Integritetspolicy
Privacy Policy
Last updated: 1 October 2026
The short version
You upload a photo of your child so we can illustrate them as the hero of their book. We use that photo for one purpose: to create your preview and your book — nothing else. If you don't buy, the photo and the preview are automatically deleted 30 days after you create them. We never sell your data, we never use your child's photos to train AI models, and we never use your child's likeness in our marketing without your explicit written permission. You can ask us to delete everything at any time at info@bookarino.se. The full detail follows.
1. Who we are
Bookarino is operated by “BM Tech Company” Limited, a company registered in Bulgaria (company no. (EIK) 208797240), registered address 6 Nikolay Haytov St., Entrance B, Office 3, Iztok Residential Complex, Izgrev District, 1113 Sofia, Bulgaria (“Bookarino”, “we”, “us”). We are the data controller for the personal data described in this policy. Questions or requests: info@bookarino.se.
2. What we collect
| What | Why | Our lawful basis |
|---|---|---|
| Your name, email, delivery address, phone number | To take your order, make your book and deliver it | Performance of our contract with you |
| The child's first name, the photo(s) you upload, and any dedication text | To make the book | Performance of our contract with you |
| Payment data | Taken and processed by our payment providers — we never see or store your full card number | Performance of our contract with you |
| Correspondence with us | To answer you and fix what went wrong | Our legitimate interest in running a shop properly |
| Usage data (IP address, browser and device type, pages visited) | Collected via cookies and similar technologies, to understand the site and to show relevant ads | Your consent for anything non-essential — see section 6 |
3. Your child's photo — how it is handled
This is the part that matters most, so it has its own section.
- Your photo is sent to us over an encrypted connection (HTTPS).
- It is processed on our own systems and by the image-generation providers we use to create the illustrations, primarily Google's image-generation models. For some processing steps we use other specialist AI image-processing providers. None of them may use your photo to train their own models.
- If you do not purchase: the photo, the generated preview and the session are automatically deleted 30 days after they are created.
- If you purchase: we keep the photo and the generated artwork only as long as needed to print your book and to honour our guarantee, and no later than 30 days after delivery (or, if you have an open guarantee claim, until that claim is resolved).
- We do not: use your photo or the artwork made from it to train AI models; use facial recognition to identify anyone, or create or retain biometric identifiers or biometric templates from it; sell, rent or share it with anyone beyond the processors named in section 6; use your child's photo or likeness in advertising or on our website without your separate, explicit written consent.
4. Children's privacy
Our customers are adults. We do not knowingly allow anyone under 18 to create an account, upload photos or place an order. All information about a child (name, age, photo, dedication) must be provided by the child's parent or legal guardian, or by an adult who has the parent's or guardian's express permission — you confirm this when you upload a photo. We collect information about a child only from an adult, and only for the purpose of making that one book.
5. Why we process your data, and on what legal basis
Under the UK GDPR and the EU GDPR:
- Creating your preview and book (personalisation data, session data) — performance of our contract with you.
- Fulfilling and delivering your order (order and payment data) — performance of our contract with you.
- Customer support and our guarantee — performance of our contract with you, and our legitimate interest in resolving problems.
- Legal obligations (accounting, tax, consumer-law records) — compliance with a legal obligation.
- Improving our website (aggregated usage data) — our legitimate interest in running a good store.
- Marketing emails, analytics and advertising — only with your consent; every marketing email includes an unsubscribe link, and non-essential cookies are off until you accept them (section 6).
6. Who we share data with, and cookies
We use a small number of processors, and only for the job they do:
- Shopify — hosts our store and processes your order (Shopify International Ltd. / Shopify Inc.).
- Payment providers — Shopify Payments and the other payment methods offered at checkout process your payment; we never see your full card number.
- Gelato — prints and dispatches your book; they receive the print file, your child's first name, any dedication text and your delivery address.
- Carriers — receive your name, address and contact details to deliver your order.
- Our image-generation providers — primarily Google, for the illustration step described in section 3.
- Analytics and advertising providers — Google (Analytics 4, Tag Manager), Meta and TikTok receive usage and event data so we can measure the site and our ads — never photos, never your child's details.
Non-essential cookies — analytics, advertising and measurement — are off until you accept them. We ask you on your first visit; you can change your answer at any time from the cookie link in the footer, and withdrawing is as easy as giving it. Strictly necessary cookies (the ones that keep your basket working and let you check out) are always on.
Depending on where you live, sharing browsing data with our advertising partners for interest-based ads may count as a “sale” or “sharing” of personal information under US state privacy law. See Your Privacy Choices (linked in our footer) to opt out, including via the Global Privacy Control signal. We do not sell personal data for money to anyone, and we never share your child's photo or name for advertising.
We may also disclose data if required by law, or in connection with a business sale or restructuring, in which case this policy continues to apply to your data.
7. International transfers
Our processors operate inside and outside the UK and the European Economic Area, including in the United States. Where personal data leaves the UK or the EEA, we rely on the UK's International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, and, where applicable, the EU–US Data Privacy Framework, so that your data keeps the same standard of protection wherever it is processed. Illustration generation is subject to the same safeguards.
8. How long we keep data
| What | How long |
|---|---|
| Uploaded photo and preview (no purchase) | Deleted automatically 30 days after the session is created |
| Uploaded photo and artwork (after purchase) | Deleted no later than 30 days after delivery, or when an open guarantee claim is resolved |
| Order and invoice records (without the photo) | As long as accounting and tax law requires |
| Support correspondence | Up to 2 years after the matter is closed |
| Marketing consent and email address | Until you unsubscribe |
9. Your rights (UK and EU GDPR)
You have the right to access, correct, delete or receive a copy of your personal data; to restrict or object to our processing; and to withdraw consent at any time (this does not affect processing that already happened). To exercise any right, email info@bookarino.se — we respond within one month and never charge for a first request.
You also have the right to complain to a supervisory authority. UK residents may complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. Our own supervisory authority is the Bulgarian Commission for Personal Data Protection (cpdp.bg), but you may always complain to the authority where you live.
10. US residents
We honour the rights above for all customers, wherever you live — including customers in the United States. Depending on your state (for example, under the California Consumer Privacy Act and similar state laws), you may have specific rights to know, delete and correct personal information, and to opt out of its sale or sharing, including via the Global Privacy Control signal. We do not sell personal data for money, and we do not use sensitive personal information for anything beyond providing the service you asked for. See Your Privacy Choices (linked in our footer) to exercise these rights, or use the contact in section 9. We do not discriminate against anyone for exercising a privacy right.
11. Security
All traffic to our site and our personalisation service is encrypted in transit. Access to uploaded photos is restricted to the systems and people who need it to create your book. No system is perfectly secure, but if a breach ever affects your data we will notify you and the relevant authority as required by law.
12. Changes to this policy
If we change this policy in a meaningful way, we will post the new version here with a new date and, for significant changes affecting photos or children's data, tell you by email or a site notice before the change takes effect.
13. Contact
“BM Tech Company” Limited, 6 Nikolay Haytov St., Entrance B, Office 3, Iztok Residential Complex, Izgrev District, 1113 Sofia, Bulgaria. Email: info@bookarino.se.