Privacy Policy
Information about the protection of your personal data
Last updated: September 12, 2026
We appreciate your interest in OurTales. The protection of your privacy is very important to us. Below we inform you in detail about how we handle your data.
1. Data Controller
The data controller responsible for data processing is:
2. Access Data and Hosting
2.1 Hosting
Our website and application are hosted by external service providers:
- Vercel Inc. (Frontend Hosting)
- DigitalOcean, LLC (Backend Server & Databases)
These service providers process data (e.g., IP addresses, log files) exclusively on our instructions and within the framework of commissioned processing to ensure the secure operation of the website.
3. Data Processing for Contract Fulfillment
We collect personal data when you voluntarily provide it to us as part of your order or when contacting us.
3.1 Order Process & Story Generation
To create your personalized book, we process the following data:
- Master data: Name, email address.
- Story data: Names of protagonists, age, personal characteristics, story themes.
- Uploads: Uploaded photos for character personalization.
Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfillment).
3.2 Transfer to AI Service Providers (AI Processing)
To generate the personalized texts and images, it is technically necessary to transmit your inputs (prompts) and, if applicable, image features to specialized AI providers. We use:
- OpenRouter / OpenAI / Mistral AI: For text generation.
- fal.ai: For image generation.
These providers only receive the content data necessary for generation. They are not authorized to use this data for training their own models that would violate your privacy.
3.3 Cover by email before an order
Anyone looking at their generated book cover who isn't ready to order yet can voluntarily leave us an email address. We then send the cover by email and ask for a short confirmation of the address.
We keep the uploaded photo, including for marketing purposes, for up to 48 hours unless you order the book, and delete it immediately if you withdraw your consent. We keep the email address and the generated cover for up to 60 days so that we can reach out during that time.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent, given by voluntarily providing the address).
4. Payment Processing
For payment processing, we use the service provider Stripe Payments Europe, Ltd. (Ireland).
Payment data (e.g., credit card number, CVC) is entered directly by you into Stripe's input form and is not stored on our servers. We only receive confirmation of successful payment and a transaction ID.
More information: Stripe Privacy Policy.
5. Email Delivery (Transactional)
For sending order confirmations and the link to your finished book, we use the service provider Resend Inc.
Your email address and the content of the message are transmitted to Resend to ensure delivery.
Review invitation via Trustpilot
Once your book is finished, we invite you to review your purchase. For this we transmit your email address, your name and an order reference to Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark, which sends the invitation on our behalf.
The legal basis is our legitimate interest in genuine customer reviews (Art. 6(1)(f) GDPR) within the existing customer relationship (§ 174(4) TKG 2021). Every invitation contains an unsubscribe link; after unsubscribing you will receive no further invitations.
Newsletter and product updates via Brevo
If you left and confirmed your email address while viewing your book cover, or if you bought a book from us, we send you email about OurTales, for example about a cover you have not ordered yet, new book formats or promotions. For this we transmit your email address, your name, the first name of the child in your book and the date and number of your orders to Brevo (Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany), which sends these emails on our behalf.
For prospects the legal basis is your consent, given by confirming your email address (Art. 6(1)(a) GDPR); for customers it is our legitimate interest in informing you about our own similar products (Art. 6(1)(f) GDPR, § 174(4) TKG 2021). Every email contains an unsubscribe link. After you unsubscribe, we block your address at Brevo from further mailings and keep it only for that purpose.
When you buy a book from us, we use your email address under § 7(3) UWG and Art. 6(1)(f) GDPR to inform you about similar OurTales products, and transmit it to Brevo for this. You can object to this use at any time, without incurring costs other than the transmission costs at basic rates, via the unsubscribe link in every email or by emailing us.
6. Web Analytics, Tracking & Marketing
We use technologies to analyze the use of our website and optimize our marketing measures.
6.1 PostHog (Product Analytics & Heatmaps)
We use PostHog to understand how users interact with our app (e.g., which steps in the editor are difficult).
- Data: Anonymized IP, click paths, heatmaps.
- Purpose: Improving user experience (UX) and bug fixing.
6.2 Google Tag Manager & Google Analytics 4 (GA4)
We use Google Analytics for statistical analysis of visitor traffic.
- Provider: Google Ireland Limited
- Function: IP anonymization is enabled. The data is used to compile reports on website activity.
6.3 Meta Pixel (Facebook/Instagram Ads)
We use the Meta Pixel to measure the success of our advertising campaigns on Facebook and Instagram (conversion tracking).
- Function: When you arrive via an advertisement and make a purchase, this is reported to Meta so we know which ad was successful.
- Legal basis: Your consent via the cookie banner (Art. 6 para. 1 lit. a GDPR).
6.4 Anonymous reach measurement (without cookies)
To understand how many visitors actually reach our landing page, we count page loads in a purely anonymous and aggregated way. No cookies are set and nothing is stored on or read from your device. We count loads, not people. No recognition takes place.
- Data: Each load increments an anonymous daily counter by one. Your IP address is briefly received for technical reasons but is never stored, logged or further processed. To distinguish traffic sources, we additionally evaluate the campaign parameters (e.g. utm_source) from the URL you opened.
- Purpose: Data-minimal, anonymous measurement of the actual reach of our advertising and marketing activities.
- Legal basis: No consent is required because no access to your device takes place. The brief processing of the IP is based on our legitimate interest (Art. 6 para. 1 lit. f GDPR). You may object at any time at hello@ourtales.com.
6.5 Error reports (PostHog)
So that we can spot and fix technical errors quickly, our website reports unexpected errors to PostHog (servers in the EU). This happens without cookies and without storing anything on your device; your IP address is not stored.
- Data: The error message and where it occurred, the affected page, the website's version and internal identifiers (e.g. of an order or a book). Names, photos, email addresses and the text of your stories are not sent.
- Purpose: Secure, error-free operation of the website and bug fixing.
- Legal basis: Our legitimate interest in the secure and error-free operation of the website (Art. 6 para. 1 lit. f GDPR).
7. Cookies and Consent Management
On your first visit to our website, we ask for your consent via a cookie banner to use non-essential cookies (marketing, analytics). You can revoke or adjust your consent at any time in the cookie settings on the website.
- Necessary cookies: Required for operation (shopping cart, login).
- Marketing/Analytics: Only loaded with your consent.
8. Your Rights
You have the right to:
- Access to your data stored with us.
- Rectification of incorrect data.
- Deletion of your data, provided there are no legal retention obligations.
- Withdrawal of given consents.
Please contact us at: hello@ourtales.com
9. Data Security
We use the widely used SSL (Secure Socket Layer) method during your website visit in conjunction with the highest level of encryption supported by your browser.