Privacy Policy

1. Introduction

Enchantably LLC (“Enchantably,” “we,” “us,” or “our”) operates the website enchantably.com and related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our Service.

Contact Information:
Enchantably LLC
Windover Ave NW
Vienna, VA 22180
Email: support@enchantably.com

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, display name, and password (stored securely by Google Firebase Authentication).
• Story Content: Character names, story preferences, themes, and text content you create.
• Images: Photos of toys, pets, or other characters you upload for illustration purposes.
• Order Information: Shipping address, billing information (processed by Stripe), and order history.
• Communications: Messages you send to our support team.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Service.
• Device Information: Browser type, operating system, device identifiers.
• Log Data: IP address, access times, referring URLs.
• Local Storage and Similar Technologies: We use browser local storage and similar client-side storage mechanisms to maintain your authentication state and remember your preferences. Third-party services we integrate (such as Google Analytics) may set their own cookies. See Section 10 for more details.

2.3 Photos of Children and Adults — Special Notice

Photos of people are optional and handled with special care:

• You are not required to upload photos of anyone. You may instead provide text descriptions.
• If you choose to upload a photo, it is used solely to generate a text-based description of physical features (hair color, eye color, face shape, etc.) and a stylized illustrated avatar.
• Photos are deleted immediately after AI processing — typically within seconds. During processing, a temporary face-cropped region may be derived in memory to improve illustration quality; this cropped image is never stored and exists only for the duration of the processing call.
• Only text-based appearance descriptions and AI-generated illustrated avatars are retained to create consistent illustrations throughout your storybook.
• What we retain is not biometric data: The text descriptions we store (e.g., “oval face, brown eyes, wavy hair”) are categorical appearance labels selected from a fixed set of options — not mathematical face embeddings, faceprints, or biometric templates. These descriptions cannot be used to identify or verify a person's identity.
• We strongly encourage using nicknames rather than full legal names.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our Service
• Create and deliver personalized storybooks
• Process payments and fulfill orders
• Send transactional emails (order confirmations, shipping updates)
• Send marketing communications (with your consent; see Section 7)
• Respond to customer support requests
• Analyze usage patterns to improve user experience
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. How We Share Your Information

We do not sell your personal information. We share information only as follows:

4.1 Service Providers

• Google Cloud Platform / Firebase: Hosting, authentication, database, and storage services.
• Google Vertex AI: AI-powered content and image generation. Your story content and uploaded images are sent to Google Vertex AI solely to generate your storybook. Per Google Cloud's data processing terms, customer data submitted to Vertex AI is not used to train or improve Google's AI models.
• Stripe: Payment processing. We never see or store your full credit card number. Stripe may set its own cookies for fraud prevention.
• Linemark Printing: Print fulfillment and shipping for physical books. Linemark receives only your shipping address and book files necessary to produce and deliver your order.
• Google Analytics: Website analytics and advertising measurement. Google Analytics may set cookies on your browser; see Section 10.

4.2 Legal Requirements

We may disclose information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.3 Business Transfers

If Enchantably is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Children's Privacy (COPPA Compliance)

Our Service is designed for use by parents, guardians, and educators to create personalized books for children. We take children's privacy seriously and comply with the Children's Online Privacy Protection Act (COPPA), including the amendments finalized in January 2025 (effective April 2026).

• Age Requirement: You must be at least 13 years old to create an account. Users under 18 should use the Service with parental involvement.
• Parental Control: Parents and guardians create and control accounts. Children should not create accounts or use the Service independently.
• Limited Collection: We collect only the information necessary to create storybooks. Photos of children are deleted immediately after processing.
• No Biometric Data Collection: We do not collect biometric identifiers (facial recognition templates, faceprints, or mathematical face embeddings) from children or adults. When a photo is uploaded, our AI generates text-based categorical descriptions (e.g., “round face shape,” “brown eyes,” “wavy hair”) from a fixed vocabulary of appearance options. These text labels guide illustrated avatar creation and are not capable of identifying or verifying any person's identity.
• Ephemeral Photo Processing (Children): Photos of children are processed in memory during a single AI analysis call, during which temporary derivative images (such as face-region crops) may be created to improve illustration fidelity. These derivative images are never written to persistent storage and are discarded when the processing call completes. Only the resulting text descriptions and AI-generated illustrated avatars are retained.
• Adult Photo Processing: For adult characters (parents, grandparents, etc.) created by the account holder, a small face-region crop (512x512 pixels) derived from the uploaded photo may be retained alongside the illustrated avatar to improve likeness consistency across story illustrations. This crop is stored in the same secure location as the avatar and is deleted when the character is deleted or the account is closed. No face crops from children's photos are ever stored.
• No Direct Marketing to Children: We do not knowingly market directly to children under 13.
• No Children's Data for AI Training: Information about children provided through our Service is used solely to generate their personalized storybook and is never used for profiling, advertising, or model training.
• Parental Rights: Parents may review, delete, or refuse further collection of their child's information by contacting us at support@enchantably.com. Upon request, we will delete all stored appearance descriptions, illustrated avatars, and story data associated with a child within 30 days.

6. Data Retention Policy

This section constitutes our written data retention policy as required by applicable law, including the Children's Online Privacy Protection Act. We retain personal information collected from or about children only for as long as reasonably necessary to fulfill the purpose for which it was collected.

• Photos of Children: Deleted immediately after AI analysis (within seconds). A scheduled daily cleanup deletes any orphaned photos older than 24 hours as a safety net. Temporary in-memory derivatives (face crops) are never persisted to storage.
• Adult Face Crops: A 512x512 pixel face-region crop from an adult's uploaded photo may be retained to improve illustration fidelity. This crop is tied to the character record and is deleted when the character is deleted or the account is closed.
• Facial Characteristic Descriptions: Text-based appearance labels (e.g., face shape, eye color, hair style) are retained as part of the story data for illustration consistency. These are deleted when the story is deleted or the account is closed.
• Illustrated Avatars: AI-generated character illustrations (not photographs) are retained as part of the story data. These are deleted when the story is deleted or the account is closed.
• Stories and Books: Stored for up to one year while your account is active.
• Account Data: Retained while your account is active and for a reasonable period thereafter (up to 30 days after account closure).
• Payment Records: Retained as required for tax and legal compliance (typically 7 years), processed and stored by Stripe.
• Account Deletion: Upon request, we delete your account and all associated data — including stories, appearance descriptions, illustrated avatars, and order history — within 30 days, except where retention is required by law (e.g., payment records).

7. Marketing Communications

We may send you marketing emails about new features, promotions, or content we think you'll enjoy. These emails comply with the CAN-SPAM Act:

• Every marketing email includes an unsubscribe link
• We honor unsubscribe requests within 10 business days
• We include our physical mailing address in every email
• We never use deceptive subject lines
• You can opt out at any time without affecting your use of the Service

Personalized Reminders: We may send you reminders featuring previews of your own storybooks (e.g., holiday gift reminders). These feature only your content and are sent only to you.

8. Your Rights and Choices

8.1 All Users

• Access: You can access your story data through your account.
• Correction: You can edit your stories and account information at any time.
• Deletion: You can delete individual stories or your entire account.
• Opt-Out: You can unsubscribe from marketing emails at any time.

8.2 Virginia Residents (VCDPA)

If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act (VCDPA):

• Right to Access: Confirm whether we are processing your personal data and access that data.
• Right to Correct: Request correction of inaccuracies in your personal data.
• Right to Delete: Request deletion of your personal data.
• Right to Data Portability: Obtain a copy of your personal data in a portable, readily usable format.
• Right to Opt Out: Opt out of the processing of personal data for targeted advertising, sale, or profiling. We do not sell personal data or use it for profiling.
• Right to Appeal: If we decline your request, you may appeal by contacting us. If your appeal is denied, you may contact the Virginia Attorney General.

To exercise these rights, contact us at support@enchantably.com. We will respond within 45 days.

8.3 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: Request deletion of your personal information.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out: We do not sell or share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

To exercise these rights, contact us at support@enchantably.com. We will respond within 45 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Secure authentication through Google Firebase
• Access controls limiting data access to authorized personnel
• Regular security assessments
• Infrastructure hosted on Google Cloud Platform with SOC 1/2/3 and ISO 27001 certifications

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

10. Cookies, Local Storage, and Tracking Technologies

Our Service uses a combination of browser storage technologies:

10.1 Technologies We Use Directly

• Local Storage (Essential): Firebase Authentication uses browser local storage and IndexedDB to maintain your login session. This is required for the Service to function and cannot be disabled without losing access to your account.
• Session Data: Temporary data used during your visit to maintain preferences such as language selection and in-progress story drafts.

10.2 Third-Party Cookies

The following third-party services integrated into our site may set their own cookies:

• Google Analytics: Sets cookies to collect anonymous usage data that helps us understand how visitors use our site and improve the experience. You can opt out by installing the Google Analytics Opt-out Browser Add-on.
• Google Ads: If you arrived via a Google ad, cookies may be set to measure advertising effectiveness. These do not track you across unrelated websites.
• Stripe: May set cookies for fraud detection and payment security purposes.

10.3 Your Choices

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking essential local storage will prevent you from signing in. Blocking third-party cookies will not affect core functionality of the Service.

11. Artificial Intelligence and Content Generation

Our Service uses AI (Google Vertex AI) to generate story text and illustrations. Here is how your data is handled in this process:

• Story preferences, character descriptions, and uploaded reference images are sent to Google Vertex AI to generate your personalized storybook.
• Per Google Cloud's data processing terms, customer data submitted to Vertex AI is not used to train or improve Google's foundation models.
• AI-generated content (stories and illustrations) is stored in your account for you to access, download, and order as printed books.
• We do not use your content to train our own AI models or share it with other users.
• All AI processing occurs on Google Cloud infrastructure within the United States.

12. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies.

13. International Users

Our Service is operated in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

European Economic Area (EEA) and United Kingdom Users: If you are located in the EEA or UK, we process your personal data on the legal basis of contract performance (to deliver your storybooks), legitimate interest (to improve our Service and prevent fraud), and consent (for marketing communications and non-essential analytics). You have the right to access, correct, delete, restrict processing of, and port your personal data. You also have the right to withdraw consent at any time and to lodge a complaint with your local data protection authority.

By using the Service, you acknowledge that your information will be processed in the United States. To exercise any data protection rights, contact us at support@enchantably.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last Updated” date. For significant changes, we may also notify you by email. Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise any of your data protection rights, please contact us:

Email: support@enchantably.com
Mail: Enchantably LLC, Windover Ave NW, Vienna, VA 22180