This Privacy Policy explains how we collect, use, share, and protect your personal data when you use the BUKI platform to create personalised children's storybooks. Because our Service involves creating books for children, some child-related data may also be processed.
BUKI collects information from adult customers to:
We aim to collect the minimum necessary and keep it no longer than needed.
Name, email, password (hashed if you create an account), country/language preference, and communication preferences.
If you sign in via a third-party identity provider (Google or Apple), we receive your email address and basic profile information (name, profile picture where provided) from that provider. We do not receive your password. The provider's own privacy policy also applies to the information they share with us.
Billing/shipping address, order details, receipts/invoices, payment status, fraud prevention signals, and shipment tracking information. Note: we do not store your full card details; payment processing is handled by our payment provider.
Child's first name (and optionally last name), age range, interests, dedication text, character appearance choices (hair/skin tone/accessories), story parameters, and similar customisation details.
Optional: uploaded photo(s) you provide to portray the child or family members in the book. Photographs are processed only in-memory during character generation. They are never written to any database, object storage, log file, or backup. After the character illustration is generated, the photo is discarded.
Messages, attachments, and logs of support interactions.
IP address, device type, browser/app version, pages viewed, session data, application error logs, and security logs.
Cookie identifiers and preference/consent signals. Essential cookies are required for the platform to function. For non-essential cookies (analytics, advertising), we ask for your consent.
Under UK GDPR, all processing must be based on a lawful basis and explained transparently.
Process personalisation inputs; generate previews; store drafts; allow edits. Legal basis: performance of a contract.
Payment processing, anti-fraud checks, printing coordination, shipping updates. Legal basis: performance of a contract; compliance with legal obligations.
Respond to enquiries, troubleshoot issues, handle complaints and refunds. Legal basis: performance of a contract; legitimate interests.
Secure authentication, logging, rate limiting, investigations. Legal basis: legitimate interests; compliance with legal obligations where applicable.
Understand feature usage, debug, improve performance. Legal basis: consent for non-essential analytics cookies where required; otherwise legitimate interests for strictly necessary measurement.
Newsletters, product updates, offers. Legal basis: consent, or “soft opt-in” for existing customers where permitted under UK PECR. You can opt out at any time.
Accounting, tax, regulatory filings; responding to law enforcement or court requests. Legal basis: legal obligation.
If offered, used to improve generation quality. Legal basis: explicit opt-in consent. If you do not opt in, we do not use that data for training.
BUKI is intended for adults creating books for children. We do not offer the Service directly to children, and we expect account holders and order-placers to be adults.
We do not allow children to create accounts or submit personal data directly. If we discover a child has registered independently, we may close the account and delete the data.
When a child's name, photo, or other personal data is submitted, we apply higher protection standards and process only what is necessary for book creation and delivery. Photos are never persisted to any storage system — they exist only transiently in memory during character generation and are discarded immediately afterwards.
If our Service is “likely to be accessed by children,” the UK Children's Code may apply, requiring child-safety-focused design, Data Protection Impact Assessments (DPIAs), and high-privacy defaults.
We share personal data only as needed for the purposes above, on a need-to-know basis and with appropriate contractual safeguards. We enter into UK GDPR-compliant Data Processing Agreements with all processors.
Categories of recipients:
We do not sell your personal data to third parties.
Your personal data may be processed in countries outside the United Kingdom — for example, if a cloud provider, AI provider, or support tool is based abroad or accesses data remotely.
Where restricted transfers occur, we use appropriate legal mechanisms, which may include:
We keep personal data no longer than necessary for the purposes for which it was collected, and we maintain a documented retention schedule.
Depending on your location and the applicable law, you may have the following rights:
To exercise your rights: contact us at buki@bu-ki.com. We may ask for reasonable additional information to verify your identity.
Complaints: you may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
The Service is for adults. We require account holders to be 18 or over.
Where consent-based processing might be considered directly offered to children online, the UK threshold for a child's own consent is age 13; below that age, consent from a person with parental responsibility — and reasonable verification efforts — may be required.
We use cookies and similar technologies for:
For non-essential cookies we ask for your consent via a cookie banner and provide clear information about each category. We aim to make “Reject All” as easy as “Accept All,” consistent with UK PECR and ICO guidance.
Book content and images may be generated by automated systems (AI). This automated generation is not designed to constitute “solely automated decision-making” with legal or similarly significant effects on you, because:
We apply appropriate technical and organisational measures to protect personal data, including where appropriate:
No system is 100% secure. In the event of a personal data breach, we will fulfil our notification obligations to the ICO and/or affected individuals in accordance with UK GDPR requirements (generally within 72 hours for high-risk breaches).
We may update this Policy from time to time. If changes are material, we will provide notice via the Service or by email (if you have an account). The updated version will be effective from the date it is published on the platform.