Privacy Policy

1. Data controller

Wundertale
Philipp Hasse
Westring 80
33154 Salzkotten
Deutschland

Email: info@wundertale.shop

2. What data we collect

2.1 Account data

When you register and place an order, we collect your name, email address, billing address, and, where applicable, shipping address. This data is required to perform the contract (Art. 6 para. 1 lit. b GDPR).

2.2 Photos and reference images

You may upload photos of your children and reference images (for example pets or toys) to personalize the characters in the book. These images are used exclusively to create stylized character references.

Important: The uploaded original photos are deleted automatically and irreversibly once your book has been completed and approved, and no later than seven days after upload. Until then they are used solely to allow corrections and re-creations of the character references. The stylized references are not photographic likenesses, but artistically abstracted illustrations.

Legal basis: consent (Art. 6 para. 1 lit. a GDPR). You may withdraw this consent at any time and request the immediate deletion of the photos.

Before the first photo upload we obtain your explicit consent. In doing so you confirm that you hold parental responsibility for any children shown, or have obtained the consent of their legal guardians. As proof of consent (Art. 7(1) GDPR) we store the time, the IP address and the version of the consent text.

2.3 Character descriptions and story data

Names, age, personality traits, interests, and visual descriptions of characters, as well as story details (theme, language, tone), are stored to create the personalized book. This data remains in your account so that you can access your book at any time.

2.4 Payment data

Payments are processed by external payment service providers. We do not store credit card numbers or bank account details. We only receive confirmation of the payment status.

2.5 Technical data

When you visit our website, the following data is collected automatically: IP address, browser type, operating system, referrer URL, and time of access. This data is required for the technical operation and security of the website (Art. 6 para. 1 lit. f GDPR).

2.6 Gallery publication (optional)

If you wish, you can publish your finished book in our public gallery. This only happens with your explicit consent. If children are depicted, you confirm that all legal guardians agree to the publication. As proof we store the time, the IP address and the version of the consent text. You can withdraw the publication at any time by emailing info@wundertale.shop; your book will then be removed from the gallery. Legal basis: consent (Art. 6(1)(a) GDPR).

2.7 Support Chat

Our website offers a support chat. You can use it with or without a customer account, and you don't have to give us your name. When you send a message, we process the text of your message, the name you optionally enter, technical session data and — if you are logged in — the link to your customer account, so that we can answer your enquiry (Art. 6(1)(b) and (f) GDPR). Chat conversations are not archived: a conversation is deleted automatically no later than 48 hours after the last message, or one hour after it has been closed. After a chat ends, you can voluntarily rate it (stars and an optional comment); ratings are stored for internal quality purposes together with the name you entered, if any, and an anonymous chat code. Outside our chat hours, the chat window lets you send us your question by e-mail instead; in that case we process the e-mail address, name and message you enter in order to reply to you.

3. Purpose of data processing

We process your data only for the following purposes:

• Creating and managing your user account
• Creating your personalized picture book (story, illustrations, cover)
• Processing orders and payments
• Producing and shipping printed editions
• Communicating with you about your order and your book
• Technical operation and security of the website

4. Sharing data with third parties

4.1 AI services

We use the following service providers to generate stories, illustrations and audiobook narration:

• Google Ireland Limited, Ireland (Gemini API) — text and image generation
• OpenAI Ireland Limited, Ireland — text and image generation
• ElevenLabs Inc., USA — speech synthesis for the audiobook narration

The data necessary for the respective generation is transmitted to these services (for example character descriptions, story text, or stylized references). Original photos are transmitted in order to create stylized character references. After generation, the originals are deleted by us (see section 6). The providers retain submitted content only temporarily for abuse monitoring (up to 55 days in Google’s case) and delete it afterwards. The stylized references may then be used as a basis for illustrations.

Transfers to third countries: The providers named above also process data on servers outside the European Union, in particular in the USA. Such transfers are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and — where the provider is certified — on the EU-US Data Privacy Framework (Art. 45 GDPR). Data processing agreements pursuant to Art. 28 GDPR are in place with all providers named. The respective provider's own privacy policy applies in addition.

No use for model training: We use the AI services named above exclusively via paid API access (paid tier). Under the applicable API terms of these providers, content submitted through the API is not used to train the AI models. Accordingly, your inputs, photos and the generated content are not used for the providers’ own purposes.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

4.2 Print service providers

If you order a printed edition, we transmit the data necessary for printing and shipping (print files, shipping address) to our print partner. The partner processes the data exclusively to fulfill the order.

4.3 Payment providers

Payments are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Apple Pay, Google Pay and credit or debit card payments are also processed via PayPal. The data required for the payment (including name, billing address, email address and order amount) is transmitted to PayPal. The legal basis is Art. 6(1)(b) GDPR. PayPal's own privacy policy applies in addition.

4.4 Hosting

Our website is hosted by Strato (for hosting) and Hetzner (for object storage) in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place.

4.5 Google services

Our website uses services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”): Google Analytics and Google Ads (each only with your consent) as well as Google reCAPTCHA to protect our forms. Personal data (e.g. a truncated IP address, device and usage data) may be transmitted to Google, including to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. See section 5 for details on purposes, legal bases and how to withdraw consent.

5. Cookies, analytics and third-party services

We use technically necessary cookies required for operating the shop and managing the session on the basis of Section 25(2)(2) TDDDG. In addition, we use Google statistics and marketing services only with your consent, which we obtain via the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent these services are not loaded and no such data is transmitted (Google Consent Mode, default “denied”). You can change or withdraw your choice at any time with effect for the future via the “Cookie preferences” link in the footer of this website.

To complete an order we load scripts from PayPal so that the payment (including Apple Pay and Google Pay) can be carried out. PayPal may set its own cookies that are necessary for processing the payment and for fraud prevention. These scripts are only loaded once you start the checkout process.

5.1 Google Analytics (statistics — only with consent)

With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies (prefix _swag_ga) that enable an analysis of your use of the website (e.g. pages visited, time spent, approximate region). Google Analytics 4 does not store IP addresses and processes them only in truncated form. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Data may also be transmitted to servers of Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. We have concluded a data processing agreement with Google. Event data linked to cookies is automatically deleted after 14 months. You can withdraw your consent at any time via the cookie preferences.

5.2 Google Ads (marketing — only with consent)

With your consent we use Google Ads conversion tracking provided by Google Ireland Limited to measure the success of our advertising. Cookies may be set and data about your visit (e.g. completed orders) may be transmitted to Google, including to the USA (EU-US Data Privacy Framework, see section 5.1). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie preferences.

5.3 Google reCAPTCHA

To protect our forms (e.g. contact form, registration) against abuse and spam we use Google reCAPTCHA, provided by Google Ireland Limited. reCAPTCHA analyses visitor behaviour (e.g. IP address, time spent, mouse movements) to detect automated access. Processing is based on our legitimate interest in protecting our website against abusive access (Art. 6(1)(f) GDPR). Data may be transmitted to Google servers, including in the USA (EU-US Data Privacy Framework). More information: https://policies.google.com/privacy.

6. Retention periods

• Uploaded photos: Deleted once your book has been completed and approved, and no later than 7 days after upload.
• Book projects and illustrations: Stored for as long as your account exists so that you can access them at any time.
• Account data: Until deletion of your account, subject to statutory retention obligations.
• Order data: 10 years pursuant to commercial and tax retention obligations (Sections 147 AO, 257 HGB).
• Server log files: 14 days.

7. Your rights

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR) — you may request information about the data stored about you.
• Rectification (Art. 16 GDPR) — you may request correction of inaccurate data.
• Erasure (Art. 17 GDPR) — you may request deletion of your data unless retention obligations apply.
• Restriction (Art. 18 GDPR) — you may request restricted processing of your data.
• Data portability (Art. 20 GDPR) — you may receive your data in a common format.
• Objection (Art. 21 GDPR) — you may object to the processing of your data.
• Withdrawal of consent — you may withdraw consent granted at any time for future processing.

To exercise your rights, contact info@wundertale.shop.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR. The competent authority is the supervisory authority of your place of residence or the authority at the registered office of our company.

9. Special protection of children

Our service is aimed at adults who create picture books for children. We are aware of the special responsibility involved in processing data about children.

• Uploaded photos of children are used exclusively to create stylized, artistically abstracted character references.
• Photos of children may only be uploaded by their legal guardians or with their consent; you confirm this explicitly when uploading.
• The original photos are deleted once the book has been completed and approved, and no later than 7 days after upload.
• The stylized references are not photographic likenesses and do not allow biometric identification.
• Character traits and names are stored only in the context of the book project and are not used for other purposes.

10. Changes to this policy

We reserve the right to amend this privacy policy to reflect changes in the law or changes to our service. The current version is always available on this page.

Version: August 2026