Privacy Policy

1. Who we are

“StorySurprise” is a trading name of EthicsLab Limited, acting as the data controller for the personal data described below.

2. What we collect

We collect only what we need to run the reader and respond to you:

Information you submit.When you request a custom story, ask for changes before unlocking, or contact us, we store your name, email address, and the text you send (story ideas, change notes, or general messages). Custom-story requests may also include your child's name(s), budget preference, optional reference photos, and any details you add for a quote.

Story reading. Share links are private tokens — we do not require an account to read. We store which share link was opened only as needed to deliver the story and process unlock payments.

Payments. Paid unlocks are processed by Stripe. We receive confirmation that a payment succeeded and may store the payer email Stripe provides. We do not receive or store your full card number.

Photos. If you upload reference photos with a story request, they are stored in a private Supabase Storage bucket and used only to prepare your quote or custom book.

Server and analytics. Vercel hosts this site and records standard request logs (IP address, user agent, path, timestamp) for security and abuse prevention. We use Vercel Web Analytics for aggregate, privacy-friendly traffic metrics — no third-party advertising pixels.

3. Why we collect it

We use the data above only to:

• Deliver shared story previews and full unlocks.
• Process one-time Stripe payments for paid stories.
• Respond to custom story quotes, change requests, and general enquiries.
• Diagnose errors and keep the service secure.

We do not sell your data, share it with advertisers, or use it to train external advertising or recommendation models.

4. Sub-processors

We rely on a small set of vendors that may process your data on our behalf. Each is contractually bound to our instructions:

Stories are created in StoryWhisk (our studio) using Google Cloud AI services. Inputs you provide for a custom quote may be reviewed by our team; we do not send your contact details to Google for that purpose.

5. How long we keep data

Form submissions and unlock records are kept while we need them to fulfil your request or meet legal obligations. You may ask us to delete information you submitted via the contact form; we will action verified requests within 14 days.

6. Data export

You have the right to a copy of the personal data we hold about you. Submit a contact formmessage with the subject line “Data export” from the email address linked to your enquiry, and we will reply within 14 days with a machine-readable copy of the fields we store.

If you live in the UK or the EU, you also have the right to object to processing, ask us to correct inaccurate data, ask us to restrict processing, and complain to a supervisory authority — for the UK that is the Information Commissioner's Office.

7. Children

StorySurprise delivers stories for children, but the site is operated for parents and guardians. We do not knowingly collect personal data directly from anyone under 13. If you believe a child submitted data without a guardian, contact us via the contact form and we will delete it.

8. Changes to this policy

If we materially change this policy, we will:

1. Update the Last updated date at the top of this page.
2. Post a notice on the home page linking to the current version.

You can always view the current policy at storysurprise.store/privacy.

9. Contact

Questions, complaints, exports, deletions — use our contact form.