Privacy Policy

Last updated: 25 October 2026 · My Hero Storybooks

Who is responsible for your data

KONČAR VARMAK DOOEL Skopje, trading as My Hero Storybooks, is the data controller. Write to myhero.storybook@gmail.com for anything on this page. We are not required to appoint a Data Protection Officer; the same address answers data-protection questions.

What we collect, and what we refuse to collect

To make the book: the child's first name or nickname, how the story should address them (he, she or they), appearance choices, an optional dedication, the language of the book, and one photo of the child.

To take and deliver the order: your name, your email, your phone number, and — for printed books — your delivery address. We need the address because a parcel cannot be posted without one, and the phone number because couriers ask for it.

We never request the child's surname, exact birth date, school, home address or medical information. Please do not put any of that in the dedication.

We never see or store card details. Those go straight to the bank.

Why we are allowed to do this

• Making and sending the book, and everything on the order: because we have a contract with you. Without this we cannot make the book.
• Keeping order and payment records for 18 months: because our bank's card-acceptance rules and Macedonian tax rules require it.
• Counting visits to this site: because we have a legitimate interest in knowing whether the site works. No cookies, no tracking across sites, no third party, and we honour Do Not Track.
• Marketing pixel from Meta: only with your consent, given by clicking Accept on the cookie banner. You can withdraw it at any time under Cookie settings at the bottom of every page.

About the child's photo

The photo is personal data about a child, and you give it to us as the parent or guardian. We rely on our contract with you, the adult buyer, not on the child's own consent. We use the photo for one thing only: drawing the character in your book. We do not use it to recognise or identify anyone, we do not build a face template from it, and we do not compare it against any other face. We never publish it and we never sell it.

• Personalization details are stored in a private, access-controlled database and are never published.
• No public child profiles exist and personalized books are never displayed publicly.
• Your photo and your book are never used to train anyone's AI model. We pay for the image service specifically so that this is guaranteed in writing by the provider.

Who else sees your data

Only the services we need to make and send your book and, only if you accept marketing cookies, Meta. We do not sell data, and we never give advertisers your child's name, the photo, the story details or your email.

• Google (Gemini API) — the photo you upload and the story details are sent to Google's image model to draw your child's character. Google processes them on our instructions under its paid API terms and does not use them to improve its own models. Google's servers may be outside your country, including in the United States; the transfer is covered by Google's standard data-protection terms.
• Supabase — hosts our database and private file storage. This is where the photo, the personalization details and the order live, protected by access controls; nothing in it has a public address.
• Komercijalna banka AD Skopje — the card payment. We never see the card details.
• Our print partner — the finished print file and the delivery address only. Never the photo, never the personalization details.
• Cloudflare — hosts this website and runs the small programs behind the order form.
• Resend — sends our emails: your email address and, in order emails, your name and the order details. Its servers may be in the United States; the transfer is covered by its standard data-protection terms.

How long we keep things

• The photo, if you do not go ahead: deleted within 24 hours.
• The photo, once you approve the character: kept while we draw your book and deleted when the book is delivered. If the order is not completed, it is deleted after 7 days.
• The finished book file: kept 30 days after delivery, so we can redo the book if something is wrong with it, then deleted.
• The order itself — what you bought, for whom, the price, the address: kept for 18 months after payment, because our bank's card rules and Macedonian tax rules require it. After that, the personal details are erased. A cancelled order is erased after 30 days.
• A costs record of each preview — a date, a price and a status, with no photo and no name: kept for 12 months.

The deletions run automatically every night. They are not a promise that depends on someone remembering.

What this site stores in your browser

No cookies unless you accept marketing cookies. A few small things are kept in your browser's own storage so the site behaves: your chosen language, your chosen currency and your cookie choice. They never leave your device and we cannot read them. Clear your browser storage and they are gone.

Counting visits

We run our own visit counter. It sets nothing in your browser and sends nothing to anyone else. Each page view records the page address, the site you came from, your language, the currency shown and the width of your screen. Your IP address is turned into a one-way number that changes every day, used to tell one visit from another, and then forgotten. If your browser sends "Do Not Track", we do not count you at all.

Marketing pixel from Meta

We use the Meta Pixel (Meta Platforms Ireland Ltd.) to see which of our ads bring visitors, and to show our ads to people who may like our books. It loads only if you click Accept on the cookie banner. If you click Decline, or choose nothing, it is never loaded and no cookies are set.

If you accept, the pixel sets cookies in your browser and receives the page you visit, technical details about your browser and device, and a few events: that you joined our list, opened a story, started an order or paid for one, with the amount and currency only.

We never send Meta your child's name, the photo, the story details, your email, your phone number or your address, and we do not use its automatic matching features.

Meta may process this data outside your country, including in the United States, under its own privacy policy.

You can change your mind at any time: click Cookie settings at the bottom of any page and choose Decline. We then remove its cookies from this site.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to stop using it, or ask for it in a portable file. Write to myhero.storybook@gmail.com and we answer within 30 days.

If you think we have got it wrong, you can complain to a data-protection authority: in North Macedonia the Personal Data Protection Agency (Агенција за заштита на личните податоци), and in the EU, the EEA or the UK the authority where you live.

TermsPrivacyRefunds and correctionsDeliveryPayment and securityHome