Privacy Policy
We, magic-story.ai GmbH (Prossowitscher Strasse 69/1, 9500 Villach, Austria – VAT ATU64439655) (hereinafter "we", "us", or "our"), value your privacy and handle your personal data with care. This privacy policy informs you pursuant to Art. 13 GDPR about the processing of your personal data. It describes what data we collect when you use our website https://story-magic.ai (hereinafter: "the Website"), place an order, or otherwise contact us, how we use this data, how it is stored, with whom it may be shared, and what rights you have.
1. Personal Data Collected
1.1 Data you provide directly: Contact and account data (name, email address and – if you set one – password, encrypted), order data (billing and shipping address), personalization data (names in the book, occasion, textual instructions). Note: Do not enter sensitive medical or special category personal data in free text fields. Uploaded images: Processed by our AI systems to generate illustrations. Communication data: What you provide when contacting us. Payment data: Not stored by us; processed by Stripe; we only receive payment confirmations. 1.2 Automatically collected data: When you visit our Website, we may collect technical data (IP address, browser, operating system, device) and usage data (pages visited, click behavior, duration) via cookies and similar technologies (see Section 6). 1.3 Customer account: If you have paid for an order with us, we automatically create a customer account for your email address as soon as you first click a button in one of our emails about that order (e.g., in the order confirmation or in the email “Your story experience is ready – come explore”). The click confirms that the address belongs to you; you do not need a password for this. If an account already exists for that address, we sign you in to that account instead. In your account you will find your orders and downloads. Each time you sign in, we store the time, the login method, your IP address and your browser identifier (and, derived from it, the device type, browser and operating system). This login history is part of your account data; it is used to protect your account against misuse and to resolve login and security issues. 1.4 Reminder about your book draft (only with your consent): Next to the email field in the book wizard that we use to send you your cover, a box reading “Remind me once by e-mail about my book – with a little gift.” may appear. It is never pre-ticked. If you tick it and submit your address, we store with your book draft your email address, the time of your consent and the version of the consent text you saw. About 24 hours later we send you a single reminder email with a link back to your book and a personal discount code – only if by then you have not paid for this draft and have not ordered any other book with this address. No further reminders follow. If you change the email address of your draft, the old address receives no reminder. We create the discount code with our payment provider Stripe when the reminder is sent: redeemable once, only for “Premium Pack + Hardcover”, valid for 72 hours. For this, Stripe receives only the code, its validity and the identifier of your book draft – not your email address. We also store the code, its validity and the time of sending with your draft; if you pay for it while the code is valid, the discount is deducted automatically. The legal basis is your consent (Art. 6(1)(a) GDPR; for the email additionally Section 174 of the Austrian Telecommunications Act 2021, TKG 2021). You can withdraw it at any time with effect for the future: via the unsubscribe link in the email with your cover and in the reminder, by removing the tick and submitting your address again before the reminder is sent, or by emailing us (Section 12). We keep these details – also as proof of your consent and of any withdrawal (Art. 7(1) GDPR) – together with your book draft and delete them together with the draft or when you request deletion.
2. Purposes of Data Processing
We process your personal data exclusively for: Creating and managing your account, including the customer account created automatically after an order (Section 1.3), and protecting it against misuse; processing, producing, and handling your orders; generating personalized children's books (eBooks and physical books) using AI; checking textual input for conflicts with our terms (e.g., copyrighted terms or inappropriate content); shipping products and making digital eBooks available for download; communicating about your order and providing customer service; sending service-oriented emails (order confirmations, shipping notifications); sending the reminder about your book draft that you asked for (Section 1.4); improving our products, services, and Website; analyzing website usage (anonymized where possible); complying with legal obligations (e.g., tax retention); preventing fraud and misuse.
3. Legal Grounds for Processing (GDPR)
Performance of the agreement (Art. 6(1)(b) GDPR): For processing your order, delivering products, managing your account (including the automatically created customer account through which we make your order and your downloads available to you), and for the processing of uploaded photos, personalization data, and book creation – these are necessary for contract performance. Consent (Art. 6(1)(a) GDPR): For marketing, newsletter, marketing cookies, and the reminder about your book draft (Section 1.4). You give this consent separately in each case; you may withdraw it at any time. Legal obligation (Art. 6(1)(c) GDPR): To comply with tax and administrative obligations. Legitimate interest (Art. 6(1)(f) GDPR): For fraud prevention, the security of your customer account (login history), enforcing our terms, and improving our services.
4. Sharing Personal Data with Third Parties
We do not sell your personal data. We only share it with third parties if necessary for our services. We conclude Data Processing Agreements (Art. 28 GDPR) with these parties. Affected categories: Payment providers (Stripe) for secure payment processing; shipping and printing partners for production and delivery; hosting and IT providers for the Website and storage; AI technology providers (e.g., OpenAI, Google) for generating texts and illustrations – your photos and textual input are processed by these systems; analytics services (e.g., Google Analytics) for website usage analysis (anonymized where possible); authorities if required by law. For error monitoring we use Sentry (Functional Software, Inc., data stored in the EU): if a technical error occurs on the Website, Sentry receives an error report with technical details (e.g. browser, device, page visited, error message) so that we can fix it. In addition, for a small share of page views Sentry measures how fast the page and its content load (performance monitoring, with the same technical details); the addresses of your photos and book images are not transmitted – the legal basis for both is our legitimate interest in a working Website (Art. 6(1)(f) GDPR); the session recording Sentry Session Replay only runs with your consent (see section 6). Transfer outside the EEA (in particular USA): Stripe, OpenAI, Google, and possibly other providers process data on servers in the USA. We use EU Standard Contractual Clauses and, where available, the EU-US Data Privacy Framework to ensure an adequate level of protection. Third-country transfers nevertheless entail residual risks (e.g., access by authorities in the third country), which we minimize through contractual safeguards.
5. Retention Periods
We do not retain your personal data longer than necessary. Account data: As long as your account is active or until you request deletion. Order and invoice data: At least 7 years per statutory tax retention obligation. Personalization data (photos and eBooks): Uploaded photos and generated digital eBooks ("project files") are stored for a maximum of 10 weeks from creation. After that, they are automatically and permanently deleted. You must download your eBook within this period. Reminder about your book draft: see Section 1.4. Communication data: Up to 2 years after handling your request or complaint.
6. Cookies and Tracking Technologies
We use cookies and similar technologies (e.g. pixels, local storage) to run the Website, analyse its use and — with your consent — for marketing. Cookies are small text files placed on your device. Necessary cookies: essential for the Website to function (navigation, login, order access, your cookie decision). Analytics (consent only): Google Analytics 4 and Google Tag Manager (Google Ireland Ltd.) measure page views, the steps of the book wizard, the creation of your customer account and purchases using a pseudonymous client identifier; after a payment we additionally send the purchase confirmation from our server to Google Analytics together with this identifier, your order number and the order value — without name, e-mail address or photos. Microsoft Clarity (Microsoft Ireland Operations Ltd.) records sessions as heatmaps and replays; text inputs, photos and book pages are masked. Sentry Session Replay (Functional Software, Inc., data stored in the EU) records a sample of sessions, and every session in which a technical error occurs (clicks, page changes, loading times), so that we can trace errors; all text, inputs and images are made unrecognisable, and the addresses of your photos and book images are not transmitted. Marketing (consent only): Meta Pixel (Meta Platforms Ireland Ltd.) and TikTok Pixel (TikTok Technology Ltd.) record visits, the creation of your customer account and purchases to deliver advertising and measure its performance. After a payment we additionally send the purchase confirmation from our server to Meta via the Meta Conversions API: order number, order value, the Meta cookie identifier, IP address and browser identifier as well as e-mail address, name, phone number and postal address in hashed (pseudonymised) form, so that Meta can attribute the purchase to an ad and optimise campaigns; photos and details about your child are never transmitted. The legal basis is your consent (Art. 6(1)(a) GDPR). Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework or standard contractual clauses. On your first visit a cookie banner informs you and asks for consent; without consent no analytics or marketing services are loaded. You can change or withdraw your consent at any time with effect for the future via “Cookie settings” in the footer. We only count anonymously how many visitors accept or decline (without a cookie or identifier).
7. Security of Personal Data
We take appropriate technical and organizational measures to protect your personal data against misuse, loss, unauthorized access, and unauthorized modification. This includes encryption (SSL/TLS) for transmission, secure servers, and access management. Despite adequate security measures, complete security for data transmitted over the internet cannot be guaranteed. In the event of a data breach with likely adverse consequences, we will inform you in accordance with legal obligations.
8. Your Rights (Data Subject Rights)
Under the GDPR, you have the following rights: Right of access (Art. 15 GDPR); Right to rectification (Art. 16 GDPR); Right to erasure ("right to be forgotten", Art. 17 GDPR); Right to restriction of processing (Art. 18 GDPR); Right to notification (Art. 19 GDPR); Right to data portability (Art. 20 GDPR); Right to object (Art. 21 GDPR); Right not to be subject to automated individual decision-making (Art. 22 GDPR). We do not engage in solely automated decision-making with legal or similarly significant effects. To exercise these rights, contact us using the details below. We will respond within one month; this period may be extended by two months for complex requests. We may ask you to identify yourself. If you believe our processing infringes privacy legislation, you have the right to lodge a complaint with the competent Data Protection Authority.
9. AI Generation and Use of Images
The processing of uploaded images for personalizing your children's book is carried out by our AI systems and those of our carefully selected technology partners (e.g., OpenAI, Google). This processing serves exclusively to generate the ordered product. We have concluded Data Processing Agreements (Art. 28 GDPR) with all AI providers. Important: We and our partners do not use your photos and input data to train AI models; our AI providers likewise do not use your data to train their models. Your data is only used for the execution of your order.
10. Children's Data
Our products are aimed at children but are ordered by adults. We do not knowingly collect personal data directly from children without parental consent. Personal data of children (e.g., name in the book, uploaded photo) is only processed for product personalization, based on the input of the adult Buyer. By uploading a photo and providing names, the Buyer confirms that they are the legal guardian or otherwise authorized to upload the image and provide the child's data. If you suspect we have collected data from a child without the required authorization, please contact us.
11. Changes to the Privacy Policy
We reserve the right to modify this privacy policy. Changes will be published on our Website. The date of the last revision is stated at the bottom. We advise you to consult this policy regularly. In the event of significant changes that substantially affect your rights or the way we process your data, we will actively inform you, e.g., via email or a clear notice on the Website.
12. Contact Details
If you have questions about this privacy policy, the processing of your personal data, or wish to exercise your rights, you can contact us via email: info@story-magic.ai, or via our contact page. You can also reach us via WhatsApp (WhatsApp Ireland Ltd., a Meta Platforms company). WhatsApp then processes your phone number and communication metadata under its own privacy policy; using it is voluntary and an e-mail enquiry is always an equivalent option. Please do not send us photos of your child via WhatsApp – use the protected upload in the book wizard instead.
This privacy policy was last updated on October 13, 2026.