GDPR & Data Processing

Last updated: 4 August 2026

This notice explains how ItsMySaga handles personal data under the EU General Data Protection Regulation (GDPR), including why we use it, who receives it, how long we keep it, and the rights available to you.

Who controls your data

Sagora Publishing AB, company registration number 559475-0274, operates ItsMySaga and is the data controller for personal data collected through this storefront and service. Contact us about any privacy question or request at:

privacy@itsmysaga.com

This notice should be read together with our Privacy Policy and Cookie Policy.

On this page

Personal data we process

The data depends on how you use ItsMySaga and may include:

  • Account and contact details, such as your name, email address and sign-in information.
  • Book-personalisation data, including a child's name, age, interests, an original photo used to create the character, generated characters, stories and book files.
  • Order and delivery data, such as recipient name, shipping address, phone number, products and order status.
  • Payment and transaction data. Stripe processes full payment details; we receive transaction references and payment status rather than full card numbers.
  • Messages you send to support and transactional email delivery information.
  • Technical and security data, including IP address, device, browser, logs, errors and service interactions.
  • Consent choices and, only with consent, analytics and advertising identifiers, page visits and campaign interactions.

Service providers and other recipients

We disclose only the data reasonably needed for each service. Provider roles can differ by feature: some act only on our instructions, while regulated payment and advertising services may also act as independent or joint controllers.

Amazon Web Services (AWS)Processor for cloud servicesCountry/regionSweden (Stockholm)
Purpose
Backend hosting, PostgreSQL database, Redis cache, file and PDF storage, queues, PDF generation, logs, networking and security.
Data involved
Account, book-personalisation, uploaded and generated files, order, support and technical data, depending on the AWS service used.
Transfer details
Our AWS services use eu-north-1. AWS may process limited data outside the selected Region where necessary to provide or maintain its services or comply with law; AWS's DPA includes Standard Contractual Clauses for applicable transfers.
Provider privacy information
VercelProcessor for storefront hosting and deliveryCountry/regionGlobal; primarily United States
Purpose
Hosting and delivering the storefront, including server-side rendering, routing, caching, deployment and security.
Data involved
IP address, request metadata, device and browser information, URLs, essential cookies and data included in requests handled by the storefront.
Transfer details
The current deployment serves users through nearby edge locations, while server-side processing may occur in the United States. Vercel's DPA incorporates the EU Standard Contractual Clauses.
Provider privacy information
OpenRouterProcessor and gateway to our AI model providersCountry/regionUnited States; model-provider countries
Purpose
Routing generation requests to OpenAI and Google for character, story and book-illustration creation.
Data involved
Depending on the step: the original photo, generated character reference, child's name, age and interests, story and image prompts, generated output and technical request metadata.
Transfer details
OpenRouter passes inputs to the selected model provider. Its DPA incorporates Standard Contractual Clauses, and each model provider may have different retention practices.
Provider privacy information
OpenAIAI model provider engaged through OpenRouterCountry/regionGlobal; including United States
Purpose
Generating final page and cover illustrations, including the child's illustrated likeness, from the generated character reference and story prompts.
Data involved
Generated character reference, child's name and age, story and image prompts, and generated illustrations. The current page-and-cover flow does not send the original uploaded photo to OpenAI.
Transfer details
Requests are routed through OpenRouter; OpenRouter's DPA and the applicable OpenAI model terms govern onward processing and transfers.
Provider privacy information
Google AI (Gemini)AI model provider engaged through OpenRouterCountry/regionGlobal; including EEA and United States
Purpose
Generating the initial illustrated character reference from the original photo, and generating story text and scene prompts from the supplied details and generated character reference.
Data involved
Original photo and age during initial character generation; generated character reference, child's name, age and interests, book template and story prompts during story generation.
Transfer details
Requests are routed through OpenRouter; OpenRouter's DPA and the applicable Google model terms govern onward processing and transfers.
Provider privacy information
LangSmith (LangChain)Processor for AI observabilityCountry/regionNetherlands (EU); possible United States access
Purpose
Recording AI request traces to monitor generation quality, failures and performance.
Data involved
Story and image prompts, a generated-story preview, generated-character reference URLs, child age, template and model metadata, errors and technical request identifiers. The current character-generation flow does not trace the original uploaded photo to LangSmith.
Transfer details
We use the EU regional endpoint at eu.api.smith.langchain.com. LangChain is a United States company, and support access or subprocessors may involve international transfers under the applicable terms.
Provider privacy information
Cloudprinter.comProcessor for order management and global print fulfilmentCountry/regionNetherlands (company); hosting location not disclosed; fulfilment worldwide
Purpose
Receiving, storing, routing and managing print orders; providing order status; and printing, packaging and delivering physical books.
Data involved
Book and cover print files through temporary download links, order and item identifiers, recipient name, email address, phone number, full shipping address, and fulfilment and status data.
Transfer details
Cloudprinter.com B.V. is established in the Netherlands. Its public privacy notice does not identify a specific data-centre country; it states that Cloudprinter uses third-party hosting providers and may transfer or make data accessible worldwide. Order data is also shared with the production and logistics partners selected for fulfilment. Cloudprinter states that it may retain customer data while our account is active and afterwards where needed for legal obligations, disputes, fraud prevention or enforcement.
Provider privacy information
Postmark (AC PM LLC)Processor for transactional emailCountry/regionUnited States; subprocessor countries
Purpose
Sending account, order, delivery and support emails and monitoring their delivery.
Data involved
Name, email address, message content, delivery status, IP address and email metadata.
Transfer details
Postmark's approved subprocessors may operate in other countries. Its DPA incorporates Standard Contractual Clauses.
Provider privacy information
StripeProcessor and independent controller for regulated payment purposesCountry/regionEEA, United States and other countries
Purpose
Payment processing, fraud prevention, refunds, financial reporting and legal compliance.
Data involved
Payment method, billing and shipping details, name, email, IP address, transaction and order information.
Transfer details
Stripe's DPA and transfer addendum set out the applicable transfer mechanisms.
Provider privacy information
Google AnalyticsProcessor for standard analytics; controller for data shared under enabled Google data-sharing settingsCountry/regionGlobal; including EEA and United States
Purpose
Understanding site use and improving the storefront, only after Analytics consent.
Data involved
Online identifiers, approximate location, device and browser information, pages viewed and interactions.
Transfer details
Google's data-processing and controller terms govern the role and transfer mechanism that applies to the configured account settings.
Provider privacy information
Meta (Facebook and Instagram)Processor, joint controller or independent controller depending on the processing described in Meta's Business Tools TermsCountry/regionGlobal; including EEA and United States
Purpose
Advertising measurement, attribution, campaign reporting and relevant advertising, only after Marketing consent.
Data involved
Browser and advertising identifiers, IP address, page visits, ad-click information and events such as starting checkout or purchasing.
Transfer details
Meta's Business Tools Terms and transfer addenda govern its different processing roles.
Provider privacy information
TikTokProcessor, joint controller or independent controller depending on the Business Product and purposeCountry/regionGlobal; including EEA and other countries
Purpose
Advertising measurement, attribution, campaign optimisation and relevant advertising, only after Marketing consent.
Data involved
Cookie and advertising identifiers, IP address, device information, page visits, campaign data and purchase-related events.
Transfer details
TikTok's Business Products Data Terms describe the applicable role and safeguards.
Provider privacy information
SentryProcessor for application monitoringCountry/regionUnited States; subprocessor countries
Purpose
Error reporting, performance monitoring, service reliability and diagnosing technical problems.
Data involved
Error details, URL, IP address, device and browser information, technical events and identifiers included in monitored requests.
Transfer details
Approved subprocessors may operate in other countries. Sentry's DPA provides transfer mechanisms including Standard Contractual Clauses.
Provider privacy information

International transfers

Our core backend infrastructure and customer-data storage on AWS are configured in Sweden, and LangSmith trace storage uses its EU region. The storefront is delivered through Vercel's global network, and several other providers process personal data outside the EEA. Where required, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses, an applicable Data Privacy Framework certification, or another lawful mechanism, together with supplementary contractual, organisational and technical safeguards where appropriate. Contact us to request information about the safeguards relevant to your data.

How long we keep data

We keep personal data only for as long as needed for the purpose collected, then delete or anonymise it unless law or a legal claim requires longer retention. The main criteria are:

  • Account and support data: while your account or support matter remains active, followed by a limited period for recovery, security and disputes.
  • Orders, transactions and invoices: for fulfilment, warranty and the statutory accounting and claims periods that apply.
  • Original photo: until character generation succeeds; we then remove it from the child's record and delete the uploaded file from active storage. Generated character and book content: for creation, delivery, reprints and support, followed by deletion or anonymisation under the service's operational and backup cycles.
  • Security and error logs: for the shortest period reasonably needed to secure and diagnose the service.
  • Cookie consent: the preference cookie lasts six months; provider cookies have the durations listed in the Cookie Policy.

Children's data and photos

ItsMySaga is intended for adults purchasing for a child. A parent, guardian or other authorised adult must provide the child's data and confirm they have authority to do so. We use the original photo only to generate the illustrated character. Once generation succeeds, our service removes the photo from the child's record and deletes the uploaded file from active storage. We retain the generated character and book artwork to create and fulfil the requested book. Do not submit more information than the book requires.

AI and automated processing

We use OpenRouter to route generation requests to Google AI and OpenAI. In the current service, Google creates the initial character reference and story, while OpenAI creates the final page and cover illustrations. This creative processing does not make decisions that produce legal or similarly significant effects about you or the child.

Your GDPR rights

Depending on the circumstances, you may ask us to:

  • Confirm whether we process your data and provide a copy.
  • Correct incomplete or inaccurate data.
  • Delete data when no lawful reason requires us to keep it.
  • Restrict processing while an issue is reviewed.
  • Provide eligible data in a structured, commonly used, machine-readable format.
  • Object to processing based on legitimate interests or direct marketing.
  • Withdraw consent at any time without affecting earlier lawful processing.
  • Complain to a data protection supervisory authority.

Security

We use access controls, encryption in transit, provider security controls, monitoring and restricted staff access appropriate to the risk. No online service can guarantee absolute security, but we review safeguards and limit provider access to what is needed for the service.

Requests and complaints

Email privacy@itsmysaga.com to exercise a right or ask about this notice. We may need to verify your identity before disclosing or changing data and normally respond within the period required by GDPR.

You can also lodge a complaint with Sweden's data protection authority, the Swedish Authority for Privacy Protection (IMY).