The short version
You give us your email address, and your child's first name, age and a few interests. We use them to write your child's story and to send it to you. We don't sell anything to anyone, we don't use your child's details to train AI models, and we delete everything when you cancel.
If you'd rather just email me and ask something, do: stories@chamomilechapters.com
1. Who we are
Chamomile Chapters is operated by Jack Patterson, sole trader, of 62b Marshfield Road, Cardiff, CF3 2UW.
We are the data controller for the personal data described below.
ICO registration: in progress.
Contact for all data protection matters: stories@chamomilechapters.com
2. What we collect
From you, the account holder:
- Your email address
- Your timezone and preferred delivery time
- Your payment card details — collected and held by Stripe, never by us. We receive only a customer reference, the last four digits, and the card's expiry date.
- Optionally, how you heard about us
About your child:
- Their first name only
- Their age
- Up to five interests you choose to tell us
- The name and type of story character you pick
We do not collect, and never ask for: your child's surname, date of birth, photographs, address, location, school, health information, or any means of contacting them directly. Your child has no account with us and receives nothing from us — everything goes to you.
Automatically: basic server logs (IP address, timestamp, error information) retained for 30 days for security and debugging. We do not run analytics, advertising trackers, or non-essential cookies. There is no cookie banner because there is nothing to consent to.
3. Why we collect it, and our lawful basis
| What | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Your email | To send you the chapters and account emails | Performance of a contract |
| Child's first name, age, interests | To write and personalise the story | Performance of a contract |
| Timezone, delivery time | To send at your bedtime | Performance of a contract |
| Payment details (via Stripe) | To take payment | Performance of a contract; legal obligation for records |
| Server logs | Security and fault-finding | Legitimate interests — keeping the service working and secure |
| "How did you hear about us" | To know which channels work | Consent — it's optional and you can skip it |
We rely on performance of a contract rather than consent for the core data, because we cannot provide the service without it. You always have the right to object, to withdraw from the contract, and to have the data deleted (see §8).
Is providing this data mandatory? Yes, for the core fields — your email and your child's first name, age and interests are all necessary for us to write and deliver the story. Without them we can't create your account. The only optional field is "how did you hear about us," and skipping it changes nothing.
Automated decision-making. Your child's story is written and illustrated by AI, and automatically checked for safety before it sends. This is content generation, not a decision about you or your child — it doesn't score, profile, or make any legal or similarly significant decision about either of you, so UK GDPR's automated decision-making rules (Article 22) don't apply. We're telling you anyway, because we'd rather be transparent about where AI is involved than technically compliant and vague about it.
4. Who we share it with
We do not sell your data. We do not share it for advertising. We use the following processors, each under a data processing agreement:
| Processor | What they get | Where | Purpose |
|---|---|---|---|
| Anthropic | Child's first name, age, interests, story-so-far | US | Writing the story text |
| fal.ai | A scene description (no child's name) | US | Generating the illustration |
| Resend | Your email address, the story content | US / EU | Sending the emails |
| Stripe | Your email, payment details | US / EU | Payments and subscription billing |
| Supabase | All of the above except payment details | London, UK | Database and file storage |
| Netlify | Server logs only | Global | Hosting the website |
On AI training: we use these providers under commercial API terms which do not permit them to train their models on our inputs or outputs. We do not use your child's data to train any model of our own.
International transfers. Some processors are based in the United States. Where that is the case, transfers are made under the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an applicable adequacy decision, as appropriate to that provider.
We will also disclose data if legally required to — for example by a court order — and we will tell you if we are permitted to.
5. How long we keep it
| Data | Retained for |
|---|---|
| Account and child details | While your subscription is active |
| After you cancel | Deleted within 30 days |
| Stories and illustrations already generated | Deleted with the account, unless you've asked us to keep them for a printed book |
| Payment records | 7 years — we're legally required to keep these (HMRC) |
| Server logs | 30 days |
| Emails you send us | 2 years, so I can remember our conversation |
If you ask us to delete your data sooner, we will — except for the payment records we're legally obliged to retain.
6. Children's data — how we think about it
Your child is not our user. They have no account, receive nothing directly from us, and cannot interact with us. Everything is sent to you, and you decide what to do with it.
Even so, this is a child's personal data and we treat it more carefully than the law strictly requires:
- Data minimisation by design. A first name, an age, and a handful of interests is the smallest amount of information that makes the product work, and it is all we ask for. We deliberately do not ask for a surname or a date of birth.
- No profiling, no advertising, no behavioural tracking. We do not build a profile of your child, we do not target them with anything, and their data is never used for marketing.
- No sharing between accounts. There are no social features, no way for one subscriber to see another's stories, and no public exposure of any child's name.
- You are always in control. You provided it; you can see it, correct it, or have it destroyed at any time by replying to any email.
We voluntarily align our practices with the ICO's Age Appropriate Design Code (the Children's Code) where relevant, notwithstanding that our service is directed at and used by adults.
We only accept subscriptions from adults with parental responsibility for the child concerned. By signing up you confirm you are that person.
7. Security
- All traffic encrypted in transit (TLS); data encrypted at rest by our database provider
- Card details never touch our systems — Stripe handles them entirely
- Access to the production database is limited to the operator of the service and protected by two-factor authentication
- We keep the amount of data we hold deliberately small, because the safest data is the data you never collected
No system is perfectly secure. If a breach occurs that risks your rights or freedoms, we will notify the ICO within 72 hours and tell you directly and promptly.
8. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of everything we hold about you and your child
- Rectification — have anything inaccurate corrected
- Erasure — have it all deleted ("the right to be forgotten")
- Restriction — have us stop using it while a dispute is resolved
- Portability — receive it in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — for anything based on consent
How to exercise any of them: reply to any email you've had from us, or write to stories@chamomilechapters.com. No form, no verification hoops beyond confirming you're the account holder. We'll respond within one month, and usually within a couple of days, because it's one person reading the inbox.
Complaints. If you're unhappy with how we've handled your data, please tell us first and we'll try to fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
9. Cookies
We use a single essential cookie to keep your session working during checkout. We do not use analytics, advertising, or tracking cookies of any kind. If that ever changes, we'll ask your consent properly before setting anything.
10. Changes to this policy
If we change anything material, we'll email you before it takes effect and update the date at the top. We won't quietly broaden what we do with your data.
Chamomile Chapters · Jack Patterson, sole trader · 62b Marshfield Road, Cardiff, CF3 2UW · ICO registration: in progress