Privacy Policy

Last updated: 28 September 2026

Cozy Bee Studio ("we", "us"), a trading name of Nsource Limited, is a small studio in London, England, that makes personalised storybooks. We are the controller of the personal data described here, under the UK GDPR and the Data Protection Act 2018. Because our books are about children, we try to collect as little as we can and keep it no longer than we need.

What we collect

Your account — when you sign in with Google or Apple: your name, email address and profile picture. (With Apple's "Hide My Email", we only see a relay address.)
Your book — the names, age, language, dedication, any note or story you write for us, and the photo(s) you add.
Your order — what you bought and the options chosen, your email, and the delivery address. If you save an address to your account, we keep it to fill in checkout for you.
Payment — handled entirely by Stripe. We never see or store your full card details.
Previews — the character pictures and book covers made for you when you try a book (see below).

Why we use it

To make, print and deliver your book, and to email you about your order — because you asked us to (performing our contract with you).
To keep order records for accounting and tax — because the law requires it.
To run your account, your book club subscription and the free preview.
To keep the site secure and working, and to count, in totals, how the shop is doing (our legitimate interests).

We use the photos you send only to make your book or your preview. We never use them for advertising, never share them publicly, and never use them to train anyone's AI.

The character preview

You can try it without an account: up to two previews a day from one network, checked by Cloudflare Turnstile (a bot check that uses no tracking cookies). Signed in, up to three a day.
Your photo is made smaller in your browser, then sent to Google's Gemini model on Vertex AI, a paid service under which Google does not use it to train its models. We do not keep the photo you upload for a preview — unless you ask us to email you the cover (below).
The character that comes back is kept in private storage, shown to you through a link that expires within an hour, and deleted automatically after 30 days.
When you pick a book, the same model paints its cover with your child's character; the cover is kept the same way (private, deleted after 30 days). The model letters the title with your child's name onto the cover too, and we check the spelling before you see it.
If you go on to order, the character and the cover are kept with your order so your book can match them (deleted with your photo, as below).
"Email me this cover": we send the cover to the address you give, with a link back to your book. So that link works without uploading again, we keep the photo beside your preview — private, and deleted after 30 days with the preview. If you tick the box, we send two reminders at most (2 days and 15 days later) and then never write about it again; we stop early if you order or unsubscribe. We keep the request (your email, your child's first name and age, and which book) for 31 days.

If you sign up, we email you a link to confirm first — nothing else is sent until you press it. Once confirmed, you get a one-off welcome code, then new books, seasonal stories and offers, a few times a month at most. We keep your email, when and how you signed up, and the wording you agreed to, as a record of your consent. Our mails, the newsletter included, are sent by Amazon SES, which also keeps the newsletter list. If you tick "email me new books…" in your cart, we add you to the list once your order is paid, and keep the wording you agreed to. Every mail has an unsubscribe link, and unsubscribing takes effect at once.

Cookies and counting

We don't use advertising or tracking cookies. Your browser keeps your cart, your sign-in (through Firebase) and, for 30 days, the name of the campaign link that first brought you here (for example "instagram"), so we can tell which links lead to orders. We count visits to each step of the shop — previews, carts, checkouts, orders — only as daily totals, never as a profile of you.

Who helps us

These companies process data for us, only to provide their service:

Stripe — payments and the book club subscription.
Gelato — printing and posting physical books (the delivery address, the book files and, for printing, the illustrated pages).
Google — sign-in (Firebase) and drawing the preview character (Vertex AI).
Apple — sign-in, if you choose it.
Amazon Web Services, in Ireland (EU) — storing orders, book details and previews, and sending our emails.
Cloudflare — serving this website, forwarding email sent to us, and the Turnstile bot check on the free preview.
Etsy — only if you order through our Etsy shop, under Etsy's own policy.

Some of them process data outside the UK (for example in the EU or the US). Where they do, it is protected by UK adequacy regulations or the UK's approved contract terms. We don't sell your data, and we don't share it with anyone for marketing.

How long we keep it

Preview characters and covers — 30 days, then deleted automatically (and the photo, if you asked us to email you the cover).
A cover you asked us to email — the request and its reminders, 31 days.
Photos and book details you give us for a book — if you don't place the order, deleted automatically after 14 days. Once you order, kept for 180 days (time to make, post and, if needed, reprint your book), then deleted automatically — unless you ask us to keep them for another book. They stay in our private storage: we don't send them around by email.
Orders from our Etsy shop — the photos and details sent with the order, and the book we make from them, are kept in our private storage: at hand for 180 days (to make, post and, if needed, reprint your book), then moved to archive storage, so a copy can be reprinted later. Ask us at any time and we'll delete them.
The Hive reader (your child's name, age, favourites and photo, for the monthly book) — while you're a member, and deleted automatically 30 days after the membership ends, unless you rejoin by then.
Newsletter — your address stays on the list until you unsubscribe; we keep the record of your consent.
Reviews — about two weeks after an order (four days for a PDF) we email once to ask how it went. If you leave a review, we keep it with your order, and once we've read it we show your stars, your words and the first name you gave on the book's page. Ask us and we'll take it down.
Order and payment records — six years, as UK tax law requires.
Your account and saved address — until you ask us to delete them.

Your rights

You can ask to see the data we hold about you, to correct it, to delete it, to restrict or object to how we use it, or to have a copy to take elsewhere. You can withdraw consent (for example, to the newsletter) at any time. Write to us at the address below — we'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Children

Our books and previews are made from photos a parent, guardian or family member gives us. Please only send a child's photo if you are their parent or guardian, or have their parent's permission. Our site is for grown-ups to use; we don't knowingly collect data from children.

Changes

If we change this policy in a way that matters, we'll update the date at the top and, where it affects you, tell you by email.

Contact

Anything about your data: hello@cozybeestudio.com.