This page is a draft. It will be replaced by the reviewed version before we open to the public.

How we protect your photos

You are trusting us with photos of your child. Here is exactly what happens to them, and how you can check.

Your photos are deleted quickly

• We delete your photos as soon as you choose a drawing style, usually within minutes of uploading them.
• If you don't choose a style, we delete them 24 hours after you upload them.
• We email you when they are deleted, and your order page says so.
• Photos are never copied into backups. An automatic check alerts us if it ever finds a photo older than 25 hours.

Your photos are never used to train AI

The AI services that draw and check your child receive the photos only to do that job. None of them may use them, or the pictures we draw, to train AI models. You can see who they are and what each receives.

What we keep, and how to delete it

• The pictures we draw, the story and your child's details stay with your order so you can come back to your book and ask for redraws.
• You can delete them yourself at any time once your order is delivered: use "Delete my data" on your order page, or "Delete my account" on your account page. We delete everything within 24 hours and email you when it's done.
• The book PDF can be downloaded for 90 days, and the animated story for 90 days.
• Read the full details in our privacy notice.

How we keep it safe

• Everything is encrypted on its way to and from your device, and our storage and database are encrypted.
• Photos and pictures are stored privately. They are only ever shown through links that stop working after 15 minutes, and never sent in emails.
• Our own staff need two-step sign-in to reach our systems, admin sessions end after 8 hours, and every time staff view a child's pictures or story it is recorded.
• Pages that handle your order run no advertising or tracking scripts.
• Error reports are stripped of personal details before they leave our systems.

Independent checks

• Penetration test: not yet done. An independent security firm will test the site before we open to the public.To be confirmed: the date and a one-paragraph summary, once done.
• Cyber Essentials (CSA): not yet certified. We will apply once our Singapore company is set up.

Questions and problems

• Questions about your data: our Data Protection Officer at privacy@starringmykids.localhost.
• Found a security problem? Please tell us. We reply within 3 working days.