Privacy Policy

We care about privacy — especially about protecting children. This document explains what personal data we process, why, for how long, and what rights you have.

1. Data controller

The controller of personal data within the meaning of Regulation (EU) 2016/679 (the "GDPR") and Act No. 110/2019 Coll. is:

• Name: Lukáš Kantor, a self-employed individual doing business under the Czech Trade Licensing Act
• Company ID (IČO): 03177009, registered office: Milíkov 244, 739 81 Milíkov
• Contact e-mail for data protection matters: contact@heroofthebook.nz

Which privacy law protects you. We are established in the Czech Republic, so we process all personal data under the GDPR (Article 3(1)). Because we carry on business in New Zealand, the Privacy Act 2020 applies to us as well, even though we have no place of business there and process the data outside New Zealand (section 4(1)(b), (2) and (3) of that Act). We comply with both, including the information privacy principles in section 22 of the Privacy Act 2020. Where they differ, you get the protection of whichever is stronger.

2. What data we process

• Identification and contact data: name, e-mail, and possibly phone number and delivery address.
• Account data: e-mail and a secured (hashed) password.
• Order and book content: the child's name, an optional dedication, the selected story, texts.
• Photographs of the characters: portrait photographs uploaded in order to create the illustrated characters. A book may have up to five characters, so besides the child's photograph these may be photographs of siblings, friends, parents or grandparents, that is of adults as well. This is personal data; in the case of children we pay special attention to it (see Art. 4).
• A photograph uploaded into a gift add-on: your own photograph, which you may optionally place into a gift card instead of an illustration and which is then printed (see Art. 4).
• Content of a review: the rating, the text of the review, the name displayed with the review and an optionally attached photograph or video (see Art. 12).
• Payment data: for card payments these are processed by the payment gateway and we store only the payment status and its identifier. For payment by bank transfer we ourselves keep the payment request (the payment reference, the amount, our account number, the e-mail address to which the details are sent and the due date) and the bank advice of the credited payment; that advice also contains the identification of the payer — as a rule the name, possibly the account number — as the bank communicates it to us.
• Interest in a launch in a given country: the e-mail address you enter in the form on the page for a country where we are still preparing the service, together with the information whether you confirmed it by clicking in the confirmation e-mail. Until you confirm the address, we send nothing to it.
• Data on participation in the friends promotion: the e-mail address from the order under which the sharing code arises, the number of recommended purchases and the rewards issued (see Art. 5a).
• Data of partners in the affiliate program: for applicants and partners, additionally the name or business name, business registration number (IČO or its local equivalent), VAT ID, billing address, a description of the promotional channel, bank account number, and an overview of commissions and issued invoices.
• Technical data: IP address, cookies, and logs necessary for operation and security.

3. Purposes and legal bases of processing

• Performance of a contract (Art. 6(1)(b) GDPR) — creating and delivering the book, maintaining the account, handling orders and complaints; for payment by bank transfer also issuing the payment request and matching the incoming payment to the order (without which we would not know what has been paid); for partners, assessing the application, recording referrals and commissions, and paying them out under the affiliate program terms.
• Compliance with legal obligations (point (c)) — accounting and tax documents.
• Consent (point (a)) — processing the uploaded photographs of the characters and of a photograph placed into a gift add-on (see Art. 4); publishing a review including the name and any attached photograph or video on our website and on our social media profiles (see Art. 12); sending the newsletter and personalized offers based on data inferred about the family and the purchase history (see Art. 5); sending a notice of the launch of the service in a country you expressed interest in through the form on the page of a country in preparation (confirmed by clicking in the confirmation e-mail); analytics and marketing cookies, including measuring advertising effectiveness (see Art. 10). Consent may be withdrawn at any time.
• Legitimate interest (point (f)) — securing the website, preventing misuse, and measuring traffic without cookies: even without your consent we determine the aggregate number of page views, without storing anything on your device or reading anything from it and without being able to recognise you on a subsequent visit (in detail in Art. 10).

4. Uploaded photographs and the consent of the persons depicted

The service is not intended for persons under 18 years of age. An account is always created and an order always placed by an adult (Art. 1 of the Terms and Conditions); we therefore process data about children — the name, the photograph and the text of the dedication — exclusively from their legal guardians, or from persons who have the guardians' consent. We do not knowingly collect personal data directly from a child; if we find that any have reached us in that way, we delete them.

Information about the child and about the other characters in the book reaches us from the person placing the order, not from them. Information privacy principle 3A of the Privacy Act 2020, in force since 1 May 2026, requires us to make sure the person concerned is aware of that collection, its purpose, the recipients and their rights of access and correction. This policy sets all of that out, and it is shown to the person ordering, who is the child's guardian or acts with the guardian's consent; we ask them to tell any other adult whose photograph they upload. You and the people in the book may ask us for access to their information and for its correction at any time (information privacy principles 6 and 7).

We use the photographs solely to create the illustrated characters for the ordered book, or to print an ordered gift add-on. A book may have up to five characters and a photograph may be uploaded for each of them — so this is not necessarily only the child, but also siblings, friends, parents or grandparents. In a gift card you may in addition place your own photograph instead of an illustration, and it is then printed on the ordered add-on.

By uploading a photograph you confirm that you are the legal guardian of the child depicted or that you have the consent of the child's legal guardian, and, in the case of an adult, that you have that person's consent. At the same time you grant consent to the processing of the photograph for the stated purpose.

The photograph is not used for profiling, for recognizing individuals across services, or for training artificial intelligence models, and we do not share it with third parties beyond the processors necessary to create the book (see Art. 6). We keep it securely for the duration of your account so that you can edit your book at any time or build on it with a sequel (see Art. 8). You may request the erasure of your data, including photographs, at any time at the contact e-mail address; consent may likewise be withdrawn at any time, and withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Personalization and profiling for marketing purposes

From the text of the dedication and from the order history we infer who bought the book and what their relationship to the child is (e.g., parent, grandparent), so that we can send you a personalized offer (typically an offer of a second book). This is profiling within the meaning of Art. 4(4) GDPR — however, it has no legal or similarly significant effects on you; it merely tailors the content of a marketing e-mail. This processing takes place only with your marketing consent (see Art. 3 and Art. 10) and you have the right to object to it at any time under Art. 21 GDPR (see the rights in Art. 9) — you may withdraw your consent at any time at the contact e-mail address or via the unsubscribe link in the e-mail, and you will no longer receive personalized offers.

In New Zealand, marketing e-mails are also governed by the Unsolicited Electronic Messages Act 2007. We send them only with your consent (section 9), every message identifies us (section 10) and contains a working unsubscribe link (section 11), and we act on an unsubscribe request within 5 working days.

5a. Friends promotion

Everyone who pays for an order with us receives a sharing code for the friends promotion. The code is tied to the e-mail address of the order, so that a buyer without a user account receives it too; with that address we keep the number of recommended purchases, the period during which the code actively earns rewards, and the reward coupons issued. The legal basis is the performance of an obligation arising from the public promise by which the promotion is announced (Art. 6(1)(b) GDPR).

If a new customer comes to us through someone else's code, we keep that customer's e-mail address (or account) with the referral — this prevents one person from being counted and rewarded repeatedly. The identity of the referred person is not shown to the referrer; they see only the number of referrals and the progress towards the reward.

We keep the data on participation in the promotion for the duration of the account, in the case of a buyer without an account for the period during which the code or an issued reward may be valid, and thereafter for the period required by law for accounting documents. If you do not wish to take part in the promotion, write to us and we will invalidate the code.

6. Recipients and processors

To provide the service we use vetted processors who process the data on the basis of a contract and solely in accordance with our instructions:

• Payment gateway provider — payment processing; payment card details never reach us at all.
• Our bank — carries out the payment transaction where payment is made by transfer. It is not our processor: the bank is an independent controller and processes the data under Act No. 370/2017 Coll., on payment transactions, and under its own rules. From the bank advice we receive the amount credited, the payment reference and the identification of the payer (see Art. 2).
• Cloud storage provider — secure storage of files (photographs, illustrations, PDFs) with data located in the EU.
• Provider for sending transactional e-mails.
• Providers of AI technologies for generating text and illustrations and for narrating the audiobook — processing of image and text inputs in order to create the book; when an audiobook is ordered, the text of the book, including the child's name, is also passed to the voice synthesis provider. We use exclusively the paid modes of these services, in which the providers do not use your inputs (including photographs) to train their models. Some of them may also operate outside the EU/EEA (see Art. 7).
• Advertising and analytics platforms — Google (Analytics 4, Google Ads), Microsoft (Clarity), Meta Platforms (Pixel and Conversions API), and Seznam.cz (Sklik). Data that makes it possible to recognise a visitor is transferred to them only if the relevant cookie consent is given. Without consent, Google receives only an anonymous record of a page view without any identifier whatsoever (see Art. 10); nothing at all is sent to the other platforms in that case.
• Hosting provider; for orders of a printed book, additionally the print partner and the carrier it engages. Printed books are not delivered to New Zealand, so for New Zealand orders no print partner or carrier receives your data.

Under section 11 of the Privacy Act 2020, information that a provider holds solely to process it for us counts as held by us, and we remain responsible for it.

7. Where your data is processed

We process your data in the European Union. Some processors may process data outside the EU/EEA as well (particularly in the USA). In such cases the transfer is secured by appropriate safeguards under the GDPR: the European Commission's standard contractual clauses, or the recipient's participation in the EU–US Data Privacy Framework. Data passing between New Zealand and the European Union needs no further safeguard under the GDPR, because the European Commission has recognised that New Zealand ensures an adequate level of protection (Decision 2013/65/EU).

Under the Privacy Act 2020, a provider that processes data only on our behalf does not receive it as a disclosure (section 11), and we remain responsible for it. Where data is disclosed to an independent recipient abroad, we do so only where the recipient is subject to privacy laws that, overall, provide comparable safeguards to those in the Privacy Act 2020, such as the GDPR (information privacy principle 12(1)(c)).

8. Retention periods

• Uploaded photographs of the characters and a photograph placed into a gift add-on: for the duration of the account (so that you can edit the book or build on it at any time), or until an erasure request is handled.
• Order data and accounting documents: for the period laid down by law (usually up to 10 years for tax documents).
• Account data and created books: for the duration of the account, or until an erasure request is submitted.
• An unfinished book without a completed order for a visitor without an account: 6 months from the last edit. After that we automatically and irreversibly delete it, including the uploaded photograph of the child. If you want to keep an unfinished book longer, create an account — it will then be kept for as long as the account exists.
• Data on participation in the friends promotion: for the duration of the account; in the case of a buyer without an account for the period during which the sharing code or an issued reward may be valid, and thereafter only to the extent required by law for accounting documents.
• Partner data: for the duration of participation in the affiliate program; billing and payment data on tax documents then for the period laid down by law (usually up to 10 years). Data from a rejected application is kept for the duration of the applicant's account, or until an erasure request is handled.
• Reviews: we display a published review including the name and any attached photograph or video until consent is withdrawn. After withdrawal we stop publishing it, delete the attached photograph or video, and also delete the post we published from the review on our social media profiles. We keep a record that a review of the book has already been created even after that — it prevents the reward for a review from being claimed repeatedly.
• Newsletter: until consent is withdrawn.
• Interest in a launch in a given country: until consent is withdrawn, but no longer than one year from the launch of the service in that country. An unconfirmed address is deleted no later than one year after it was entered.
• Analytics and marketing data: in Google Analytics 4 we keep user data for 14 months. Recordings of on-page behavior in Microsoft Clarity are kept for 30 days from capture (for tagged and randomly sampled recordings up to 9 months), aggregate statistics longer. For advertising platforms, the periods are governed by their own terms. Your cookie choice is stored in the browser until you revoke it.

9. Your rights

In relation to your personal data you have the right:

• of access to the data and to a copy of it,
• to rectification of inaccurate data,
• to erasure (the "right to be forgotten"),
• to restriction of processing,
• to data portability,
• to object to processing based on legitimate interest, including profiling for direct marketing purposes (see Art. 5) — once you object, we no longer process your data for that purpose,
• to withdraw a given consent at any time.

You can exercise your rights at the contact e-mail address. Under the Privacy Act 2020 you may ask us for access to your personal information and for its correction (information privacy principles 6 and 7); we respond to an access request as soon as reasonably practicable and no later than 20 working days after we receive it (section 44 of that Act).

If you are not satisfied with how we handle your data, you may complain to the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909) under section 70 of the Privacy Act 2020. The Commissioner usually expects you to raise the matter with us first, so please write to us and give us the chance to put it right. Because we are established in the Czech Republic, you may also lodge a complaint under Article 77(1) of the GDPR with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz), which is the lead supervisory authority for our processing under Articles 55 and 56 of the GDPR.

10. Cookies and measurement tools

We divide cookies into three categories. Necessary cookies always run, because the website does not work without them. Analytics and marketing cookies are stored only after you give consent in the cookie bar. Without consent no analytics or marketing cookie is stored or read and the Microsoft Clarity, Meta Pixel and Sklik scripts are not downloaded at all.

The only exception is the measurement of traffic without cookies described below: the Google measurement code loads even without consent, but sends only an anonymous record of a page view. It stores nothing on your device and reads nothing from it, assigns you no identifier and will not recognise you on your next visit. Because this is neither the storing of information in your terminal equipment nor gaining access to information already stored there, such measurement does not require consent under Article 5(3) of Directive 2002/58/EC (in the Czech Republic Section 89(3) of Act No. 127/2005 Coll., on electronic communications); under the GDPR we carry it out on the basis of our legitimate interest (Article 6(1)(f)) in knowing how many people visit the website and which pages they look at. You may object to this processing at any time (see Art. 9).

• Necessary — signing in and maintaining the session, an unfinished book, recording referrals within the affiliate program, protecting forms against misuse (Cloudflare Turnstile), storing your cookie choice, and recording which page and possibly which campaign you came to the website from (the `attr_first` and `attr_last` cookies) — we use this to evaluate where it pays off to promote the website, not to track you across other websites. Legal basis: legitimate interest in operating and securing the website and in evaluating the effectiveness of promotion.
• Analytics — Google Analytics 4 and Microsoft Clarity. These serve for traffic statistics and for understanding which parts of the website are easy to understand. In Google Analytics, measurement is carried out with IP address anonymization. Microsoft Clarity additionally captures a recording of movement across the page (mouse movement, clicks, scrolling, window resizing) and builds so-called heatmaps from it. This is not screen or camera capture: the recording is a reconstruction of the page in the browser and is configured in the mode of masking all text and images, so that neither the child's name, the photograph, the dedication text, nor anything you fill into a form is transferred into it. The `_clck` and `_clsk` cookies serve to recognize that individual page views belong to a single visit. Without analytics consent, the Clarity script is not loaded at all and Google Analytics stores no cookie — it measures only anonymously and without cookies, as described above and below.
• Marketing — Google Ads, Meta Pixel (Facebook, Instagram), and Sklik (Seznam.cz). These serve to evaluate the effectiveness of advertising (how many orders came from which campaign) and to display more relevant advertising, including re-engaging visitors who did not complete an order.

With Google tools we use Consent Mode v2 in its so-called advanced variant. Until you give consent, all consent categories are set to "denied": Google may neither store nor read any cookie, may not use the data for advertising or personalisation, and advertising click identifiers are stripped from the data sent. What remains is only an anonymous record of a page view (the page address, where you came from, an approximate location at the level of country or region derived from the IP address, the type of device and browser), from which Google estimates overall traffic. Such a record does not identify you and cannot be linked to you personally or to a previous visit. If you give consent, measurement switches to the normal mode with cookies.

In connection with advertising we also process campaign parameters (UTM parameters and the click identifiers gclid / fbclid), which we store with the order so that we know which source it came from. After an order is paid, we also pass purchase data to Meta (the order value and the e-mail in the form of an irreversible fingerprint — a hash), so that the conversion can be attributed to the correct advertisement. This processing likewise takes place only if marketing consent is given.

Consent is voluntary and not giving it has no effect whatsoever on your ability to order a book. You can change your choice at any time using the "Cookie settings" link in the website footer, or manage cookies directly in your browser settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Security

We take appropriate technical and organizational measures — encrypted transmission (HTTPS), storage of passwords in the form of a secure fingerprint, access control, and private access to files via a proxy. However, no measure guarantees absolute security. If a privacy breach occurs that has caused or is likely to cause you serious harm, we notify the Privacy Commissioner and you as soon as practicable (sections 114 and 115 of the Privacy Act 2020), and we also notify the Office for Personal Data Protection and, where required, you under Articles 33 and 34 of the GDPR.

12. Reviews

After the book has been delivered we may offer you the option of writing a review. A review is voluntary and we process it on the basis of your consent (Art. 6(1)(a) GDPR), which you give directly in the form before submitting it.

• Purpose: publishing a reference so that other parents have something to go by.
• Scope: the rating, the text of the review, the name you enter with the review and, optionally, an attached photograph or video. Both the name and the attached file are displayed publicly — the file is accessible to anyone who knows its address, even without signing in. Upload only what you want to be public, and consider this especially carefully for photographs and videos of children.
• Where we publish the review: on our website and on our social media profiles (Facebook, Instagram, YouTube, TikTok). We store the wording of the consent you ticked in the form together with the review — for older reviews, which did not concern social media, publication remains limited to the website.
• Recipients: the public (visitors to the website and to the social media profiles), the operators of those networks as independent controllers (Meta Platforms Ireland, Google Ireland for YouTube, TikTok Technology Limited) and the cloud storage provider (see Art. 6). Once published on a network the content is beyond our control — a visitor can download it or share it further, and we cannot delete such copies.
• Publication: we review a submission before publishing it and we are not obliged to publish it.
• Photographs and videos of other people: if another person appears in the attached file, we need that person's permission in order to disseminate their likeness (Sections 84 and 85 of Act No. 89/2012 Coll., the Civil Code), and in the case of a child the permission of the legal guardian — you confirm this to us by ticking the box in the form. Under Section 87 of that Act the permission may be withdrawn at any time. If the law of your own country requires more (for example a written consent or the consent of the child as well), that requirement applies in addition.
• Withdrawal of consent: you may withdraw your consent at any time at the contact e-mail address — we will stop displaying the review, delete the attached photograph or video and also take down the post published on social media. Withdrawal does not affect the lawfulness of processing carried out before it. Details of the retention periods are in Art. 8.

13. Changes to these policies

We may update these policies. We will announce material changes on the website, or by e-mail. The current version is always available on this page.