Parent accounts can save family preferences and reading progress. The personalized photo preview still stays on your device; remote photo submission and payment remain disabled.
These translations are provided so families can understand the same rules in their preferred language. Mandatory rights under applicable law always prevail.
1. Controller and scope
Pip & Ponder is the controller for personal data it decides how and why to process. The project is operated from Dubai, United Arab Emirates. This Policy covers this website, digital stories, future orders, subscriptions, support and personalized-book services; a payment or delivery partner may also act as an independent controller for its own regulated activities.
The registered operator name, licence details, postal address and monitored privacy contact are not yet published because checkout is not open. They must be added before we collect orders or receive photographs. This pre-launch gap is stated openly so no one mistakes the current local preview for an active submission service.
2. Parents, children and direct collection
The commercial service is directed to adults, not children. A child must not order, create an account, contact us, or submit personal information. A parent or guardian should control the device and any information entered. If we learn that a child sent information without appropriate adult authority, we will delete it unless law requires a limited record.
For a personalized story, the adult must be entitled to provide information about the child and other identifiable people. We use child-related data only to deliver the family-requested service, never for targeted advertising.
3. What the site processes now
The site may process hosting and security data such as IP address, request time, browser or device details, requested pages and security signals; the language in the page URL; and a consent-choice record in browser storage. If a parent creates an account, we also process the parent’s email address, an optional parent first name, authentication and session records, family reading languages and preferences, an optional child first name, the protected child-PIN digest, completed-story and sticker records, and the parent’s new-story push opt-in. When push is enabled, we store that device’s opaque push endpoint, encryption keys and notification language so the browser can deliver the alert.
Only after an adult opts in, Google Analytics receives basic page-view information such as the requested page, referrer, time, browser/device details, approximate location derived from the IP address, and cookie or session identifiers. We do not send names, email addresses, account IDs, child names, reading progress, stickers, PINs or family preferences to Analytics. The on-page bag, anecdote and personalized photo preview remain temporary browser state and are not uploaded. Selecting a photo does not upload it to Pip & Ponder.
4. What we expect to collect when ordering opens
Before activating checkout or upload, we will update this Policy and the collection notice. Depending on the chosen service, data may include an adult’s name, email, billing and delivery details; order, subscription and support records; a child’s first name, age range, family anecdotes and content choices; up to ten reference photos; consent and permission records; and payment status from a payment provider. We do not intend to store full card numbers.
Please provide only what is needed. Do not send medical records, identity documents, precise location, school details, intimate images or other sensitive data unless we expressly request it for a lawful, necessary purpose and provide an additional notice.
5. Why we process data and our legal bases
We process data only for stated purposes and an available legal basis.
- Contract or steps requested by the adult: create and secure the parent account, sync family preferences, keep reading and sticker progress, prepare a story, fulfil an order, deliver content, manage a subscription and provide support.
- Consent: optional Google Analytics, new-story push notifications, browser preferences and any separate permission to feature family material publicly. Consent can be withdrawn as easily as it is given.
- Legitimate interests: protect the site, prevent fraud, keep minimal business records and improve reliability, balanced against family privacy.
- Legal obligation: accounting, tax, consumer, safety, sanctions, dispute and lawful-authority requirements.
- Vital interests or other lawful grounds only in the rare circumstances permitted by applicable law.
6. Special rules for photographs and children’s stories
Reference photographs and child-related anecdotes will be access-restricted and used only to create, review, deliver and support the ordered book. We will not sell them, use them for behavioural or targeted advertising, publish them, add them to a public portfolio, perform facial recognition, create biometric templates, or train generative-AI models with them unless the adult gives a genuinely optional and separate permission for the specific new use.
Human illustrators or carefully selected production providers may need limited access. They must be bound by confidentiality and data-protection terms. A parent may withdraw permission before illustration work starts. After that point, we may need to retain or complete limited processing to perform the contract, address a dispute or meet law, and we will explain the consequences.
7. Sharing and service providers
We share personal data only as needed with hosting and security providers (currently Cloudflare/OpenAI site infrastructure), Supabase for parent authentication and the account database in the European Economic Area, and Google Analytics for basic site measurement only after consent. Before other services launch, we will name relevant payment, email, illustration, printing, delivery, customer-support and professional providers. We may disclose information to authorities where legally required or to protect a child or another person from serious harm.
Providers may process data only for documented services unless they separately explain an independent legal role. We do not sell personal information and do not share child-related data for cross-context behavioural advertising.
8. International transfers
The site is operated from the UAE and its infrastructure may process information in the United States, European Economic Area and other locations where providers operate. Before order processing begins, we will document applicable transfer safeguards, such as adequacy decisions, contractual clauses or other mechanisms required by UAE, EU/UK and Australian law, and make details available on request.
9. Retention
Parent account preferences, reading progress and stickers are kept while the account remains active and are deleted or de-identified after a verified deletion request, subject to short backup, security and legal-retention windows. Authentication and security logs follow provider security settings and legal need. Consent choices expire after six months; an optional device-only language preference is ignored when consent expires or is withdrawn. Google Analytics user- and event-level retention is configured to two months; aggregated reports may remain available longer.
Before ordering opens, we will publish specific order-retention periods. Our intended rule is to keep reference photos and working files only through production, approval and a short issue-resolution window, then delete or de-identify them; final order, invoice, consent and dispute records will be kept only as required by contract, tax, consumer and limitation laws.
10. Security
We use proportionate technical and organisational safeguards, including HTTPS, Supabase password protection, row-level account ownership controls, salted one-way derivation for the child PIN, limited access, provider controls and data minimisation. The child PIN is not stored in readable form. No internet service can guarantee absolute security. If a breach creates a legally reportable risk, we will notify the relevant authority and affected people as required.
11. Your privacy rights
Depending on your location, you may ask for access, correction, deletion, restriction, portability or a copy of personal data; object to certain processing; withdraw consent; and complain to a regulator. We may need to verify the requesting adult’s identity and authority to act for a child. Rights can have lawful exceptions, which we will explain.
EEA/UK users may contact their local data-protection authority; Australian users may contact the Office of the Australian Information Commissioner; UAE users may use the competent UAE data-protection channel. Exercising a right will not result in unfair treatment.
13. Changes and contact
We will update this Policy before activating payment or remote photo upload and when data practices materially change. The date at the top identifies the current version. If a change requires consent, we will ask before applying it.
Before paid sales or remote photo upload open, we must publish a monitored privacy contact and full operator details. Until then, use the parent account only for the information described in section 3 and do not send photographs, order details or other personal information through the preview. Once published, that contact will handle privacy questions and rights requests.
Launch note: paid checkout and remote photo upload are not active. Before either opens, this page must be updated with the registered operator name, licence details, postal address and a monitored privacy contact.