Privacy Policy
Last updated: 27 July 2026
Fable & Kin is not yet a registered legal entity — until it is, this Service is operated by the individual running Fable & Kin, trading as “Fable & Kin”, New Zealand. A registered entity name and address will be added here before a general public launch.
1. Who we are
Fable & Kin is a service that lets you create a personalised, AI-illustrated children’s book. The book is built from a story idea and details you provide, including the name, description, and (optionally) a photograph of the child the book is about.
We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). If you are located outside New Zealand, additional protections may apply to you under your local laws; you can contact us at any time to exercise privacy rights available to you.
Questions, requests, or complaints about privacy can be sent to hello@fableandkin.org.
2. The personal information we collect
We collect only the information needed to create your book, fulfil your order, and run the service safely.
Information you give us:
- Contact details— your email address. You can create an optional account (via our sign-in provider, Clerk) to manage your books later, but most of the wizard works before you ever sign in; we don’t store your password, our sign-in provider holds it.
- Story content you author — your story idea, the occasion, a dedication, the title, and your style choices.
- Character details — the names, roles, and descriptions of the characters in your book.
- Child photographs— if you choose to upload one or more photographs of a child to guide the illustrations. We treat children’s photographs as sensitive information and apply the additional safeguards described in sections 6 and 7. Before your first photo upload on a book, we ask you to confirm you have the right to use it, and we record that confirmation.
- Order and delivery details— for printed books, the recipient ’s name and shipping address, entered directly with our payment processor (Stripe). Stripe passes us a phone number only if it collects one; we don’t separately require it.
Information created as you use the service:
- Your generated book — the story text and illustrations produced from your inputs.
- An activity log — a record of actions on your book (inputs you submit, AI generation steps, status changes, and payment confirmations). Append-only and best-effort — the source we use to compile your information if you ask for a copy, not a guaranteed complete record of every interaction.
- Draft and session identifiers — a guest-session identifier and book-access cookies so a draft you start before signing in can later be linked to your account or a shared link.
Information collected automatically:
- Payment information — when you pay, you enter your card details directly with Stripe on its secure checkout. We never receive or store your full card number. We retain a Stripe checkout reference, the amount, and the currency.
- Analytics and product usage — we use PostHog to understand how the service is used. This includes usage events and identifiers; once you give us your email we associate your analytics profile with it. Session recording and input autocapture are switched off. See section 4 for cookies.
- Error and performance data — we use Sentry to detect and fix faults. Default PII capture is switched off; this may still include technical details about your device and the actions leading to an error.
- Security and anti-abuse signals — Cloudflare Turnstile and rate-limiting protect the service from abuse, involving a guest/session identifier, your email, and an IP-derived key or token.
- Service and reminder emails— if you start a book and don’t finish it, we may email you a reminder (using your email, book title, and cover image) a few days later.
3. Why we use your information, and our lawful basis
We use your information to create your personalised book; generate and refine story text and illustrations using the AI providers listed in section 5; check uploaded content for safety (section 6); take payment, print, and ship your order; send you service emails about your order, account, and unfinished drafts; understand and improve the service through analytics and error monitoring; and protect the service and our users from fraud and abuse.
Before we process a child’s photograph, we ask you to affirmatively confirm you have the right to use it and we log that confirmation. For customers in regions that require a formal lawful-basis analysis, our bases are the performance of our contract with you, your affirmative confirmation for children’s photographs, and our legitimate interests in operating and securing the service.
4. Cookies and similar technologies
New Zealand law doesn’t require a cookie-consent banner the way some other jurisdictions do — it requires that we give you clear notice of what we collect and why. This section is that notice.
| Cookie / identifier | Category | Purpose | Duration |
|---|---|---|---|
| fk_guest | Necessary | Remembers your draft before you sign in | 90 days |
| fk_book | Necessary | Links a shared/emailed book to your browser | Up to 90 days |
| fk_attribution | Non-essential (analytics) | Records the referring site/campaign on your first visit | 90 days |
| PostHog identifiers | Non-essential (analytics) | Usage/journey tracking, linked to your email once given | Set by PostHog |
| Clerk cookies | Necessary | Keeps you signed in, only on the account area | Set by Clerk |
| Stripe / Turnstile | Necessary | Hosted checkout and bot protection | Provider-controlled |
We don’t currently offer an in-product cookie-preference toggle. Until we do, you can block or delete cookies through your browser’s own settings — this may stop the wizard remembering your draft — or email hello@fableandkin.organd we’ll manually exclude you from analytics tracking.
5. Who we share information with (our processors)
We do not sell your personal information. We share it only with service providers who process it on our behalf, under contract. Several are located overseas, so your information may be stored or processed outside New Zealand.
| Provider | Purpose | Data shared |
|---|---|---|
| Vercel | Website hosting | Service traffic and content |
| Supabase | Database and file storage | Account, book content, and uploaded photographs |
| Clerk | Sign-in (optional account area only) | Email and authentication identifier |
| Inngest | Background job processing | Book-generation tasks |
| Anthropic | Story text generation, moderation, photo-safety and quality checks | Story inputs, character details, and photographs (for safety checks) |
| fal.ai | Illustration generation | Character descriptions and photographs. Illustrations are currently generated using Google's Nano Banana Pro / Gemini image model, accessed through fal.ai — Google may also process this content as an underlying model provider. |
| Stripe | Payment processing | Payment and billing details (entered directly with Stripe) |
| Resend | Sending service emails | Email address and order details |
| Gelato | Printing and shipping | Recipient name, shipping address, and the finished book |
| PostHog | Product analytics | Usage events and identifiers, linked to your email once provided |
| Sentry | Error and performance monitoring | Technical error and device data |
| Cloudflare (Turnstile) | Bot protection and abuse prevention | Security signals |
We only use conditional providers (like Turnstile) when they’re actually switched on, and will update this list as our providers change.
AI providers and training.We do not use your content to train our own models. Anthropic’s and fal.ai’s current standard terms exclude customer content from being used to train their models; fal.ai’s “never train” commitment is explicitly an enterprise-tier guarantee, and the underlying image model in use can change, so we can’t promise this is contractually guaranteed the way an enterprise agreement would be. We minimise what we send: photographs re-hosted on fal’s storage are set to expire automatically rather than persisting indefinitely.
6. How we keep children’s photographs and content safe
- Authority and confirmation.Before your first photo upload on a book, we ask you to confirm you are the child’s parent or guardian, or have their permission, and that you’re comfortable with the photo being processed as described here. We log that confirmation (with a timestamp and wording version) so it applies to every photo you upload for that book.
- Automated photo-safety screening.Uploaded photographs and story text pass through automated checks designed to catch unsafe content. These are automated safeguards, not a guarantee — if a check can’t run, we don’t block your upload on it, so please only upload photographs you’re comfortable using.
- Restricted access. Uploaded photographs are stored privately in Supabase and retrieved only through short-lived, signed links. They are also sent to fal.ai to generate your illustrations; we apply a short automatic expiry to that copy rather than letting it persist indefinitely.
7. How long we keep information, and deletion
- Child photographs. We schedule your original uploaded photographs for deletion once you approve your book, and automatically delete photographs from draft books inactive for 30 days. You can also delete them yourself anytime from your account page, or ask us at hello@fableandkin.org. The copy sent to fal.ai expires automatically within a short window.
- Generated character data.Deleting your original photograph does not delete the character description, generated reference sheet, finished illustrations, or book files — we keep these to provide, and if needed reprint or correct, your finished book. Tell us if you’d like these removed too.
- Account and order records are kept for as long as you have an account, and afterwards as needed to meet legal, accounting, and tax obligations.
- Activity log is retained as part of our records and audit trail, protected against everyday alteration or deletion.
8. Your privacy rights
Under the New Zealand Privacy Act 2020 you have the right to access the personal information we hold about you, and request correction if it is wrong.
You can also delete your uploaded photographs yourself from your account page, ask us to delete them, ask questions about how we handle your information, or withdraw a confirmation you’ve given. To make a request, email hello@fableandkin.org. We will respond within the timeframes required by law, and may need to verify your identity first.
If you are not satisfied with how we have handled your information, you can complain to us, and you may also contact the Office of the Privacy Commissioner (New Zealand) at privacy.org.nz. Customers in other regions may have additional rights under their local laws.
9. Security
We use technical and organisational measures to protect your information: database access controls so your data isn’t read directly by a browser; private storage of photographs with short-lived, signed links; an append-only activity log; automated photo-safety and content moderation; bot protection and rate-limiting; and card payments handled entirely through Stripe. A shared book-review link is protected by a hard-to-guess link rather than requiring sign-in — treat it like any private link. No method of storage or transmission is completely secure, but we work to protect your information and respond promptly to any issues.
10. Children using the service
Fable & Kin is intended to be used by adults creating a book for or about a child. It is not directed at children. We do not currently verify age when someone uses the Service. If you believe a child has provided us with personal information, please contact us so we can address it.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.
12. Contact us
Fable & Kin, New Zealand — hello@fableandkin.org. See also our Terms of Service.