Privacy Policy

1. Introduction

Enchantably LLC (“Enchantably,” “we,” “us,” or “our”) operates the website enchantably.com and related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. It also contains our written data retention policy (Section 6) and our notice to parents (Section 5).

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our Service.

Contact Information:
Enchantably LLC
Windover Ave NW
Vienna, VA 22180
Email: support@enchantably.com

2. Information We Collect

2.1 Information You Provide

• Account information: Email address, display name and profile picture (if you sign in with Google), and sign-in codes. We never see or store a password: sign-in is handled by Google Firebase Authentication. You can start as an anonymous guest; your work is linked to an email address when you choose to save it.
• About the children in your books: First name or nickname, age or age range, gender, appearance details (either typed by you or derived from a photo, see Section 2.3), relationship to you, and, if you choose, a birth month so we can offer a free birthday story preview each year. We advance a hero's age range by one year on each anniversary.
• About other characters: Names and descriptions of toys, pets and adult family members, and the photos you upload of them.
• Story content: Your answers to our story questions, the chat with our story guide, story ideas, themes, verses and edits, dedication text and an optional dedication photo, and the finished book.
• Safety Magic details: Depending on the scenario you choose, a parent's name and phone number, a family password, a trusted neighbor or backup contact, a meeting spot, and home details (house or apartment, floor, elevator). These are printed in the book so your child can learn them, and are stored with the story.
• Class Books and Team Books (educators and coaches): The class or team name, the teacher's or coach's name, and each student's or player's first name, age, gender, description and photo.
• Order information: Name, shipping address, phone number and email collected by Stripe at checkout; a gift certificate purchaser's and recipient's names, emails and gift message; educator verification emails.
• Marketing sign-ups: Your email when you request a sample book, join the newsletter, enter a giveaway (plus a referral code), or ask to be emailed when a hero is ready.
• Communications: Messages you send through the contact form, feedback on your books, and blog comments (display name and comment).

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, story progress milestones, errors, and time spent, collected through Firebase Analytics / Google Analytics under a pseudonymous user ID. We do not send your email, name, your child's name or your story text to analytics.
• Device and log data: IP address, browser type, operating system, access times and referring URLs in server logs. IP address and browser identifier are also kept for 24 hours in an abuse-prevention log that limits account creation and generation rates.
• Advertising identifiers: If you arrive from a Google ad, the ad click identifier is stored in a first-party cookie for 90 days and attached to your order so we can measure which ads lead to purchases.
• Browser storage: See Section 10 for the cookies and on-device storage we use.

2.3 Photos of People: How They Are Handled

You are never required to upload a photo of anyone. You can describe a character in words instead, and we encourage nicknames rather than full legal names. If you do upload a photo of a person, this is exactly what happens:

• Hero creation (children and adults): The photo is sent in a single processing pass to Google Vertex AI (to write a short text description of appearance, e.g. “oval face, brown eyes, wavy hair”, and to paint an illustrated avatar) and to Google Cloud Vision (to locate the face and measure a handful of proportions, such as eye spacing, that steer the illustration). The photo is held in memory for the duration of that pass and is not written to our storage. What we keep is the text description and the illustrated avatar.
• Children: We do not retain the photograph, any crop of it, or the facial measurements. The measurements are categorical descriptions used only during the pass; no faceprint, template or embedding is created or stored, and nothing we keep can be used to recognize or identify a person.
• Adults you add as characters (parents, grandparents): To keep an adult's likeness consistent across pages, we may keep a small (512x512 pixel) face crop and, if you choose to add one, a second reference photo, stored next to the illustrated avatar. Both are deleted when you delete that character.
• Custom Story Flow and My Story My Way: These flows paint directly from your reference photos, so the photos you upload there (which may include children and other family members) are stored with that story until you delete the story.
• Class Books: Student and teacher photos uploaded by an educator are stored with the class book, so pages can be regenerated, until the class book or that character is deleted.
• Team Books, Quick Magic and Safety Magic: People in these flows are created through Hero creation (see above). Photos of toys and pets are stored so your book can be regenerated. Any temporary copies of people's photos in these flows are removed when the book is generated and in any case within one day.
• Other photos: Photos of rooms or places, props, toys, pets and dedication photos are stored with the story until the story is deleted.

Parental consent: By uploading a photo of, or describing, a child, you represent that you are the child's parent or legal guardian and consent to the processing described here. By uploading a photo of an adult, you represent that you have that person's permission. Educators represent that they have obtained parental consent for each student.

3. How We Use Your Information

We use your information to:

• Create, illustrate, narrate and deliver your personalized storybooks
• Process payments and fulfill print orders
• Send transactional emails (sign-in codes, order confirmations, shipping and delivery updates, gift certificates, “your hero is ready”)
• Send reminders and offers about your own books (an unfinished book, an item left in your cart, a free birthday story preview, a sample book you requested) and our newsletter, each with an unsubscribe link; see Section 7
• Respond to support requests and feedback
• Understand how the Service is used and improve it
• Measure advertising and prevent fraud, abuse and excessive automated use
• Comply with legal obligations

We do not use your content, your photos or information about your children to train our own AI models, and we do not sell personal information.

4. How We Share Your Information

We share information only with the service providers below, each of which processes it on our behalf to run the Service, and in the legal situations described in 4.2 and 4.3.

4.1 Service Providers

• Google Cloud Platform / Firebase: Hosting, authentication, database, file storage, server logs and daily backups.
• Google Vertex AI: Generates story text, illustrations and Safety Magic songs from your story content, character descriptions, reference photos and the personalization details above. Under Google Cloud's data processing terms your data is not used to train or improve Google's models. Google may hold inputs in memory for up to 24 hours to speed up responses and may log prompts for abuse monitoring. We use Google's global AI endpoint for availability, so AI requests may be processed in any Google Cloud region worldwide; your stored data remains in the United States.
• Google Cloud Vision: Receives uploaded photos of people only to locate the face and measure proportions during hero creation; nothing is retained by us.
• ElevenLabs and Google Cloud Text-to-Speech: Receive the text of your book (which includes the names in it) to produce the read-aloud narration in our reader and library.
• Stripe: Payment processing. Stripe collects your card details, name, email, shipping address and phone number; we never see or store your full card number. Gift certificate details (names, emails and the gift message) are attached to the Stripe payment record.
• Linemark (HP SiteFlow): Print fulfillment and shipping. Receives your name, shipping address, phone number, email and the print-ready book files.
• Resend: Delivers all of our email. Emails may contain your child's name, an illustrated avatar or page from your book, and download links.
• Google Analytics / Firebase Analytics, Google Ads, Google Tag Manager and Meta (Facebook) Pixel: Site analytics and advertising measurement, described in Section 10. These tags do not run on our reader or library pages.
• Google reCAPTCHA: Bot detection on generation requests (receives your IP address and browser signals).

4.2 Legal Requirements

We may disclose information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.3 Business Transfers

If Enchantably is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

4.4 Content You Choose to Make Public

If you use “Share to library,” the book you share (title, text and illustrations) becomes publicly readable by anyone through our free library. Nothing else about you or your account is published. You can ask us to remove a shared book at any time.

5. Children's Privacy (Notice to Parents)

Our Service is designed for parents, guardians and educators to create personalized books for children. Accounts and purchases are for adults; children under 13 may not create accounts or submit information directly. The information about children described in this policy is provided to us by you, the parent, guardian or educator.

• Child-facing pages: Our read-aloud reader and free library are made to be read by or with a child. We do not collect personal information from children on those pages: no analytics, advertising or social-media tags run there, and no account is needed to read.
• Limited collection: We collect only what is needed to make the book: a first name or nickname, age, gender, appearance and the story details you choose to include.
• No biometric identifiers: We do not create or keep faceprints, facial recognition templates or face embeddings for anyone. For children we keep no photograph and no facial measurements; only categorical appearance descriptions and the illustrated avatar (Section 2.3).
• No advertising use: Information about children is used solely to create their books and the reminders described in Section 7, never for profiling, targeted advertising or AI model training.
• Parental control: You can see and edit every hero and story in your account, delete a hero (which removes its avatar, description and any stored photos) from My Heroes, and delete a book (which removes its text, illustrations and uploaded photos) from My Stories. To review or delete everything we hold about a child, or to refuse further collection, email support@enchantably.com; we complete requests within 30 days.
• Educators: Class Books and Team Books are made by an adult who confirms they hold parental consent for each child included. Parents may contact us directly to have a child removed from a class or team book.

We follow the Children's Online Privacy Protection Act (COPPA) and its 2025 amendments (compliance date April 22, 2026), including maintaining this written retention policy and a written information security program.

6. Data Retention Policy

This section is our written data retention policy. We keep personal information only as long as needed for the purpose it was collected, then delete it.

• Photos of children (hero creation): Never written to storage; processed in memory only.
• Reference photos stored with a story or character (adults' face crops and second photos; Custom Story, My Story My Way and Class Book photos; toys, pets, rooms, props, dedication photos): Kept while that character or story exists; deleted when you delete it or your account.
• Heroes (names, appearance descriptions, illustrated avatars, birth month): Kept until you delete the hero or your account.
• Books: Purchased books are kept while your account is active. Unfinished drafts that have not been touched for 180 days may be deleted. Deleting a book deletes its text, illustrations and uploaded photos; purchased PDFs stay available in your account until the account is closed.
• Narration audio: Kept with the book it belongs to.
• Orders: Order records (name, shipping address, phone, email, what was ordered, print status) are kept for 7 years for tax and warranty purposes, as are Stripe's payment records.
• Marketing sign-ups: Kept until you unsubscribe; after you unsubscribe we keep your address on a suppression list so we do not email you again.
• Abuse-prevention logs (IP address, browser identifier): 24 hours.
• Server logs: Up to 30 days.
• Backups: Daily database backups are kept for 60 days; deleted data leaves backups within that period.
• Account closure: Use “Delete my account” on your My Account page (or email support@enchantably.com from the address on your account). Reminder emails stop immediately; after a 7-day grace period in which you can cancel, we delete your account, heroes, stories, photos, narration, drafts and marketing records, in all cases within 30 days of your request. Order records are retained as described above.

7. Email Communications

Transactional emails (sign-in codes, order and shipping updates, gift certificates, “your hero is ready”) are sent to anyone who uses those features.

Reminders and marketing are sent to account holders and to people who signed up for them: a nudge about an unfinished book, a reminder about a cart you left, a thank-you with a referral offer after a book is delivered, a free birthday story preview for a hero with a birth month, follow-ups to a sample book you requested, giveaway updates and our newsletter. These emails comply with the CAN-SPAM Act:

• Every one includes an unsubscribe link and our postal address
• Unsubscribing takes effect immediately and stops all reminder and marketing email; you can also email support@enchantably.com
• Subject lines are never deceptive
• Opting out never affects your use of the Service

Your own content in reminders: Reminders may show your child's name and a page or avatar from your own book. They go only to you.

8. Your Rights and Choices

8.1 All Users

• Access and correction: Your heroes, stories and orders are visible and editable in your account.
• Deletion: Delete individual heroes and books yourself at any time, or your whole account from My Account (Section 6).
• Copy of your data: Email us and we will provide your account data, stories and books in a portable format.
• Opt out: Unsubscribe from any marketing email; control cookies as described in Section 10.

To exercise any right, email support@enchantably.com from the address on your account. We respond within 45 days (30 days for residents of the EEA and UK). If we decline a request you may appeal by replying to our decision.

8.2 Virginia Residents (VCDPA)

Virginia residents have the rights to confirm, access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale or profiling. We do not sell personal data or profile you. We use advertising measurement cookies (Section 10) that you may opt out of. If your appeal is denied you may contact the Virginia Attorney General.

8.3 California Residents (CCPA/CPRA)

California residents have the rights to know, delete and correct personal information and not to be discriminated against for exercising them. We do not sell personal information. Our Meta Pixel and Google Ads tags may count as “sharing” for cross-context behavioral advertising; you can opt out through your browser settings and the controls in Section 10.3, or by emailing us.

9. Data Security

• Encryption in transit (TLS) and at rest on Google Cloud
• Sign-in through Google Firebase Authentication; sessions are stored in a secure, HTTP-only cookie
• Database and storage rules that let only your account read your stories, heroes and orders; all other access is through our servers, which check that you own what you are asking for
• Book PDFs and print files are shared with you and our printer only through time-limited signed links
• Access to production data limited to the owner of the company; secrets held in a managed secrets store
• Infrastructure hosted on Google Cloud Platform (SOC 1/2/3, ISO 27001)

Images in your book are served through unguessable links so that your browser, our emails and our printer can load them; anyone who is given such a link can view that image, so please forward your book emails only to people you trust. No method of transmission over the Internet is 100% secure and we cannot guarantee absolute security. If we learn of a breach affecting your information we will notify you as required by law.

10. Cookies, Local Storage, and Tracking Technologies

10.1 Technologies We Use Directly

• Session cookie (essential): Keeps you signed in for up to 5 days.
• Ad attribution cookie: Stores a Google ad click identifier for 90 days so we can credit a purchase to an ad.
• On-device storage (essential): Your browser keeps your sign-in state, a local cache of your own stories and heroes so pages load quickly, in-progress drafts (which can include names, descriptions and photos you have just chosen, kept on your device until the draft is finished or expires), your cart, reader preferences such as volume and music, and small flags such as whether you have seen a popup. This data stays in your browser and reaches our servers only when you continue your book.

10.2 Third-Party Cookies and Tags

• Google Analytics / Firebase Analytics: Usage statistics under a pseudonymous ID.
• Google Ads and Google Tag Manager: Conversion measurement and remarketing cookies set on every page except the reader and library.
• Meta Pixel: Page views and purchases (amount only, no names or titles) so we can measure Facebook and Instagram ads.
• Stripe: Sets its own cookies on the Stripe checkout page for fraud prevention.

10.3 Your Choices

Our banner tells you about these tags; it does not yet let you switch them off individually. You can block or delete cookies in your browser settings, install the Google Analytics opt-out add-on, adjust ad personalization in your Google account, and manage ad preferences in your Facebook or Instagram settings. Blocking the essential session cookie will sign you out; blocking third-party cookies will not affect core functionality.

11. Artificial Intelligence and Content Generation

• Story preferences, character descriptions, personalization details and reference photos are sent to Google Vertex AI to generate your text, illustrations and (for Safety Magic) a song; book text is sent to ElevenLabs or Google Cloud Text-to-Speech for narration.
• Under Google Cloud's data processing terms, customer data submitted to Vertex AI is not used to train or improve Google's foundation models. ElevenLabs processes narration text under its API terms.
• AI-generated content is stored in your account for you to read, download and order as printed books. We do not use it to train our own models or share it with other users.
• Your stored data is kept in Google Cloud in the United States. AI requests use Google's global endpoint and may be processed in Google Cloud regions outside the United States.

12. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies.

13. International Users

Our Service is operated in the United States and we ship printed books only within the United States. If you use the Service from elsewhere, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

European Economic Area and United Kingdom users: We process your personal data on the legal bases of contract performance (to deliver your storybooks), legitimate interest (to run, secure and improve the Service), and consent (for marketing communications and non-essential cookies). You have the right to access, correct, delete, restrict and port your personal data, to object to processing based on legitimate interest, to withdraw consent at any time, and to lodge a complaint with your local data protection authority. We answer requests within one month. Our service providers in Section 4 are bound by data processing agreements, and transfers to the United States rely on their participation in the EU-US Data Privacy Framework or on standard contractual clauses.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last Updated” date. For significant changes, or any change in how information about children is collected, used or shared, we will also notify you by email. Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise any of your data protection rights, please contact us:

Email: support@enchantably.com
Mail: Enchantably LLC, Windover Ave NW, Vienna, VA 22180