Privacy
How we handle your data and your child's.
Last updated October 25, 2026
Who is responsible
Bram Schonenberg Consultancy is responsible for processing your data (the data controller under the GDPR). Our full company details — Chamber of Commerce number, VAT number and address — are shown at the bottom of every page and in our terms & conditions.
What we collect
To create a story we ask for your child's first name and age, and optionally their appearance (via fixed choices, not free text), interests, who's in the story and where it takes place. For your order we ask for your email address and shipping address. We never ask for a photo of your child: a name is enough. If you arrived through a campaign link or another website, we record on your book and order which campaign or website that was (only the website's name, not its full address). When you visit the site, we count page visits without a cookie: we record which page you viewed, which website or campaign link you came from (only the website's name), the country, the type of device (phone, tablet or computer) and the name of your browser. We use your IP address and browser type only briefly to make a code that changes every day; we don't store them. After your order we optionally ask how you found us and who the book is for; you pick your answer from fixed options, we keep it with your order and we share it with no one.
Your child's data
The story is about your child, so we process a minor's data. You provide that data as the parent or guardian — we never address the child directly, never build advertising profiles, and use the data only to make the story. Feel free to keep it light when filling it in: you don't need to share sensitive or medical details. If you do share something sensitive, we use it solely to write the story and keep it as described below.
What we use it for
We only use this data to write and illustrate the story, print and deliver the book, and manage your order and account. We also count how many people visit the site, which pages they view and where they come from, to improve the site. We never sell your data and never use it for advertising.
The basis on which we process it
We process your data to perform our contract with you: making, printing and delivering your book and managing your account. We also keep your order and invoice data to meet our statutory (tax) retention obligation. Which campaign or website brought you in is recorded on the basis of our legitimate interest in measuring which channels work; we don't use it for advertising and share it with no one. We count page visits on the basis of our legitimate interest in seeing how the site is used; we don't use those figures for advertising either, and share them with no one. Where we ask you for anything extra, we do so on the basis of your consent, which you can withdraw at any time.
Who we share it with
We share your data only with the service providers needed to make and deliver your book and handle your order, and only for that purpose. These are: AI services that write and refine the text, create the illustrations and check that each illustration matches the story; a service that automatically checks the illustrations for inappropriate imagery; our payment provider (Mollie); our print partner (PrintAPI), which also handles shipping; our email service (Resend) for order and account emails; and our hosting, database and storage providers where the site runs and your account, stories and files are kept. To protect our forms against bots we use Cloudflare Turnstile, which processes data such as your IP address for that purpose; see Cloudflare's Turnstile Privacy Addendum for details. We never sell your data.
Transfers outside the EU
Some of these providers — especially the AI services and our email service — are based in or process data in the United States. Our hosting and storage run in the EU (Frankfurt). Where a transfer to the US takes place, it does so on the basis of the European Commission's Standard Contractual Clauses and/or a valid adequacy mechanism (such as the EU-US Data Privacy Framework), so your data remains appropriately protected there too.
How long we keep it
We keep your stories, child profiles and order details as long as you have an account, so you can re-read them. If you ask us to delete them, we will. We make a daily backup of our database with our database provider Neon in Frankfurt; erased account data can remain in it for up to about 24 hours, after which the backup is replaced. If you start a book without an account and never finish it, we delete that draft automatically after 90 days of inactivity, along with the stories and the details about your child it contains. We are legally required to keep your order and invoice data for seven years (tax retention obligation), so we can only fully delete those afterwards. Your browser keeps which campaign or website brought you in for 30 days; once it is on a book or order, it follows that record's retention. For visit statistics we create a key each day; we delete it the morning after the day is over, and even in our daily backup it exists for at most about 29 hours. We keep the anonymous visit figures for 13 months and then delete them.
Your rights
You have the right to access, correct, delete and restrict your data, to object to processing, and to data portability. If you gave consent, you can withdraw it at any time. You can delete your account and data partly yourself via your account; for the rest, email us and we'll take care of it. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority.
Contact
Questions about privacy? Email us at hello@talesfornow.com.