's cookie controls.
8. Children
MyMagicalStory accounts are for adults — parents, guardians and gift-givers. We don't knowingly let children create accounts or collect information directly from children. Information about children (their photo, first name and age) is provided to us by their parent or guardian, with consent, solely to create their book. If you believe a child has provided us information directly, contact us and we will delete it.
9. Security
Data is encrypted in transit and at rest, access is limited to what each system needs, payments are handled by PCI-compliant Stripe, and book files are served through expiring, signed links. No system is perfectly secure, but we treat your family's photos with the care we'd want for our own.
10. Changes & contact
If we make material changes to this policy we'll update this page and the date above, and flag significant changes on the site or by email. Questions, requests or complaints:
Email: info@mymagicalstory.com.au