Privacy Policy

We care about privacy — especially about protecting children. This document explains what personal data we process, why, for how long, and what rights you have.

1. Data controller

For a visitor and customer in the United Kingdom, the applicable law is the UK GDPR — Regulation (EU) 2016/679 as retained in the law of the United Kingdom under section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data (Use and Access) Act 2025 — together with the Data Protection Act 2018. Because the controller is established in the Czech Republic, the EU version of the same Regulation and Act No. 110/2019 Coll. apply to the same processing as well. The two texts impose the same duties and the article numbering is identical, so where this document refers to "the GDPR" and to an article number, both are meant.

The controller of personal data is:

• Name: Lukáš Kantor, a self-employed individual doing business under the Czech Trade Licensing Act
• Company ID (IČO): 03177009, registered office: Milíkov 244, 739 81 Milíkov
• Contact e-mail for data protection matters: contact@heroofthebook.co.uk

Representative in the United Kingdom. Under Article 27 of the UK GDPR, we have appointed Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom, as our representative in the United Kingdom. It is the point of contact for you and for the UK supervisory authority (the Information Commissioner's Office, ICO) on all matters relating to the processing of your personal data. You can contact it, or exercise your rights through it, at https://app.prighter.com/portal/15918961802. You can also write to us directly at the contact email address above.

2. What data we process

• Identification and contact data: name, e-mail, and possibly phone number and delivery address.
• Account data: e-mail and a secured (hashed) password.
• Order and book content: the child's name, an optional dedication, the selected story, texts.
• Photographs of the characters: portrait photographs uploaded in order to create the illustrated characters. A book may have up to five characters, so besides the child's photograph these may be photographs of siblings, friends, parents or grandparents, that is of adults as well. This is personal data; in the case of children we pay special attention to it (see Art. 4).
• A photograph uploaded into a gift add-on: your own photograph, which you may optionally place into a gift card instead of an illustration and which is then printed (see Art. 4).
• Content of a review: the rating, the text of the review, the name displayed with the review and an optionally attached photograph or video (see Art. 12).
• Payment data: for card payments these are processed by the payment gateway and we store only the payment status and its identifier. For payment by bank transfer we ourselves keep the payment request (the payment reference, the amount, our account number, the e-mail address to which the details are sent and the due date) and the bank advice of the credited payment; that advice also contains the identification of the payer — as a rule the name, possibly the account number — as the bank communicates it to us.
• Interest in a launch in a given country: the e-mail address you enter in the form on the page for a country where we are still preparing the service, together with the information whether you confirmed it by clicking in the confirmation e-mail. Until you confirm the address, we send nothing to it.
• Data on participation in the friends promotion: the e-mail address from the order under which the sharing code arises, the number of recommended purchases and the rewards issued (see Art. 5a).
• Data of partners in the affiliate program: for applicants and partners, additionally the name or business name, business registration number (IČO or its local equivalent), VAT ID, billing address, a description of the promotional channel, bank account number, and an overview of commissions and issued invoices.
• Technical data: IP address, cookies, and logs necessary for operation and security.

3. Purposes and legal bases of processing

• Performance of a contract (Art. 6(1)(b) GDPR) — creating and delivering the book, maintaining the account, handling orders and complaints; for payment by bank transfer also issuing the payment request and matching the incoming payment to the order (without which we would not know what has been paid); for partners, assessing the application, recording referrals and commissions, and paying them out under the affiliate program terms.
• Compliance with legal obligations (point (c)) — accounting and tax documents.
• Consent (point (a)) — processing the uploaded photographs of the characters and of a photograph placed into a gift add-on (see Art. 4); publishing a review including the name and any attached photograph or video on our website and on our social media profiles (see Art. 12); sending the newsletter and personalized offers based on data inferred about the family and the purchase history (see Art. 5); sending a notice of the launch of the service in a country you expressed interest in through the form on the page of a country in preparation (confirmed by clicking in the confirmation e-mail); analytics and marketing cookies, including measuring advertising effectiveness (see Art. 10). Consent may be withdrawn at any time.
• Legitimate interest (point (f)) — securing the website, preventing misuse, and necessary cookies without which the website does not work (in detail in Art. 10).

4. Uploaded photographs and the consent of the persons depicted

The service is not intended for persons under 18 years of age. An account is always created and an order always placed by an adult (Art. 1 of the Terms and Conditions); we therefore process data about children — the name, the photograph and the text of the dedication — exclusively from their legal guardians, or from persons who have the guardians' consent. We do not knowingly collect personal data directly from a child; if we find that any have reached us in that way, we delete them. In the United Kingdom a child may consent to an information society service from the age of 13 (section 9 of the Data Protection Act 2018) — our threshold is deliberately higher, so a child's own consent is never something we rely on.

We use the photographs solely to create the illustrated characters for the ordered book, or to print an ordered gift add-on. A book may have up to five characters and a photograph may be uploaded for each of them — so this is not necessarily only the child, but also siblings, friends, parents or grandparents. In a gift card you may in addition place your own photograph instead of an illustration, and it is then printed on the ordered add-on.

By uploading a photograph you confirm that you are the legal guardian of the child depicted or that you have the consent of the child's legal guardian, and, in the case of an adult, that you have that person's consent. At the same time you grant consent to the processing of the photograph for the stated purpose.

The photograph is not used for profiling, for recognizing individuals across services, or for training artificial intelligence models, and we do not share it with third parties beyond the processors necessary to create the book (see Art. 6). We keep it securely for the duration of your account so that you can edit your book at any time or build on it with a sequel (see Art. 8). You may request the erasure of your data, including photographs, at any time at the contact e-mail address; consent may likewise be withdrawn at any time, and withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Personalization and profiling for marketing purposes

From the text of the dedication and from the order history we infer who bought the book and what their relationship to the child is (e.g., parent, grandparent), so that we can send you a personalized offer (typically an offer of a second book). This is profiling within the meaning of Art. 4(4) GDPR — however, it has no legal or similarly significant effects on you; it merely tailors the content of a marketing e-mail. This processing takes place only with your marketing consent (see Art. 3 and Art. 10) and you have the right to object to it at any time under Art. 21 GDPR (see the rights in Art. 9) — you may withdraw your consent at any time at the contact e-mail address or via the unsubscribe link in the e-mail, and you will no longer receive personalized offers.

Sending marketing e-mail to a subscriber in the United Kingdom is additionally governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426). We send commercial e-mail either with your prior consent, or — under the exception in regulation 22(3) — to our own customers whose address we obtained in the course of a sale, about similar products, where they were given the opportunity to refuse at the time and are given it in every message. Every message identifies us and contains a working unsubscribe link, which takes effect immediately. Compliance with these Regulations is supervised by the Information Commissioner's Office (see Art. 9).

5a. Friends promotion

Everyone who pays for an order with us receives a sharing code for the friends promotion. The code is tied to the e-mail address of the order, so that a buyer without a user account receives it too; with that address we keep the number of recommended purchases, the period during which the code actively earns rewards, and the reward coupons issued. The legal basis is the performance of an obligation arising from the unilateral offer by which the promotion is announced (Art. 6(1)(b) GDPR).

If a new customer comes to us through someone else's code, we keep that customer's e-mail address (or account) with the referral — this prevents one person from being counted and rewarded repeatedly. The identity of the referred person is not shown to the referrer; they see only the number of referrals and the progress towards the reward.

We keep the data on participation in the promotion for the duration of the account, in the case of a buyer without an account for the period during which the code or an issued reward may be valid, and thereafter for the period required by law for accounting documents. If you do not wish to take part in the promotion, write to us and we will invalidate the code.

6. Recipients and processors

To provide the service we use vetted processors who process the data on the basis of a contract and solely in accordance with our instructions:

• Payment gateway provider — payment processing; payment card details never reach us at all.
• Our bank — carries out the payment transaction where payment is made by transfer. It is not our processor: the bank is an independent controller and processes the data under Act No. 370/2017 Coll., on payment transactions, and under its own rules; a bank from which you send the payment likewise acts as an independent controller under its own law (in the United Kingdom the Payment Services Regulations 2017). From the bank advice we receive the amount credited, the payment reference and the identification of the payer (see Art. 2).
• Cloud storage provider — secure storage of files (photographs, illustrations, PDFs) with data located in the EU.
• Provider for sending transactional e-mails.
• Providers of AI technologies for generating text and illustrations and for narrating the audiobook — processing of image and text inputs in order to create the book; when an audiobook is ordered, the text of the book, including the child's name, is also passed to the voice synthesis provider. We use exclusively the paid modes of these services, in which the providers do not use your inputs (including photographs) to train their models. Some of them may also operate outside the EU/EEA (see Art. 7).
• Advertising and analytics platforms — Google (Analytics 4, Google Ads), Microsoft (Clarity) and Meta Platforms (Pixel and Conversions API). Data is transferred to them only if the relevant cookie category is allowed (see Art. 10); otherwise nothing at all is sent to them, not even an anonymous record of a page view.
• Hosting provider; for orders of a printed book, additionally the print partner and the carrier it engages.

7. Transfers outside the United Kingdom and the EEA

Some processors may process data outside the United Kingdom and the European Economic Area as well, particularly in the USA. For a transfer out of the United Kingdom, the safeguard is the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses — both issued by the Information Commissioner under section 119A of the Data Protection Act 2018. For a transfer to a certified recipient in the USA, the UK–US data bridge applies, that is the UK extension to the EU–US Data Privacy Framework, recognised by the Data Protection (Adequacy) (United States of America) Regulations 2023 (SI 2023/1028). For the same processing under the EU GDPR we rely on the European Commission's standard contractual clauses, or on the recipient's participation in the EU–US Data Privacy Framework. A copy of the safeguards used is available on request at the contact e-mail address.

8. Retention periods

• Uploaded photographs of the characters and a photograph placed into a gift add-on: for the duration of the account (so that you can edit the book or build on it at any time), or until an erasure request is handled.
• Order data and accounting documents: for the period laid down by law (usually up to 10 years for tax documents).
• Account data and created books: for the duration of the account, or until an erasure request is submitted.
• An unfinished book without a completed order for a visitor without an account: 6 months from the last edit. After that we automatically and irreversibly delete it, including the uploaded photograph of the child. If you want to keep an unfinished book longer, create an account — it will then be kept for as long as the account exists.
• Data on participation in the friends promotion: for the duration of the account; in the case of a buyer without an account for the period during which the sharing code or an issued reward may be valid, and thereafter only to the extent required by law for accounting documents.
• Partner data: for the duration of participation in the affiliate program; billing and payment data on tax documents then for the period laid down by law (usually up to 10 years). Data from a rejected application is kept for the duration of the applicant's account, or until an erasure request is handled.
• Reviews: we display a published review including the name and any attached photograph or video until consent is withdrawn. After withdrawal we stop publishing it, delete the attached photograph or video, and also delete the post we published from the review on our social media profiles. We keep a record that a review of the book has already been created even after that — it prevents the reward for a review from being claimed repeatedly.
• Newsletter: until consent is withdrawn.
• Interest in a launch in a given country: until consent is withdrawn, but no longer than one year from the launch of the service in that country. An unconfirmed address is deleted no later than one year after it was entered.
• Analytics and marketing data: in Google Analytics 4 we keep user data for 14 months. Recordings of on-page behavior in Microsoft Clarity are kept for 30 days from capture (for tagged and randomly sampled recordings up to 9 months), aggregate statistics longer. For advertising platforms, the periods are governed by their own terms.
• Choice in the cookie bar: it is valid in your browser for 180 days, after which we ask you again. We keep the anonymous record of the choice (see Art. 10) for 3 years.

9. Your rights

In relation to your personal data you have the right:

• of access to the data and to a copy of it,
• to rectification of inaccurate data,
• to erasure (the "right to be forgotten"),
• to restriction of processing,
• to data portability,
• to object to processing based on legitimate interest, including profiling for direct marketing purposes (see Art. 5) — once you object, we no longer process your data for that purpose,
• to withdraw a given consent at any time.

You can exercise your rights at the contact e-mail address; we answer within one month (Art. 12(3) GDPR), which we may extend by a further two months for a complex request. You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom that is the Information Commissioner's Office (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk/make-a-complaint, helpline 0303 123 1113); you may turn to it directly, because the United Kingdom is not part of the one-stop-shop mechanism, so the ICO will not refer your complaint anywhere else. For the same processing under the EU GDPR the lead authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz) under Articles 55 and 56 of that Regulation. Beyond a complaint, you may claim compensation in court (Art. 82 UK GDPR and section 168 of the Data Protection Act 2018).

10. Cookies and measurement tools

We divide cookies into three categories. Necessary cookies always run, because the website does not work without them. We store analytics and marketing cookies only after you give your consent in the cookie bar. Until you consent, no analytics or marketing cookie is stored or read, and measurement and advertising scripts are not loaded at all.

The consent for analytics and marketing cookies is required by regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426). It permits storing information on your device, or gaining access to information already stored there, only with your consent and after clear information about the purpose. The only exception is what is strictly necessary to provide the service you asked for.

• Necessary — signing in and maintaining the session, an unfinished book, protecting forms against misuse (Cloudflare Turnstile), and storing your choice in the cookie bar. This also includes the code from a referral link (the `ref` cookie), but only while it gives you the discount you asked for by clicking the link. If the code serves only so that the partner receives a commission, it is stored only if marketing cookies are allowed. The legal basis is our legitimate interest in operating and securing the website and in providing the discount.
• Analytics — Google Analytics 4 and Microsoft Clarity. These serve for traffic statistics and for understanding which parts of the website are easy to understand. In Google Analytics, measurement is carried out with IP address anonymization. Microsoft Clarity additionally captures a recording of movement across the page (mouse movement, clicks, scrolling, window resizing) and builds so-called heatmaps from it. This is not screen or camera capture: the recording is a reconstruction of the page in the browser and is configured in the mode of masking all text and images, so that neither the child's name, the photograph, the dedication text, nor anything you fill into a form is transferred into it. The `_clck` and `_clsk` cookies serve to recognize that individual page views belong to a single visit. If the analytics category is not allowed, neither the Google Analytics nor the Clarity script is loaded at all.
• Marketing — Google Ads and Meta Pixel (Facebook, Instagram). These serve to evaluate the effectiveness of advertising (how many orders came from which campaign) and to display more relevant advertising, including re-engaging visitors who did not complete an order. This category also includes our `attr_first` and `attr_last` cookies, which remember which page and possibly which campaign you came to the website from.

With Google tools we use Consent Mode v2 in its basic variant. As long as neither the analytics nor the marketing category is allowed, the Google measurement code is not loaded at all and nothing is sent to Google, not even an anonymous record of a page view. Once a category is allowed, your choice is also passed to the code, so Google uses the data only to the extent of the categories you have allowed.

In connection with advertising we also process campaign parameters (UTM parameters and the click identifiers gclid / fbclid), which we store with the order so that we know which source it came from. After an order is paid, we also pass purchase data to Meta (the order value and the e-mail in the form of an irreversible fingerprint, known as a hash), so that the conversion can be attributed to the correct advertisement. Both take place only if marketing cookies are allowed.

Consent is voluntary and not giving it has no effect whatsoever on your ability to order a book. The "Reject all" button is available in the cookie bar just as readily as "Accept all", and closing the bar with the cross (×) has the same effect as rejecting. You can change your choice at any time using the "Cookie settings" link in the website footer, or manage cookies directly in your browser settings. Your choice is valid for 180 days, after which the cookie bar is shown again. If your browser sends a Global Privacy Control signal, we treat it as a refusal of marketing cookies, and they cannot be switched on in the cookie bar. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

For every choice in the cookie bar we keep an anonymous record: a random number known only to your browser, the country of the website, the version of the cookie bar, the allowed categories, the way the choice was made (accepting, rejecting, saving settings, closing the bar) and the time. We do not store an IP address, browser data or any link to an account with it, so it cannot be used to determine who made the choice. It serves so that we can demonstrate that we have consent (Article 7(1) UK GDPR), and we keep it for 3 years.

11. Security

We take appropriate technical and organizational measures — encrypted transmission (HTTPS), storage of passwords in the form of a secure fingerprint, access control, and private access to files via a proxy. However, no measure guarantees absolute security.

12. Reviews

After the book has been delivered we may offer you the option of writing a review. A review is voluntary and we process it on the basis of your consent (Art. 6(1)(a) GDPR), which you give directly in the form before submitting it.

• Purpose: publishing a reference so that other parents have something to go by.
• Scope: the rating, the text of the review, the name you enter with the review and, optionally, an attached photograph or video. Both the name and the attached file are displayed publicly — the file is accessible to anyone who knows its address, even without signing in. Upload only what you want to be public, and consider this especially carefully for photographs and videos of children.
• Where we publish the review: on our website and on our social media profiles (Facebook, Instagram, YouTube, TikTok). We store the wording of the consent you ticked in the form together with the review — for older reviews, which did not concern social media, publication remains limited to the website.
• Recipients: the public (visitors to the website and to the social media profiles), the operators of those networks as independent controllers (Meta Platforms Ireland, Google Ireland for YouTube, TikTok Technology Limited) and the cloud storage provider (see Art. 6). Once published on a network the content is beyond our control — a visitor can download it or share it further, and we cannot delete such copies.
• Publication: we review a submission before publishing it and we are not obliged to publish it. We publish only genuine reviews from genuine customers and we never write or commission one — a fake review, or concealing that a review was incentivised, is a banned practice under paragraph 13 of Schedule 20 to the Digital Markets, Competition and Consumers Act 2024, and that provision also requires us to take reasonable steps to check the reviews we display.
• Photographs and videos of other people: if another person appears in the attached file, we need that person's permission to publish it, and in the case of a child the permission of the legal guardian — you confirm this to us by ticking the box in the form. The law of the United Kingdom recognises no general right of publicity, so that permission matters here as a matter of data protection (the person is identifiable from the image) and, where someone's image would be used in a way suggesting they endorse us, as a matter of the law of passing off. The permission, like the consent to publication, may be withdrawn at any time. If the law of your own country requires more (for example a written consent or the consent of the child as well), that requirement applies in addition.
• Withdrawal of consent: you may withdraw your consent at any time at the contact e-mail address — we will stop displaying the review, delete the attached photograph or video and also take down the post published on social media. Withdrawal does not affect the lawfulness of processing carried out before it. Details of the retention periods are in Art. 8.

13. Changes to these policies

We may update these policies. We will announce material changes on the website, or by e-mail. The current version is always available on this page.