Privacy at Lunoland
Lunoland makes personalised children’s books. To do that, you trust us with something precious: photos of your child. This page explains exactly what we collect, what we do with it, and how little of it we keep. Lunoland is operated from the United Kingdom and this policy is written for UK law (UK GDPR and the Data Protection Act 2018). We follow the ICO’s Children’s Code: we collect the minimum we need, keep it the shortest time we can, and never use your family’s data for anything you wouldn’t expect.
Who we are
The data controller is LUNOLAND LTD (trading as Lunoland, lunoland.co.uk), a company registered in England and Wales, company number 17363841, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact us any time at hello@lunoland.co.uk.
What we collect
Only what the book needs: the photos you upload; the names, ages and relationships of the people in the book (and whether each child is a girl or a boy); a pet’s name; your chosen story, art style, language and optional dedication; your email address so we can deliver the book and let you sign in; and, for a printed book, the name, postal address and phone number it should be posted to. When you pay, your card details go directly to Stripe, our payment processor: they never touch our servers, and we store only a payment reference and the amount paid. We do not collect passwords, or anything from your child directly: Lunoland is used by parents and guardians, and you provide your child’s information on their behalf.
Why we can use it (lawful basis)
We process your order details and photos because you asked us to make your book (performance of a contract). Where the law treats a child’s images with special care, we rely on the consent you give as their parent or guardian when you place the order, which you can withdraw at any time by asking us to delete the book.
Your photos are deleted automatically
Uploaded photos exist for one purpose: creating your book’s characters. They are deleted automatically 24 hours after your book is delivered. If an order fails or doesn’t complete, the photos are deleted automatically after 7 days at the latest: the short grace period lets us fix a failed book without asking you to upload again. We never publish your photos and never use them to train AI.
The character artwork we keep, and why
Making your book creates illustrated character drawings of your child and family (not photographs: stylised artwork in your chosen style). We keep these with your finished book because every picture in it is drawn from them: when you redraw a page on your book page, or ask us to put one right, the new picture is made from the same drawings, so the faces stay the same. They are visible only to you, used only for your own book, and never shared, published, or used for anything else. They stay as long as your book stays in your account, and we delete them (along with the book, or your whole account) whenever you ask, by emailing hello@lunoland.co.uk.
Companies that help us make your book (our processors)
We share data only with the services that do the work, under contracts that bind them to protect it: the AI service that writes and illustrates the book (it receives your photos and story details, does not use them to train its models, and holds them only briefly for abuse monitoring), Stripe (takes your payment: your card details go straight to Stripe and are never stored on our servers), our hosting company (runs the website and stores your photos and books), our email service (sends our emails), our analytics service (see “How we count visits” below), and, only if you order a printed book, our printing partner in the UK (they receive the book file and the delivery name, address, phone number and email address, so they can print and post it), and an independent review platform (it receives your email address and order reference, once, so it can ask you for a review; see “Email” below). We never sell data. Only if you allow it do we tell the ad services where we advertise which ad brought you here (see “Ads: only if you allow it” below).
Where your data is kept
Some of these companies are in the United States, and our servers are there too, so your photos, books and order details leave the UK. UK law allows this when the company receiving the data is bound by the transfer terms the UK approves, and each of ours is: their contracts with us include the standard contractual clauses with the UK’s International Data Transfer Addendum, which the Information Commissioner’s Office publishes. Our printing partner is in the UK, and our analytics stay on servers in the EU, which UK law treats as safe.
One cookie, and only when you sign in
Signing in works by emailed link: no passwords. When you click your link we set one cookie (luno_account) that keeps you signed in for 30 days. It contains only your signed email address, is essential for sign-in to work at all, and tracks nothing. Because it is strictly necessary, UK law (PECR) does not require a consent banner for it, and we set no other cookies. The “optional cookies” the box on your first visit asks about are, strictly, codes kept in your browser’s storage, which works like a cookie: screen recordings and ad measurement, both described below, and both off unless you accept.
How we count visits, and how to switch it off
To see how many people visit, which pages they open and where they get stuck, we use an analytics service. It keeps a random visitor number in your browser’s storage, so that one person counts as one person. That number holds no name, email or photo. We use these counts only to improve Lunoland, and they stay with us and that service. UK law lets a website count visits like this without a pop-up, as long as it tells you and lets you say no. Only if you allow it in the box we show on your first visit, the service also records how the site is used on screen, so we can find and fix confusing steps; what you type into a form is hidden from those recordings. To say no to all counting, use the button below: it stops all counting and recording on this device, and the ad measurement described below, and it remembers your choice.
Ads: only if you allow it
When you arrive from one of our ads, the link carries a click code that the ad service (Google or ChatGPT) added: a random code, with no name in it. Only if you allow it, we keep that code in your browser for the visit and, if you order, we send it to that ad service with the time and amount of the order, so it can count that its ad led to an order and help us spend less on ads. We never send your name, email, address or photos. If you don’t allow it, the code is not kept, so no ad service can connect your visit or your order to you; ChatGPT’s ad service is only told that an order happened, with its time and amount. We still see which of our ads a visitor came from, from our own label on the link, to count our own visits. We keep and send the code only with your consent, and you can change your answer here at any time:
Email: only what you asked for
We email you your book, your sign-in links, and messages about an order in progress. Three days after your book is ready (or a week after a printed book arrives), an independent review platform emails you once, on our behalf, to ask what you thought. Every customer gets that one email, whatever happened with their order; you can ignore it, and it has an unsubscribe link.
Your rights
You can ask us at any time to: see the data we hold about your family, correct it, delete it (including finished books and character artwork), or receive a copy. Email hello@lunoland.co.uk. We’ll act within one month. If you’re unhappy with our answer you can complain to the Information Commissioner’s Office (ico.org.uk).