What we know about you, and what we do with it.

MiraTells is the controller for the personal data processed through this site.

Questions about your data, or a request to see it or have it erased, go to [email protected]. That address is the same for every country.

Legal entity

INBETA Ventures B.V., trading as MiraTells

Registered address

Hazenweg 3A, 7481 PC Haaksbergen, Netherlands

Chamber of Commerce number

42163421

VAT identification number

NL869991978B01

To make a story

• names, ages and roles of the characters you enter
• photographs you upload, usually of children
• what you tell us about interests, memories and the message
• the choices you make: age group, direction, illustration style, language

To be able to deliver

• your name and e-mail address
• a delivery address, if something is printed
• data about your order, payment and invoices

Technical

• server logs, including IP addresses, for security and faults
• data about generations: which step ran when, and whether it succeeded

We do not ask for data we do not need. A photograph is never required; without one you can describe what someone looks like.

Performance of the contract

Making the story, having the book printed, delivering, invoicing and keeping you informed about your order.

Consent

Processing photographs of people in order to draw characters from them, and sending e-mails with story ideas and offers. You can withdraw consent at any time; that takes effect from that moment.

Legal obligation

The accounts and the invoices, which must be kept for seven years.

Legitimate interest

Security, preventing abuse, and improving the service on the basis of aggregated data.

Most photographs uploaded here are of children. We handle those more strictly than the rest:

• they are in shielded storage and are not publicly reachable
• their content is not recorded in logs
• once you have approved the drawn version, the original photograph is no longer needed; it is deleted after ninety days
• access within our team is limited to whoever needs it for their work, and falls under a separate permission that customer service does not have by default

You may only upload photographs of people who have given permission for it, or of children for whom you as a parent or guardian can give that permission.

We do not sell data. In order to deliver, we engage the following parties as processors or, where stated, as independent controllers:

AI service for text and images

Writing stories, drawing characters and illustrations, and answering questions in the support chat. What we send is not used to train models. For abuse monitoring, requests may be retained for up to thirty days. Processing may take place outside the EEA, under the European Commission’s standard contractual clauses.

Voice service for audiobooks

Narrating audiobooks, and only when you order one. The story text goes there — including the names and memories in it — and no photographs or address details. This processing currently takes place outside the EEA, under the European Commission’s standard contractual clauses; the recording stays with that service until we delete it.

Payment service

The payment. This party is the controller for the payment details themselves; we only receive whether a payment succeeded.

Printer and delivery service

Printing and shipping. The print files and the delivery address go there, not your e-mail address.

E-mail service

Sending e-mail about your order and about signing in.

Hosting and storage

Our servers and file storage are within the European Economic Area.

Unfinished upload

24 hours

Draft without an e-mail address

30 days, then deleted including files

Draft with an e-mail address, not paid

90 days, after a reminder

Uploaded photograph after the drawing is approved

90 days; the approved drawing stays

Approved characters and paid stories

As long as your account exists, or until you delete them

Print files

24 months

Invoices and accounts

7 years — legally required, including name and address

Recorded consents

As long as the processing runs, plus 7 years as evidence

You have the right to:

• see your data and ask for a copy
• have incorrect data corrected
• have data erased, except what we are legally required to keep
• restrict the processing or object to it
• have your data transferred in a common file format
• withdraw a consent you have given

You can do much of this yourself from your account: deleting characters, photographs and stories, and closing your account. For the rest you can contact us. We respond within a month.

If you disagree with how we handle your data, you can lodge a complaint with the supervisory authority in the EU country where you live, where you work, or where the matter arose (GDPR article 77). Ours is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Traffic to this site and to our API is encrypted. Files are in shielded storage, not publicly reachable, and links to them are short-lived. Access within our team is arranged per role and is recorded.

We do not claim that every field in our database is separately encrypted; that would not be true. What does happen is set out above.

Stories and illustrations are made with artificial intelligence. That is not decision-making with legal effects: nothing about you is assessed or refused on the basis of a profile. You judge every result yourself, and nothing goes into production without your approval.

If something changes in how we handle data, we amend this statement and update the date at the top. For significant changes we let you know.