This page is a draft. It will be replaced by the reviewed version before we open to the public.
Privacy notice
Last updated: [date]
This notice explains how [Company name] (UEN [number]), of [registered address], Singapore ("we", "us"), collects, uses, shares and protects personal data when you use StarringMyKids. We follow Singapore's Personal Data Protection Act 2012 (the PDPA). StarringMyKids is a service for adults. Parents and guardians use it to make a personalised book about a child, so much of the data in this notice is about your child, and we treat it with extra care.
1. The short version
- You give us photos of your child so we can draw them. We delete the photos as soon as you choose a drawing style, or 24 hours after you upload them if you don't.
- We keep the pictures we draw and your child's story with your order until you delete them. You can delete them, or your whole account, yourself at any time once your order is delivered.
- We use AI services to draw, write and check your book. Some of them are outside Singapore. None of them may use your photos or your child's pictures to train AI.
- We do not sell your data, show you ads, or use your child's pictures to promote StarringMyKids without asking you first.
2. What we collect
About you
- Your email address, or your mobile number if you sign in by phone. If you sign in with Google, we also receive your name and Google account ID.
- Your shipping address, if you order a hardcover.
- Payment details are handled by Stripe, our payment provider. We never see or store your card number. We receive the amount paid, the payment status and a payment reference.
- Messages you send us.
About your child
- Their first name, and their name in Chinese if you give it.
- Their age, and whether the story calls them he, she or they.
- What they love, and up to two family members you add to the story, by what your child calls them (for example, "Nai Nai").
- 2 or 3 photos of your child.
- The story you choose, write or paste, your answers to our story questions, and any changes you ask for.
- The pictures we draw of your child, the finished book, and the animated story if you order one.
We do not ask for your child's surname, birth date, school or address, and we ask you not to include them in your story.
Collected automatically
- Your IP address and basic browser information, which we use to keep the service secure, stop abuse (for example, too many attempts to guess an order link) and check that visitors are human (Cloudflare Turnstile).
- Cookies: one keeps you signed in, and one remembers how you found us (for example, from an advertisement) for 30 days. We use no advertising or tracking cookies. Our home page counts visits with Plausible, which uses no cookies and collects no personal data.
- Records of what happens to your order (for example, "payment received", "photos deleted"), and error reports when something breaks. These carry an order number, not your details.
3. Why we use it
We use your and your child's personal data only to:
- make, deliver and support the book, hardcover or animated story you order;
- check that photos are clear enough to draw from, and that the photos show the same child;
- write and check the story, and check every picture for likeness, quality and safety before you see it;
- take payment, give refunds and keep the accounting records the law requires;
- send you emails about your order (for example, "your photos have been deleted", "your book is ready"). We do not send marketing emails unless you separately agree;
- keep StarringMyKids secure, prevent fraud and abuse, and fix problems.
We rely on your consent, which you give when you sign up and when you add your child's details and photos. You confirm that you are the child's parent or guardian, or have their permission. We also process some data where the law allows it without consent, such as keeping accounting records and protecting the service from misuse.
4. Photos of your child
- Purpose: we use your photos only to draw your child's character, and to check they are clear and show one child. We never use them for anything else.
- Deletion: we delete them as soon as you choose a style, or 24 hours after upload if you don't. We email you when they are deleted. They are never copied into backups.
- Who sees them: the photo check and the drawing are done by automated AI services (see section 7). Our staff do not look at your photos unless you ask us for help with them.
- No face recognition records: we do not create or keep face recognition templates from your photos. To check that pages look like the character you approved, we compare the pictures we draw with each other, never with the photos.
5. How we use AI
StarringMyKids is made with artificial intelligence. AI services draw your child, write and check stories, check that each picture looks like your child and is safe for children, and read the story aloud for the animated story. You choose the drawing style, approve the story before any page is drawn, and can redraw pages. During our launch period, a person checks every book before it is released to you.
Our AI providers have agreed, or are required by their terms, not to use your photos, the pictures we draw or your story to train their AI models.To be confirmed: confirm in writing with each provider (docs/processors.md) before launch.
6. How long we keep it
| What | How long |
|---|---|
| Photos of your child | Until you choose a style, or 24 hours after upload |
| Pictures we draw, the story and your child's details | Until you delete them or your account, or we refund your order |
| Book PDF download | 90 days |
| Animated story download | 90 days |
| Your account (email, phone, name) | Until you delete your account |
| Payment and accounting records | As long as the law requires, currently 5 years; these hold the amount, date and payment reference, not your child's details |
| Security records (for example, attempt counters) | Up to 1 day |
| Backups of our database | Replaced within 7 days |
7. Who we share it with
We share personal data only with the service providers who help us run StarringMyKids, and only for the job each does for us. They are listed, with what each receives, on Who handles your data. They include AI providers (to draw, write, check and narrate), our hosting, storage and database providers, Stripe (payments), our email provider and, for hardcovers, our printer and courier.
We do not sell personal data. We may disclose it if the law requires us to, or to protect the safety of a child or anyone else.
8. Transfers outside Singapore
Some of our providers process data outside Singapore, including in the United States [and other countries, to be confirmed for each provider]. When we transfer personal data out of Singapore, we make sure it is protected to a standard comparable to the PDPA, through contracts with each provider that limit how they may use it.To be confirmed: list each provider's processing location once confirmed.
9. How we protect it
- All connections are encrypted, and our storage and database are encrypted at rest.
- Photos and pictures are stored privately and shown only through links that expire within 15 minutes.
- Access to our systems is limited to the people who need it, with two-step sign-in, and every time our staff view a child's pictures or story it is recorded.
- Error reports are stripped of personal details before they leave our systems.
No system is immune to attack. If a data breach is likely to cause you significant harm, we will tell you and the Personal Data Protection Commission as the PDPA requires.
10. Your choices and rights
- Delete your data: use "Delete my data" on your order page, or "Delete my account" on your account page. We delete everything within 24 hours and email you when it is done. Before you approve the story, a full refund also deletes everything.
- See or correct your data: ask us at privacy@starringmykids.localhost for a copy of the personal data we hold about you or your child, or to correct it. We will reply within 30 days. We may need to confirm who you are first.
- Withdraw consent: you can withdraw your consent at any time by deleting your data or asking us. We will then stop using it and delete it, except records the law requires us to keep. If you withdraw before your order is made, we cannot make it.
- Complain: if you are not happy with how we handle your data, tell us first. You can also contact the Personal Data Protection Commission (www.pdpc.gov.sg).
11. Children
StarringMyKids is for adults aged 18 and over. Children do not sign up or use StarringMyKids themselves. A parent or guardian, or someone with their permission, provides the child's details and photos, and decides when to delete them.
12. Changes to this notice
We will post any changes here and update the date at the top. If a change affects how we use your child's data, we will email you before it takes effect.
13. Contact
Our Data Protection Officer: privacy@starringmykids.localhost, [Company name], [registered address], Singapore.