Privacy Policy

BabyTruthsBooks is operated by NEXTLAYER SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Kordeckiego 26, 05-126 Nieporęt, Mazowieckie, Poland, KRS 0001177398, NIP 5361991807, REGON 54195765000000 (“we”, “us”, “our”). We are the controller of the personal data described in this policy. You can reach us at contact@neextlayer.com.

By using the website you acknowledge this policy. Where we rely on your consent, we ask for it separately.

1.1 Data you give us

• Account data: your name, email address and, if you use a password, a securely hashed password; or the account details supplied by the sign-in provider you choose (for example Google).
• Personalization data: the name(s) that appear in the book, the child’s age range and appearance description, story choices, story text, illustration prompts and your edits. Please do not enter health information or other sensitive details in free-text fields.
• Reference photos (optional): up to five photos you choose to upload so the illustrations can resemble the character. They are processed by AI systems only after you confirm the Photo & AI Processing Notice.
• Voice dictation (optional): if you use “tell it out loud”, your browser or operating system converts speech to text; we receive only the text.
• Order data: the selected plan, credits, recipient name, shipping address, shipping option and order status for printed books.
• Payment data: payments are handled by Stripe. We do not receive or store full card numbers; we receive confirmation of the payment, the amount and limited billing details.
• Communication data: what you send when you email us, including photos of a damaged book.

1.2 Data collected automatically

• Technical data: IP address, browser and device type, timestamps, and security, rate-limit and error records.
• Usage data: with your consent, first-party product analytics such as the creation step reached, device-size class and campaign labels. Vercel Web Analytics records aggregated, cookieless page-view statistics.
• AI operational data: the model used, request status, usage and cost of each generation request, without story or photo content.

• to create and manage your account and save your projects;
• to generate your personalized story and illustrations with AI and prepare the PDF and print files;
• to check text and images against our content rules, for example to prevent copyrighted characters or inappropriate content;
• to process payments, grant book plans and credits, and handle refunds and disputes;
• to print, ship and track physical books and make digital books available for download;
• to answer your questions and send service emails such as order confirmations and shipping updates;
• to keep the service secure and prevent fraud and misuse, including limits on the free trial;
• to improve the product using analytics you have allowed;
• to meet legal obligations such as tax and accounting record-keeping.

• Performance of a contract (Art. 6(1)(b) GDPR): your account, creating the book you ask for, payments, printing and delivery.
• Consent (Art. 6(1)(a) GDPR): optional reference photos and optional analytics. You can withdraw consent at any time; this does not affect processing that took place before.
• Legal obligation (Art. 6(1)(c) GDPR): tax, accounting and consumer-law obligations.
• Legitimate interest (Art. 6(1)(f) GDPR): security, fraud prevention, enforcing our content rules and improving the service, always balanced against your rights.

We do not sell your personal data and we do not use it for cross-context behavioral advertising. We share only what each provider needs to perform its part of the service, under data-processing agreements where required:

• AI providers: OpenRouter routes story and prompt text to DeepSeek and illustration requests (including optional reference photos and earlier illustrations for continuity) to OpenAI.
• Hosting and storage: Vercel (website hosting and cookieless analytics), Supabase (sign-in and database) and Cloudflare R2 (private storage of photos, illustrations and PDFs).
• Payments: Stripe, for checkout, fraud checks, refunds and disputes.
• Printing and shipping: our print partner and carriers receive the print files, recipient and delivery address.
• Sign-in providers: only the one you choose, such as Google.
• Authorities and advisers: when the law requires it, or to establish or defend legal claims.

OpenRouter states that it does not retain prompts or outputs unless prompt logging is enabled; the underlying model provider still processes each request under its own safety and retention rules. See OpenRouter’s data-retention controls.

Transfers outside the EEA

Several of these providers process data in the United States and other countries outside the European Economic Area. We only use providers that offer appropriate safeguards under the GDPR, such as certification under the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

• Account data: while your account is active, or until you ask us to delete it.
• Projects, illustrations and PDFs: while the project stays in your account, so you can edit, download or reprint it. Deleting the project or your account removes them.
• Reference photos: only while needed for the project, until you remove them, withdraw your photo confirmation, or delete the project or account.
• Order, payment and invoice records: for the period required by tax and accounting law (in Poland generally 5 years from the end of the relevant tax year).
• Support messages: up to 2 years after your question or complaint is resolved.
• AI operational data: up to 90 days. Product analytics: up to 13 months, then deleted or aggregated.

Deleted data can remain in rolling backups for a short period. To delete a project or your account, see the Data Deletion Instructions.

• Necessary: sign-in cookies and local storage that keep you logged in, save your draft and remember your choices. These cannot be switched off.
• Analytics (optional): first-party product analytics and campaign labels (UTM source, medium, campaign, content, term and ID), stored for up to 30 days and only after you allow them.
• Marketing: we do not use third-party advertising or tracking cookies.

You choose on your first visit and can change your choice at any time:

We use encrypted connections (TLS), OAuth or magic-link sign-in, database access rules, private storage with signed links, file validation, rate limits and Stripe-hosted card entry. No system is perfectly secure. If a breach is likely to put your rights at risk, we will inform you and the authorities as the law requires.

Under the GDPR you have the right to access your data (Art. 15), correct it (Art. 16), have it erased (Art. 17), restrict processing (Art. 18), be informed when we pass on a correction or erasure (Art. 19), receive it in a portable format (Art. 20), object to processing based on legitimate interest (Art. 21), and not be subject to a decision based solely on automated processing with legal or similarly significant effects (Art. 22).

To use a right, email contact@neextlayer.com. We answer within one month; for complex requests this can be extended by two months, and we will tell you if so. We may ask you to confirm your identity. You can also complain to a data-protection authority, in Poland the President of the Personal Data Protection Office (UODO).

If you live in the United States, you may have similar rights under your state’s privacy law, including the right to know, correct and delete, and to appeal a refusal. Send the request to the same address with “US Privacy Request” in the subject. We do not discriminate against anyone for using these rights.

Photos, prompts and story text are processed by our AI providers only to create the book you ordered. We do not use your photos, prompts or story text to train AI models. Text requests are restricted to providers that do not collect request data, and illustration requests go only to OpenAI’s API, which does not use API data for training by default. We do not use photos for face recognition, identity verification or biometric identification, or to infer sensitive traits.

Withdrawing your photo confirmation stops new photo-based requests. It cannot remove visual traits already included in an illustration you kept.

Our books are about children but are created and bought by adults. Accounts are for adults 18 and over, and we do not knowingly collect data directly from children, including children under 13 as defined by the US Children’s Online Privacy Protection Act. A child’s name, description or photo is processed only to personalize the book, based on the input and confirmation of the adult who has the authority to provide it.

If you believe a child has given us data without a parent or guardian, contact us and we will delete it.

We may update this policy when our service, providers or the law change. The date at the top shows the current version. If a change significantly affects your rights, we will tell you by email or with a clear notice on the website.

Questions about this policy or your data: contact@neextlayer.com. Postal address: NEXTLAYER SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Kordeckiego 26, 05-126 Nieporęt, Mazowieckie, Poland.