Privacy
Effective from 13 October 2026
This page explains what we collect when you make a book with minibooks, why, who helps us, how long we keep it and how to get it deleted. We wrote it to be read, not skimmed past.
Who looks after your data
Marek Wituszyński, Tąpadła 50, 58-111 Tąpadła, Poland, tax id (NIP) 8942767220, REGON 381219039, is responsible for your data (the "controller"). We are reachable by email: write to orders@minibooks.ai about anything on this page.
The short version
- A photo of your child is optional. It is used only to draw the portrait and is deleted as soon as you approve the portrait, or within about a day if you don’t.
- We sell books, not data. We don’t sell your data to anyone.
- There is no password. Your email address is how we send your books and how you open them later.
- You can delete a book, or everything we hold about you, on your shelf at any time.
- We measure our ads without tracking pixels or ad cookies on your device, but we do tell Meta (Facebook, Instagram) about a few steps, as explained below.
What we collect and why
Each item says why we need it and on what legal basis:
- Your email address: to send you the free Preview, the finished book, sign-in links and payment emails. Basis: our contract with you.
- What you tell us about each hero, often your child: name, age, a few words about how they look, and optionally a photo. Also the story idea, the reader’s age range and an optional dedication. We use these to write and illustrate the book. Basis: our contract with you, and our legitimate interest in making the book you ordered for the child.
- The book itself: the story, the portraits and pictures, and the PDF, plus a share link if you turn one on. We keep it so you can read, download and share it. Basis: our contract with you.
- Payment details: the amount, currency, time and status of your payment, where the visit that led to it came from, and your email. Card and bank details go straight to Stripe; we never see them. Basis: our legal duty to keep accounting and tax records, and our legitimate interest in handling claims.
- Reminders about a Preview you left unpaid. Basis: our legitimate interest; you can object at any time with the stop link in the reminder.
- News and offers by email. Basis: your consent, which you can withdraw at any time.
- Emails you send us, including complaints. Basis: our contract with you, and our legitimate interest in answering and keeping a record.
- Technical data: your IP address and a random id stored in a cookie, to keep free Previews fair (a few per person per day) and stop abuse. We store the IP address for this only as a scrambled (salted hash) value, never in plain form. Basis: our legitimate interest in preventing abuse.
- Where you came from and how far you got: if you arrive from an ad or a link, we keep its source and campaign tags, the site that sent you and Facebook’s click id, and we record which steps you reached (hero, portrait, Preview, payment page, payment). These records hold your email once you give it, the cookie id and the scrambled IP address. Basis: our legitimate interest in knowing which ads and posts work.
Your child’s photo
Adding a photo is optional; a short description always works too. If you add one, your browser shrinks it before upload. On its way it passes through our hosting provider Vercel in the United States, and we keep it in private storage in the EU (Frankfurt, Germany) that nobody can open from the internet.
To draw the portrait, we give the photo to our image service kie.ai through a private link that works for 10 minutes. kie.ai runs Google’s Nano Banana image model. The photo goes only there; our backup image service never gets it.
We delete the photo as soon as you approve a portrait. If you never approve one, we delete it within about a day. What we keep is the illustrated portrait, not the photo.
We don’t use photos to train any model. We can’t promise how kie.ai or Google handle images on their side beyond their own terms, which is one more reason the photo is optional.
Who helps us
We use a few companies to run minibooks. Each gets only what its job needs:
- Supabase: our database and the private photo storage, in the EU (Frankfurt, Germany).
- Cloudflare: stores the book pictures and PDFs (Western Europe) and serves them from media.minibooks.ai, and forwards email sent to our address. Pictures and PDFs sit at long random addresses nobody can guess, but anyone who has such an address can open it.
- Vercel (servers in the United States): hosts and runs the website. Like any web host it logs requests, including your IP address, and keeps those logs for the time its own terms set.
- Anthropic (Claude): writes the story and checks the story idea. It gets the hero descriptions, the story idea and the dedication, never the photo.
- kie.ai, run by NEXUSAI SERVICES LLC (Denver, Colorado, USA) together with INNOLEAP AI LLC: draws the portraits and pictures with Google’s Nano Banana model. It gets the drawing instructions, the photo (for the portrait only) and the approved portraits.
- fal.ai: our backup image service, used only when kie.ai fails. It gets the drawing instructions and the approved portraits, never the photo.
- Stripe: takes your payment (card, BLIK, Przelewy24, wallets, Link, Klarna and other methods, depending on your country). It gets your email address and keeps its own payment records.
- Resend: sends our emails (EU).
- Google (Gmail): our email inbox. Mail you send to orders@minibooks.ai is forwarded there by Cloudflare.
- Meta: receives the ad measurement data described below.
Ad measurement with Meta
We advertise on Facebook and Instagram. To know whether those ads work, our server tells Meta Platforms Ireland Ltd. (through its Conversions API) when someone gets a Preview, opens the payment page or buys a book. Nothing is sent from your browser and we don’t use Meta’s pixel or ad cookies.
With each of these events we send: your email address and our cookie id, both scrambled (hashed) first; your IP address and browser type (user agent); Facebook’s click id if you came from an ad; and, for a payment, its amount and currency. We never send your child’s details, the story or the photo.
We do this on the basis of our legitimate interest in measuring and improving our ads. Meta handles this data under its own privacy policy. You can object at any time, and we stop sending your events: write to us at orders@minibooks.ai.
To keep your objection, even after you delete your data, we keep only a scrambled (hashed) copy of your email address, never the address itself.
Your IP address and browser type are kept for this only until the event is sent: usually minutes, at most about two days.
Emails we send
Emails about your book always come: the Preview, a payment confirmation with these terms attached, the finished book, sign-in links, refunds.
If you leave a Preview unpaid, we may send up to two reminders about it, each with a link to stop them. If you agreed to news and offers, the second one may include a discount.
News and offers come only if you tick the box on your shelf. You can untick it there, or use the unsubscribe link in any such email.
How long we keep things
- Your child’s photo: until you approve the portrait, at most about a day.
- Your paid books, their heroes and your email address: until you delete them on your shelf, or ask us to. Unpaid Previews and drafts: deleted about 6 months after they were last created, generated or taken to checkout.
- Records used for free-Preview limits (email, cookie id, scrambled IP): 48 hours.
- Sign-in links: 30 minutes (72 hours for the one in the “book ready” email). Shelf sessions: 30 days.
- Records of which steps each visitor reached and where they came from (email, cookie id, scrambled IP address): 13 months.
- Vercel’s request logs (including IP addresses): as long as Vercel keeps them under its terms.
- IP address and browser type for Meta: until sent, at most about two days.
- Your objection to ad measurement: a hashed copy of your email, until you ask us to withdraw it.
- Payment records, including where the visit that led to the payment came from: as long as accounting and tax law requires, and as long as a claim is possible. If you delete everything, we remove your email from them but keep the amount, date, status and source. Stripe keeps its own records under its own terms.
Data outside the EU
Some of our providers process data outside the European Economic Area, mostly in the United States: Vercel (where every request, your photo included, passes through), Anthropic, fal.ai, Stripe, Google and Meta. For these transfers we rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses in each provider’s terms.
Three keep our data in the EU but are companies based outside it, so their staff may reach it from there: Cloudflare (Cloudflare, Inc., USA) and Resend (Plus Five Five, Inc., USA), both with the EU-US Data Privacy Framework and the EU Standard Contractual Clauses in their data processing agreements, and Supabase (Supabase Pte. Ltd, Singapore), with the EU Standard Contractual Clauses in its data processing agreement.
kie.ai (USA) names neither safeguard in its terms. Your child’s photo goes there only if you choose to add one, and we can’t promise more than kie.ai’s own terms.
Your rights
You can ask us to show you your data, correct it, delete it, limit how we use it or give it to you in a portable file. You can object to uses based on our legitimate interest, such as ad measurement, and withdraw any consent at any time.
The quickest way to delete is on your shelf: one book, or everything. For anything else, write to us; we answer within a month.
We make no decisions about you by automated means that have legal or similarly significant effects.
You can also complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO, uodo.gov.pl).
Children
minibooks is for adults. Children don’t use it themselves: a parent or another adult makes the book and tells us about the child. Please add a child’s photo or details only if you are their parent or guardian or have their permission.
Changes
If we change how we handle data, we update this page and the date at the top. For bigger changes we will also tell you by email.