Privacy policy

1. Who we are

Colour Your Family is a trading name of Lime Creations Limited, a company registered in England and Wales (company number 08816195), whose registered office is 71-75 Shelton Street, London WC2H 9JQ. We are the “controller” of your personal data, which means we decide how it is used and are responsible for it. We are registered with the Information Commissioner’s Office (ICO), registration number ZA864594.

Our data protection lead is Harry Gardiner. Contact them about anything in this policy at help@colouryourfamily.com, or by post at the address above.

2. What we collect and why

When you upload, we remove location (GPS) and camera data from every photo straight away. We do not use face recognition, and we do not create biometric data from your photos.

3. Our lawful basis

• Contract: making and delivering the book you asked for, including your preview and order emails.
• Legitimate interests: checking photos and pages for content that is unsuitable for a children’s book, keeping our service secure, preventing fraud and abuse, asking once for a review of your book, and reminding you about a free preview you started but haven’t ordered. For these emails we rely on the “soft opt-in” for customers in the Privacy and Electronic Communications Regulations: you can say no when you start your book (“No reminders”) and with the unsubscribe link at the bottom of every one.
• Legal obligation: keeping order and payment records for tax, and acting on any legal duty to report content that suggests a child may be at risk, for example to the police.
• Consent: marketing emails, publishing your review, and analytics and advertising cookies. These are always separate, unticked choices, and you can withdraw consent at any time (for marketing emails, with the unsubscribe link at the bottom of every one).

4. How photos are checked

Every photo and every finished page is checked twice before printing:

1. An automated check. A smaller copy of each photo (and each finished page) is checked by automated image-checking software, run for us by Anthropic (see section 5), for anything unsuitable for a children’s book. If the result is unclear, the item is held for a person to look at; nothing goes ahead on an error.
2. A person. A member of our team checks every page against your photos before printing. Every time one of our team views an image, it is logged.

If a photo can’t be used, we ask you for another one. Photos that are blocked are deleted when you replace them, unless we are required to keep them to deal with a safety concern. If you think a photo was blocked by mistake, contact us and a person will look at it again.

In the rare case that the automated check suggests a photo may show a child at risk, the order is paused, the file is moved to a locked area that only the business owner can open, and it is kept out of our automatic deletion so that we can follow our written safety procedure. That includes reporting to the police where the law requires it, and following any instructions they give us.

5. Who we share data with

We only share data with companies that help us make and deliver your book, under contracts that restrict what they can do with it. We never sell your data. We print and pack every book ourselves in the UK, so no outside printer ever receives your photos or print files.

6. Transfers outside the UK

Some of the companies above are based in, or process data in, the United States: OpenAI and Anthropic (photos, for line art and the safety check), Stripe (payment), Shippo (your delivery address, for the postage label), Cloudflare (website traffic) and, only with your cookie consent, Google and Meta. Our server is in London. RunCloud, the control panel we use to manage it, is run by RunCloud Sdn Bhd in Malaysia and can access our server; their data processing agreement includes the ICO’s UK Addendum to the EU standard contractual clauses. Our backups are kept by Amazon Web Services. Our email provider and our file storage provider are companies in the European Economic Area, but they handle your data in their London data centres. Where data leaves the UK we rely on UK adequacy regulations (for the European Economic Area, and the UK–US “data bridge” for certified US companies) or the ICO’s International Data Transfer Agreement or Addendum, so it stays protected to UK standards.

7. How long we keep things

Each order’s files are locked with their own encryption key. Once all the files for a finished order have been deleted, we destroy that key as well, so any stray copy of a file can no longer be opened. Copies in our server backups are gone within 30 days, as older backups are replaced. Your dedication is locked with the same key and deleted with your print files. After 6 years we also remove your name, email and address from the order record, keeping only the order number, amounts and dates. This timetable runs automatically every night, and we keep a record of each deletion.

Deleting your photos sooner. Use the “Delete my photos now” button on your order page:

• before you pay, we delete everything straight away, including your email address, and cancel the draft;
• after you pay, we still make your book, because a paid order can’t be cancelled. We need your photos and pages to check, print and pack it, so we delete them within a day of it being dispatched. If you need them deleted before then, email us: we would then have to stop making your book, and because it’s personalised and paid for, we can’t refund it;
• after dispatch, we delete your photos, pages, print files and dedication straight away. We keep the photo of your packed parcel and a copy of its postage label for 90 days after packing in case of a delivery dispute, then delete them and the order’s key.

8. How we keep data safe

• Photos and pages are encrypted at rest and stored outside the public website.
• You see images only through private links that expire after a few minutes.
• Our staff accounts need a strong password and two-factor login, and people only see what their role needs.
• There is no bulk-download feature, and every image view by our team is logged.
• The whole site uses a secure (HTTPS) connection, and we never put personal data in our website logs.

9. Children’s photos

Our customers are adults, but most books contain photos of children. When you upload, you confirm that you are 18 or over and that you are the parent or guardian of any child pictured, or have permission from everyone in the photos. We treat every photo as a child’s photo: we use it only to make your book, never use it to train AI or for face recognition, never show it publicly, and never use it in our marketing. Members of our team see children’s photos only when their job needs it (checking pages and packing your book), and every view is logged.

10. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct it, or to delete it;
• object to, or ask us to restrict, how we use it;
• ask for your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email our data protection lead at help@colouryourfamily.com from the address you ordered with, and we will respond within one month. We may ask you to confirm your identity first. A copy of your data comes as a file you can open or move to another service (JSON), and copies of any photos we still hold are available on request. You can delete your photos yourself at any time (see How long we keep things). If you ask us to delete everything, we delete your photos, pages, packing photo and any review you sent us, destroy your order’s key and remove your name, email and address; we keep only the order number, amounts and dates, because the law requires us to keep payment records for tax. If your book is still being made, we’ll explain your options first.

11. Cookies

We don’t use analytics or advertising cookies. We only set the essential cookies needed to create and order your book, and only on those pages. See our cookie policy.

12. Complaints

If you are unhappy with how we have handled your data, please tell our data protection lead first at help@colouryourfamily.com, so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.