Last updated: July 2025
Privacy Policy
This policy explains what personal data Small Heroes collects, why we collect it, and what rights you have over it.
We keep this short and plain — no legal fog. If anything is unclear, just email us.
Who We Are
Small Heroes operates the website smallherosstories.com,
a personalised children's story service. We are the data controller for the personal data described in this policy.
Contact: stories@smallherosstories.com
What We Collect
- Email address — entered when you create a story, so we can send it to you.
- Story content — the prompt you write, the child's age group, and the generated story text. This is used only to create and deliver your story.
- Marketing preference — if you tick the optional checkbox, we record that you consented to receive offers and tips from us, along with the date and time of that consent.
- Language preference — stored in your browser's local storage so the page remembers your language. This never leaves your device.
We do not use tracking cookies, advertising pixels, or analytics scripts.
Why We Collect It & Legal Basis
-
To deliver your story by email
Contract performance
Your email is the only way we can send you the story you asked for.
-
To send marketing emails
Consent
Only if you ticked the optional checkbox. You can withdraw this at any time.
How Long We Keep Your Data
- Stories — kept for up to 12 months so you can re-access them, then deleted.
- Email address — kept as long as we need to provide the service or until you ask us to delete it.
- Marketing consent — kept until you withdraw your consent. We delete it promptly on request.
Who We Share Your Data With
We use a small number of trusted third-party services. They act as data processors — they only handle your data on our behalf and cannot use it for their own purposes.
Supabase
Database & file storage
EU / US
Anthropic
AI story generation
US
Shopify
Payment processing (illustrated stories)
US / EU
All US-based processors operate under standard contractual clauses or equivalent safeguards for international data transfers.
Your Rights
Under GDPR you have the following rights. To exercise any of them, email us at stories@smallherosstories.com. We will respond within 30 days.
Access
Request a copy of the personal data we hold about you.
Deletion
Ask us to delete your data. We will erase it within 30 days.
Correction
Ask us to correct inaccurate data we hold.
Withdraw consent
Unsubscribe from marketing at any time. Doesn't affect story delivery.
Portability
Receive your data in a machine-readable format.
Complain
Lodge a complaint with your national data protection authority.
Children's Privacy
Stories are created about children but the service is used by parents and guardians. We do not knowingly collect data directly from children under 16. The email address collected belongs to the adult creating the story.
Story prompts may mention a child's name or interests. This information is used solely to write the story and is not shared with third parties for any other purpose.
Changes to This Policy
If we make material changes, we will update the date at the top of this page. For significant changes we will send a notice to your email if we have it.