Privacy Policy

Last updated: June 2025

Cosy Creations Ltd (“we”) is the data controller for personal data collected via https://cosycreation.com. We are committed to protecting your privacy and complying with UK GDPR and the Data Protection Act 2018.

What we collect

  • Order & contact data: email, delivery address, order details.
  • Payment data: processed securely by Stripe; we do not store card numbers.
  • Uploaded photos (transient): if you choose to add a hero, you may upload a photo.
  • Technical data: cookies and basic analytics (see our Cookie Policy).

How we handle uploaded photos — important

If you upload a photo, we use it only to create a text description of the character so our tools can draw them. We do not store the photo — it is processed and then discarded. The uploaded image may be sent to our AI provider solely to generate the description and artwork, after which it is not retained by us. We keep only the text description, linked to your order.

You confirm you have the right to upload any photo and to consent to this processing. If a photo features a child, you confirm you are their parent or guardian (or have appropriate authority) and consent on their behalf. Please do not upload inappropriate images; we screen uploads.

Why we process your data (lawful bases)

  • Contract: to fulfil your order.
  • Consent: for processing uploaded photos and for non-essential cookies.
  • Legitimate interests: to run, secure and improve our service.
  • Legal obligation: tax and accounting records.

Who we share data with

  • Payment processing: Stripe.
  • Printing & delivery: our print/fulfilment partner.
  • AI processing: our AI provider(s), for generating your artwork.
  • Hosting & infrastructure providers.

Some providers may process data outside the UK/EEA; where they do, we rely on appropriate safeguards (such as UK/EU approved transfer mechanisms).

How long we keep data

Order and contact data: as long as needed to fulfil your order and meet legal/accounting obligations (typically up to 7 years for financial records). Uploaded photos: not retained.

Your rights

You have the right to access, correct, delete or restrict your data, to object to processing, to data portability, and to withdraw consent. Contact [email protected]. You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Children

Our service is intended to be purchased by adults. We do not knowingly collect data directly from children. Where a book features a child, the purchasing adult is responsible for providing consent.

Questions? Contact us at [email protected].