Privacy notice
About your child we need only a first name or nickname, an age and whatever they invent for the story — and a parent gives it to us, not the child. We use the data to make the comic, we do not sell it, and we delete the brief 30 days after the book is delivered. Below is exactly what, why, for how long and with whom.
Effective from 15 November 2026
1. In short
- About your child we want only a first name or nickname, an age and what they invent. We do not ask for a surname, address, school or photo.
- A parent gives us the child’s details. The public children’s part of the website (adventure, games) sends nothing and is not measured. In a signed-in family account, what your child changes about their hero (look, world, style, reading) is saved to the account.
- A person reads every brief. Text and images are created by artificial intelligence; it receives only the name or nickname, the age and the parts of the brief the story needs — never your email.
- Payment is processed by Stripe. It receives only your email, the order number and the amount — nothing about your child.
- We delete the brief 30 days after the book is delivered; if you do not buy, 30 days after you sent it.
- No advertising or tracking cookies, no ads and no tracking across websites. We count visits to the parents’ pages only in aggregate, without identifiers (section 10). We do not sell data.
- We will not publish your family’s comic without your separate consent.
- You can ask for access, correction or deletion at any time: info@inkandbrave.com.
2. Who the controller is
The controller of your personal data is Ondrej Kališ, place of business: Jablonové 900, 900 54 Jablonové, Slovensko, company ID (IČO): 52175740. For privacy matters write to info@inkandbrave.com. We have not appointed a data protection officer; the controller will answer you directly.
We follow Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection.
3. What data we process
- Parent: email, country, language, order and payment (amount, currency, date, status, country at payment), our correspondence and a record of the consents you gave (time and version of the text).
- Child — required: first name or nickname, age and choices for the story (world, drawing style, the invented hero’s appearance, a wish).
- Child — optional, with your consent: personality, hobbies, family and pets (first names or forms of address only) and “what to avoid in the story”.
- Child — optional, with your explicit consent: an aid the hero should wear or use in the story (for example hearing aids or a wheelchair), if you choose one in the character builder. We only store which aid you chose — never a diagnosis or any other health information.
What we don’t want: surname, address, school, photo, national ID number, diagnoses, medical reports or descriptions of health. Picking the aid from the pictures is enough. If we find such information in a free-text field, we won’t use it, won’t send it to AI and will delete it.
“What to avoid” may indirectly reveal something sensitive. So a topic without a reason is enough, we ask for separate express consent for it, and before anything is created a person rewrites it as a neutral instruction.
Country from your connection. Cloudflare tells our server which country you are connecting from, based on your IP address. We use it for the currency (USD in the USA, EUR elsewhere) and to check whether we sell to your country. We do not store your IP address for this. When you pay, we store only the country with the order (from your connection and from the billing address Stripe passes to us) — for the currency, taxes and records of sales to EU countries.
We have the data only from you. Providing it is voluntary, but without an email, a name or nickname and an age we cannot make the book. We carry out no profiling and no automated decisions with legal or similarly significant effects for you — the AI creates the comic, it does not make decisions about you.
4. Overview of processing
| Purpose | Data | Legal basis | How long | Recipients |
|---|---|---|---|---|
| Free drawing and preparing the order | email, country, name or nickname, age, choices for the story | steps taken at your request before a contract — Art. 6(1)(b) | 30 days after sending, if you do not buy | Cloudflare, AI providers (no email), our mailbox |
| Making and delivering the comic | the same, plus order details | performance of the contract — Art. 6(1)(b) | the brief and emails containing it: 30 days after the book is delivered; the finished comic: while you have access through the link or until you ask us to delete it | Cloudflare, AI providers (no email), our mailbox |
| A richer story from optional details | personality, hobbies, family and pets | consent — Art. 6(1)(a) | as for the brief, at most until you withdraw consent | Cloudflare, AI providers |
| “What to avoid in the story” | the topic you write | explicit consent — Art. 6(1)(a) and Art. 9(2)(a) | as for the brief, at most until you withdraw consent | Cloudflare; the AI receives only a neutral instruction |
| The hero’s aid in the story | which aid you chose (e.g. hearing aids, an eye patch) | explicit consent — Art. 6(1)(a) and Art. 9(2)(a) | as for the brief (30 days after delivery); if you save the hero with separate consent, up to 12 months or until you withdraw | Cloudflare; AI providers only get a description of how the aid looks, no diagnosis |
| Payment | email, order number, amount and currency; Stripe tells us the billing address country | performance of the contract — Art. 6(1)(b) | as for accounting records | Stripe |
| Currency, countries we sell to and tax | country from your connection (we do not store the IP address); when you pay, the country from your connection and from the billing address is stored | performance of the contract and legal obligation (tax, records of sales to the EU) — Art. 6(1)(b) and (c) | not stored without a payment; with a payment, as for accounting records | Cloudflare, Stripe |
| Accounting and tax | payment record, email, amount, date | legal obligation — Art. 6(1)(c) | 10 years | public authorities, if they require it |
| Complaints, the guarantee, withdrawal and proof of consents | email, order number, related correspondence; the time of the consents given before payment (kept with the order’s accounting record — other consents from the brief are deleted with the brief) | legal obligation and our legitimate interest in defending legal claims — Art. 6(1)(c) and (f) | 3 years after the matter is closed | our mailbox, Cloudflare |
| Family account (sign-in, comics, hero) | email (encrypted), a password if you set one (a fingerprint only, never the password itself), the parent PIN (a fingerprint only), when the paid book was first opened, your child’s nickname and age, the hero’s look from the builder, world, style and reading mode | performance of the contract — Art. 6(1)(b) | while the account is active; after 24 months without sign-in we delete it; you can delete it yourself at any time in the For parents area | Cloudflare |
| Waiting list and news | email and what you are interested in | consent — Art. 6(1)(a) | until you withdraw consent, 24 months at most | Cloudflare, our mailbox |
| Website security and protection against abuse | technical connection data (such as IP address and time); for abuse limits only a fingerprint of the IP address that changes every day | legitimate interest — Art. 6(1)(f) | briefly; IP fingerprints 2 days at most | Cloudflare |
| Our own anonymous counters (parents’ pages) | daily counts only: page, step (for example page view → drawing brief → click to pay) and the domain of the website you came from — no cookies, IP addresses or identifiers | legitimate interest; we cannot identify a person from them | 400 days at most | Cloudflare (database) |
| Protecting a child in danger (section 5) | the necessary part of the brief and the parent’s contact | legal obligation and vital interests — Art. 6(1)(c) and (d) | only as long as necessary | the parent, the competent authorities |
5. Children
A child’s details are given to us by a parent or legal guardian aged 18 or over, as the holder of parental responsibility. We do not collect consent from children. (In Slovakia a child can consent to online services on their own only from the age of 16 — Section 15 of Act No. 18/2018 Coll.)
In the children’s part of the website children buy nothing, see no prices and send nothing. Please tell your child that you and a person from our side will see the brief.
When we are worried about a child. We are not a crisis service and we do not read briefs in order to assess children. But if the person reading a brief comes to a serious suspicion that a child is in danger, they may contact you. If doing so could put the child at risk, or where the law requires it (for example Section 7 of Slovak Act No. 305/2005 Coll.), they may turn to the competent authorities — the child protection authority or the police. They will pass on only what is necessary.
A child’s rights are exercised by the parent. In a crisis, the helplines on the Safety page can help.
6. Who we entrust data to
We do not sell data or pass it on for advertising. It is handled only by the suppliers without whom the comic could not be made; they are bound by data processing agreements under Art. 28 GDPR:
- Cloudflare, Inc. — running the website and database, working out the country from your connection, receiving mail to our addresses (Email Routing). The brief is encrypted in the database.
- Stripe Payments Europe, Limited (Ireland) — payments. From us it receives only your email, the order number and the amount. It also processes some payment data as an independent controller, for example to prevent fraud.
- OpenAI Ireland Ltd and Anthropic Ireland, Limited (Ireland) — creating text and images.
- Google Ireland Limited (Gmail) — the mailbox to which Cloudflare Email Routing delivers mail sent to our addresses and from which we reply to you.
- Resend — sending automatic emails (confirmation of your brief and payment, the code for a new PIN). It receives your email address and the message; the child’s name and the brief are not in these messages.
The AI receives only the first name or nickname, the age and the parts of the brief the story needs. It never receives an email address, surname or postal address. Under these providers’ business terms, content sent through their business interface is not used to train models by default; they may keep it briefly, as a rule for up to 30 days, to check for abuse.
When drawing an aid, the AI only gets a description of how it looks (for example “yellow ear defenders over both ears”) — never a diagnosis.
We may also disclose data to public authorities where the law requires us to.
7. Transfers outside the European Union
The database holding the briefs runs and stores data in the European Union. Our suppliers, however, belong to groups based in the USA, so data may also reach that country — for example when text and images are created or during technical support.
Such transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework (for companies certified under it) or on standard contractual clauses approved by the European Commission (Art. 45 and 46 GDPR). If the legal basis changes, we will update this notice. We will send you a copy of the safeguards on request.
8. How long we keep data
- A brief without a purchase: 30 days after it was sent.
- The brief and emails containing it: 30 days after the book is delivered.
- The finished comic: while you have access to it through the link. We will delete it at any time on request.
- Accounting records: 10 years (Slovak Act No. 431/2002 Coll. on Accounting).
- Waiting list: until you withdraw consent, 24 months at most.
- Anonymous visit counters: 400 days at most.
When the period ends we delete the data. It may linger for a short while in database backups until those backups are overwritten automatically.
9. Your rights
Under Art. 15 to 22 GDPR you have the right to:
- find out what data we hold about you and your child and receive a copy,
- have it corrected or deleted,
- ask us to restrict processing,
- receive the data you gave us in a commonly used, machine-readable format,
- object to processing that relies on legitimate interest,
- withdraw consent at any time — this does not affect what we did before.
How. Write to info@inkandbrave.com, ideally from the email address you used for the brief — that is how we check it is you. It is free. We reply within one month; for a complex request we may extend this by up to two further months and will tell you so.
Complaints. If you think we are not handling data properly, you can contact the Office for Personal Data Protection of the Slovak Republic, Galvaniho 7/B, 821 04 Bratislava (dataprotection.gov.sk), or the supervisory authority in the country where you live.
10. Cookies and browser storage
We use no advertising or tracking cookies, no pixels and no social media buttons.
Your browser remembers, on your own device, a brief in progress and the country you chose (local storage). None of it is sent until a parent sends the brief. You can clear it by deleting the site’s data in your browser. This storage is necessary for a function you yourself asked for, so we do not ask for consent to it.
When you sign in to the family account, your browser stores one sign-in cookie (HttpOnly, for this site only, at most 90 days; it stops working after 30 days without use). It contains only a random sign-in code, nothing about you or your child. It is strictly necessary for the sign-in you asked for, so we do not ask for consent. Signing out deletes it.
Measuring visits. On the parents’ pages we keep our own anonymous aggregate counts — for example how often a page was viewed, how many people started and sent a drawing brief and clicked to pay — per day, with the page address and the domain of the website you came from. No cookies, no IP address and no identifier of any kind, so we cannot identify a person from them or link two visits. We do not currently use any third-party tool to measure visits. If we switch one on, it will be Cloudflare Web Analytics — no cookies, no tracking across websites and aggregate figures only — and we will add it here first.
The children’s part of the website (pages for children and games) is not measured at all — neither by counters nor by analytics. The payment window belongs to Stripe and follows Stripe’s own rules.
11. Security
The connection to the website is encrypted, and the brief is also encrypted in the database. Only the people who read briefs and check the comic have access to them. We collect as little as we can, and payment details never reach us at all. There is more on the Safety page.
No system is perfectly secure. If a personal data breach occurs that poses a risk to you or your child, we will notify the supervisory authority within 72 hours and, where the risk is high, you as well (Art. 33 and 34 GDPR).
12. Changes to this notice
We update this notice when the service, our suppliers or the law change. The effective date is always shown at the top. We will tell families with an order in progress about any significant change by email in advance. Earlier versions are available on request.