Privacy Policy

Your privacy matters to us — and the protection of children most of all. This document explains what personal data we process, why, for how long, and what rights you have.

1. Data controller

The controller of personal data within the meaning of Regulation (EU) 2016/679 (the "GDPR") and Czech Act No. 110/2019 Coll. is:

• Name: Lukáš Kantor, a self-employed person trading under the Czech Trade Licensing Act
• Company ID: 03177009, registered address: Milíkov 244, 739 81 Milíkov
• Contact e-mail for data protection matters: contact@heroofthebook.com

2. What data we process

• Identification and contact details: name, e-mail, and where applicable phone number and delivery address.
• Account data: e-mail and a secured (hashed) password.
• Order and book content: the child's name, an optional dedication, the chosen story, texts.
• Character photographs: portrait photographs uploaded in order to create illustrated characters. A book can have up to five characters, so alongside the child's photograph these may also include photographs of siblings, friends, parents or grandparents, i.e. of adults as well. This is personal data, and where children are concerned we treat it with particular care (see Article 4).
• Photograph uploaded for a gift add-on: your own photograph, which the buyer may optionally place into a gift card instead of an illustration and which is then printed (see Article 4).
• Review content: the rating, the text of the review, the name displayed with the review and, optionally, an attached photograph or video (see Article 12).
• Payment data: with card payments these are processed by the payment gateway and we only store the payment status and its identifier. With bank transfer payments we ourselves keep a payment request (the variable symbol, the amount, our account number, the e-mail address for sending the payment details, and the due date) and the bank notification of the credited payment; that notification also contains the payer's designation — usually a name, possibly an account number — exactly as the bank passes it to us.
• Interest in a country launch: the e-mail address you enter in the form on the page for a country where we are still preparing the service, together with the information as to whether you confirmed it by clicking in the confirmation e-mail. Until you confirm the address, we send nothing to it.
• Refer-a-friend programme data: the e-mail address from the order under which the sharing code is created, the number of referred purchases and the rewards issued (see Article 5a).
• Affiliate partner data: for applicants and partners we further process the name or business name, the business registration number (company ID or its local equivalent), the VAT number, the billing address, a description of the promotional channel, the bank account number and an overview of commissions and invoices issued.
• Technical data: IP address, cookies and logs necessary for operating and securing the service.

3. Purposes and legal bases of processing

• Performance of a contract (Article 6(1)(b) GDPR) — creating and delivering the book, maintaining your account, handling orders and complaints; with bank transfer payments also issuing the payment request and matching the incoming payment to the order (without which we would not know what has been paid); for partners, assessing the application, keeping records of referrals and commissions and paying them out under the affiliate programme terms.
• Compliance with legal obligations (point (c)) — accounting and tax documents.
• Consent (point (a)) — processing of uploaded character photographs and of the photograph placed into a gift add-on (see Article 4); publication of a review including the name and any attached photograph or video on our website and on our social media profiles (see Article 12); sending the newsletter and personalised offers based on data inferred about the family and on purchase history (see Article 5); sending a notification that the service has launched in a country you expressed interest in through the form on the page of a country in preparation (confirmed by clicking in the confirmation e-mail); analytics and marketing cookies, including measuring the effectiveness of advertising (see Article 10). Consent can be withdrawn at any time.
• Legitimate interest (point (f)) — securing the website, preventing misuse, and cookieless traffic measurement: even without your consent we determine the aggregate number of page views, without storing anything on your device or reading anything from it and without being able to recognise you on a subsequent visit (described in detail in Article 10).

4. Uploaded photographs and the consent of the people shown

The service is not intended for persons under 18. An account is always created and an order always placed by an adult (Article 1 of the terms and conditions); we therefore process data about children — their name, photograph and the text of the dedication — exclusively from their legal guardians, or from persons who have the guardians' consent. We do not knowingly collect personal data directly from a child; if we find that any such data has reached us, we delete it.

We use photographs solely to create illustrated characters for the book ordered, or to print an ordered gift add-on. A book can have up to five characters and a photograph can be uploaded for each of them — so this need not concern only the child, but also siblings, friends, parents or grandparents. In addition, instead of an illustration you may place your own photograph into a gift card, which is then printed on the add-on you ordered.

By uploading a photograph you confirm that you are the legal guardian of the child shown or that you have the consent of that child's legal guardian, and where an adult is shown, that you have that person's consent. At the same time you grant consent to the processing of the photograph for the stated purpose.

Photographs are not used for profiling, for recognising people across services, or for training artificial intelligence models, and we do not share them with third parties beyond the processors necessary to create the book (see Article 6). We store them securely for the duration of your account so that you can edit your book at any time or build a sequel on it (see Article 8). You can request the erasure of your data, including photographs, at any time at our contact e-mail address; consent can likewise be withdrawn at any time, and withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Personalisation and profiling for marketing

From the text of the dedication and from your order history we infer who bought the book and what their relationship to the child is (e.g. parent, grandparent), so that we can send you a personalised offer (typically an offer of a second book). This is profiling within the meaning of Article 4(4) GDPR — it has, however, no legal or similarly significant effects on you; it merely tailors the content of a marketing e-mail. This processing takes place only with your marketing consent (see Article 3 and Article 10) and you have the right to object to it at any time under Article 21 GDPR (see the rights in Article 9) — you can withdraw your consent at any time at our contact e-mail address or via the unsubscribe link in the e-mail, and you will then no longer receive personalised offers.

5a. Refer-a-friend programme

Everyone who pays for an order with us receives a sharing code for the refer-a-friend programme. The code is tied to the e-mail address of the order, so that buyers without a user account get one too; against that address we keep the number of referred purchases, the period during which the code is actively earning rewards, and the reward coupons issued. The legal basis is performance of the obligation arising from the public promise by which the programme is announced (Article 6(1)(b) GDPR).

When a new customer comes to us through someone else's code, we keep their e-mail (or account) with the referral — this prevents the same person from being counted and rewarded repeatedly. The referrer is not shown the identity of the person referred; they see only the number of referrals and their progress towards a reward.

We keep data about participation in the programme for the duration of the account; for a buyer without an account, for as long as the code or an issued reward may remain valid, and thereafter only as required by law for accounting documents. If you do not wish to take part in the programme, write to us — we will invalidate the code.

6. Recipients and processors

To provide the service we use vetted processors, who process the data under a contract and solely on our instructions:

• The payment gateway provider — card payment processing; your card details never reach us at all.
• Our bank — with bank transfer payments it carries out the payment transaction. It is not our processor: the bank is a separate controller and processes the data under Czech Act No. 370/2017 Coll., on payment systems, and under its own rules. From the bank notification we receive the credited amount, the variable symbol and the payer's designation (see Article 2).
• The cloud storage provider — secure storage of files (photographs, illustrations, PDFs) with the data located in the EU.
• The provider used for sending transactional e-mails.
• Providers of AI technologies for generating text and illustrations and for narrating the audiobook — processing of image and text inputs in order to create the book; when an audiobook is ordered, the text of the book including the child's name is also passed to the voice synthesis provider. We use exclusively the paid tiers of these services, in which the providers do not use your inputs (including photographs) to train their models. Some of them may also operate outside the EU/EEA (see Article 7).
• Advertising and analytics platforms — Google (Analytics 4, Google Ads), Microsoft (Clarity), Meta Platforms (Pixel and the Conversions API) and Seznam.cz (Sklik). Data that makes it possible to recognise a visitor is passed to them only where the relevant cookie consent has been given. Without consent, Google receives only an anonymous page-view signal with no identifier whatsoever (see Article 10); in that case nothing at all is sent to the other platforms.
• The hosting provider; for orders of a printed book, also the print partner and the carrier it appoints.

7. Transfers outside the EU/EEA

Some processors may process data outside the EU/EEA as well (particularly in the USA). In such cases the transfer is safeguarded by appropriate measures under the GDPR — the European Commission's standard contractual clauses, or the recipient's participation in the EU–US Data Privacy Framework.

8. Retention periods

• Uploaded character photographs and the photograph placed into a gift add-on: for the duration of the account (so that you can edit the book or build on it at any time), or until an erasure request has been handled.
• Order data and accounting documents: for the period laid down by law (usually up to 10 years for tax documents).
• Account data and the books created: for the duration of the account, or until an erasure request is submitted.
• An unfinished book with no completed order, for a visitor without an account: 6 months from the last edit. After that we delete it automatically and irreversibly, including the uploaded photographs. If you want to keep an unfinished book longer, create an account — it is then kept for as long as the account exists.
• Refer-a-friend programme data: for the duration of the account; for a buyer without an account, for as long as the sharing code or an issued reward may remain valid, and thereafter only to the extent required by law for accounting documents.
• Partner data: for the duration of participation in the affiliate programme; billing and payment details on tax documents then for the period laid down by law (usually up to 10 years). Data from an application that was not accepted is kept for the duration of the applicant's account, or until an erasure request has been handled.
• Reviews: we display a published review, including the name and any attached photograph or video, until consent is withdrawn. Once it is withdrawn we stop publishing the review, delete the attached photograph or video, and also delete any post we published from the review on our social media profiles. We keep a record that a review for the book has already been created even after that — it prevents the review reward from being claimed more than once.
• Newsletter: until consent is withdrawn.
• Interest in a country launch: until consent is withdrawn, and no longer than one year after the service launches in that country. An unconfirmed address is deleted no later than one year after it was entered.
• Analytics and marketing data: in Google Analytics 4 we retain user data for 14 months. Session recordings in Microsoft Clarity are kept for 30 days from capture (up to 9 months for flagged and randomly sampled recordings), and aggregate statistics for longer. With advertising platforms, the periods are governed by those platforms' own terms. Your cookie choice is stored in your browser until you withdraw it.

9. Your rights

In relation to your personal data you have the right:

• of access to the data and to a copy of it,
• to have inaccurate data corrected,
• to erasure (the "right to be forgotten"),
• to restriction of processing,
• to data portability,
• to object to processing based on a legitimate interest, including profiling for direct marketing (see Article 5) — once you object, we no longer process your data for that purpose,
• to withdraw consent given, at any time.

You can exercise these rights at our contact e-mail address. You also have the right to lodge a complaint with a supervisory authority. Under Article 77(1) of the GDPR you choose the authority yourself, in particular in the Member State of your habitual residence, of your place of work or of the place of the alleged infringement; the list of national authorities is kept by the European Data Protection Board. Because we are established in the Czech Republic, the supervisory authority for our processing is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz). If you live outside the European Economic Area, contact us directly at the contact address; the courts remain open to you.

10. Cookies and measurement tools

We divide cookies into three categories. Necessary cookies always run, because the website does not work without them. Analytics and marketing cookies are stored only after you have given consent in the cookie bar. Without consent, no analytics or marketing cookie is stored or read, and the Microsoft Clarity, Meta Pixel and Sklik scripts are not loaded at all.

The only exception is the cookieless traffic measurement described below: the Google measurement code loads even without consent, but sends only an anonymous page-view signal. In doing so it stores nothing on your device and reads nothing from it, assigns you no identifier, and will not recognise you on your next visit. Because this involves neither storing data on your terminal equipment nor gaining access to it, such measurement does not require consent under Section 89(3) of Czech Act No. 127/2005 Coll., on electronic communications; under the GDPR we carry it out on the basis of our legitimate interest (Article 6(1)(f)) in knowing how many people visit the website and which pages they look at. You can object to this processing at any time (see Article 9).

• Necessary — signing in and keeping your session, your unfinished book, tracking referrals within the affiliate programme, protecting forms against misuse (Cloudflare Turnstile), storing your cookie choice, and recording which page and, where applicable, which campaign brought you to the website (the `attr_first` and `attr_last` cookies) — we use this to evaluate where it pays off to promote the site, not to track you. Legal basis: legitimate interest in operating and securing the website and in evaluating the effectiveness of our promotion.
• Analytics — Google Analytics 4 and Microsoft Clarity. These serve for traffic statistics and for understanding which parts of the website are clear. With Google Analytics, measurement takes place with IP address anonymisation. Microsoft Clarity additionally captures a recording of movement around the page (mouse movement, clicks, scrolling, window resizing) and builds so-called heatmaps from it. This is not screen or camera capture: the recording is a reconstruction of the page in the browser and is set to mask all text and images, so the child's name, photographs, the text of the dedication and anything you fill into a form are not carried into it. The `_clck` and `_clsk` cookies serve to recognise that individual page views belong to a single visit. Without analytics consent the Clarity script does not load at all and Google Analytics stores no cookie — it measures only anonymously and without cookies, as described above and below.
• Marketing — Google Ads, Meta Pixel (Facebook, Instagram) and Sklik (Seznam.cz). These serve to evaluate the effectiveness of advertising (how many orders came from which campaign) and to display more relevant advertising, including reaching out again to visitors who did not complete an order.

With Google's tools we use Consent Mode v2 in its so-called advanced variant. Until you give consent, all consent categories are set to "denied": Google may not store or read any cookie, may not use the data for advertising or personalisation, and ad click identifiers are stripped from the data sent. All that remains is an anonymous page-view signal (the page address, where you came from, an approximate location at country or region level derived from the IP address, and the device and browser type), from which Google estimates overall traffic. Such data does not identify you and cannot be linked to you as a person or to a previous visit. If you do give consent, measurement switches to the standard mode with cookies.

In connection with advertising we also process campaign parameters (UTM parameters and the gclid / fbclid click identifiers), which we store with the order so that we know which source it came from. Once an order has been paid, we also pass Meta the purchase data (the order value and the e-mail address in the form of an irreversible fingerprint — a hash), so that the conversion can be attributed to the right ad. This processing, too, takes place only where marketing consent has been given.

Consent is voluntary and withholding it has no effect whatsoever on your ability to order a book. You can change your choice at any time via the "Cookie settings" link in the website footer, or manage cookies directly in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Security

We take appropriate technical and organisational measures — encrypted transmission (HTTPS), storage of passwords as a secure fingerprint, access controls, and private file access through a proxy. No measure, however, guarantees absolute security.

12. Reviews

After your book has been delivered we may offer you the opportunity to write a review. A review is voluntary and we process it on the basis of your consent (Article 6(1)(a) GDPR), which you give directly in the form before submitting it.

• Purpose: publishing a reference so that other parents have something to base their decision on.
• Scope: the rating, the text of the review, the name you enter with the review and, optionally, an attached photograph or video. Both the name and the attached file are displayed publicly — the file is accessible to anyone who knows its address, even without signing in. So upload only what you want to be public, and give this particular thought where photographs and videos of children are concerned.
• Where we publish reviews: on our website and on our social media profiles (Facebook, Instagram, YouTube, TikTok). We store the wording of the consent you ticked in the form together with the review — for older reviews, which did not cover social media, publication remains limited to the website only.
• Recipients: the public (visitors to the website and to the social media profiles), the operators of those networks as separate controllers (Meta Platforms Ireland, Google Ireland for YouTube, TikTok Technology Limited) and the cloud storage provider (see Article 6). Once published on a network, the content passes beyond our control — a visitor can download it or share it further, and we can no longer delete such copies.
• Publication: we review submissions before publishing them and are not obliged to publish them.
• Photographs and videos of other people: if another person appears in the attached file, we need their permission to disseminate their likeness (Sections 84 and 85 of the Czech Civil Code), and in the case of a child, the permission of their legal guardian — you confirm this to us by ticking the box in the form. Under Section 87 of the Civil Code, such permission can be withdrawn at any time.
• Withdrawal of consent: you can withdraw your consent at any time at our contact e-mail address — we will stop displaying the review, delete the attached photograph or video, and also take down any post published on social media. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Details of retention periods are in Article 8.

13. Changes to this policy

We may update this policy. We will give notice of material changes on the website, or by e-mail. The current version is always available on this page.