Your photos and privacy.

Updated 6 November 2026. This notice covers story drafts, previews, saved books and fulfilment.

Who is responsible

Craven & Quill is operated by Luke Craven in Dubai, United Arab Emirates. We decide how information is used to provide this preview and manage the launch list.

Your story draft

You can add optional favourite things, hobbies and everyday details, then ask us to write or update a story. Your first name, reading level, story choices, optional details and any edited draft or requested changes are sent through our server to OpenAI to provide the story you request. Only add information you are allowed to share. Leave out surnames, addresses, schools and private or sensitive information. The service is for adults; for a child, you must be their parent or guardian or have their permission.

Your browser saves your unfinished draft and uploaded photo on this device for up to seven days after your last edit. Use Start fresh to remove that local copy, especially on a shared device. If you request an emailed return link after creating a preview, we store an encrypted copy of the story and illustrated character on our server. The private link expires after seven days. Original uploaded photos and delivery addresses are not included in that return-link copy. Resend sends the link to the email you provide. Anyone with the private link can access that draft. Expiry blocks access; it does not promise immediate deletion from hosting backups. Story-writing requests use a separate aggregate daily count to control costs; they do not create a signup, send an email or count as a successful picture preview.

Your free preview

You enter a first name, reading age, story choices and a photo. Your browser sends these to our website server and OpenAI's drawing service to create your character. This processing is necessary to provide the preview you request. Avoid surnames, addresses, school names or other private details in your story.

Original uploaded photos are retained locally in your browser draft, not in our order storage. Generated illustrations and story text can be saved privately when you request a return link or save an order, as described here. OpenAI and our hosting providers may process and retain service data under their own security and retention policies. We do not promise immediate deletion from their systems.

The service is for adults. Only upload a photo of yourself, or someone whose permission you have. For a child, you must be their parent or guardian or have that person's permission. We do not use photos to identify people, target adverts or train our own AI model.

If you save or order a book

When you choose Save my book, we privately store your story, first names, approved illustrated characters, dedication, email, chosen size and recipient delivery address. We use these to prepare, review and fulfil the book you request. Your original uploaded photo is not saved by this order feature; the illustrated character is saved. Our team can review this material. Keep the private order link safe: anyone with that link can access your book.

Full-book illustration requests send the approved illustrated character and relevant story scene to OpenAI. After payment and both customer and owner proof approval, we send the approved print files and recipient name and delivery address to Prodigi to print and ship the book. We do not send the original uploaded photo to the printer. Private file links used by the printer expire after seven days. Payments are handled securely by Ziina. This website stores the payment reference and status, but not your card details. Order emails are sent through Resend. Saving a book does not subscribe you to marketing.

We review unpaid saved books and artwork after 90 days and delete them when no longer needed. Order artwork is reviewed 90 days after fulfilment; financial and order records may need longer retention for tax, refunds and disputes. Contact us for access, corrections or deletion. Retention reviews are manual during this pilot, not automatic deletion. Private order cookies last up to 30 days.

Your preview email

When you request a free preview, we save your email, the request time and broad country in our website database, even if you do not finish the book journey. We also save campaign codes and link the email to your visit, as described under how we measure visits. We use this to manage preview requests and understand interest in the service. This does not subscribe you to marketing, place an order or confirm buying intent. Your email is not sent to the drawing service or Meta. We review preview-contact records after 90 days and delete them when no longer needed. Contact us to request deletion.

If you join the launch list

Only after you choose to join, we additionally save your email permission, preferred book format and its displayed price, your confirmation of buying interest, the campaign code that brought you here, country supplied by our host, and a record of your email permission. We use your consent to email you when these storybooks are ready to order. A free preview does not require joining the list.

We keep launch-list information until launch or withdrawal of consent, and review whether it is still needed after 90 days. We may retain the minimum consent or suppression record necessary to honour your choice and resolve complaints. Joining does not place an order or charge you.

Every launch email will include your personal unsubscribe link. You can also request access, correction, deletion or withdrawal of consent through our published contact address.

How we measure visits

We measure visits without cookies and without saving anything on your device. When you arrive, your visit is given a random reference that travels in the page address while you use the site. We record which pages and book-maker steps you reach, the campaign codes in the link you arrived from, your broad country, whether you use a phone or a computer, a shortened version of your IP address (the last part removed, so it points to a network area rather than your device) and the town and region our host estimates from it. If you request a preview, give your preview email or save a book, we link those to the same visit so we can see what was made and where people get stuck. No photos, names, story text or reading age are included in these records. Only Craven & Quill sees them, in a private owner dashboard, and we rely on our legitimate interest in understanding how the site and our advertising perform. We delete the shortened IP, town and these links after 90 days.

We also keep daily page totals with no visitor reference at all, so we can check the visit records against them.

Advertising measurement

Google and Meta may receive connection information, browser details and advertising identifiers to measure the adverts that bring people to our site, using cookies. Google measures saved preview-email requests separately from paid sales. A preview request is not a marketing subscription or a purchase. We do not send your email, phone number, address, photo, name, story or reading age to either advertising service. Automatic customer-data matching is disabled. Advertising scripts are not loaded on private book pages.

We keep the advertising click reference and campaign codes on your device for up to 30 days. We may store the reference with a preview request or order and report it to Google or Meta alongside a random conversion receipt or order number, its time, currency and actual amount paid. Our protected server reports allow a verified payment to be measured even if you close the payment page. A confirmed full refund changes its reported value to zero. Reports exclude our own test traffic and contain only the last 90 days of eligible events. Advertising measurement does not authorize follow-up emails.

You can turn advertising measurement off at any time; we remember that on this device, and you can turn it back on. Turning it off stops future browser reports, clears advertising cookies we can access, and suppresses pending server reports linked to your current visit. It does not erase information already received by an advertising service. Contact us to withdraw server reporting for earlier visits or orders.

Provider processing and international transfers are described in Google’s privacy policy and Meta’s privacy policy. We do not enable advertising personalisation or customer audience lists through this Google integration.

Service providers and security

Our website uses OpenAI Sites and Cloudflare hosting and database services, and OpenAI for story writing and drawing. These services and the operator may process information outside the UK. We limit the information sent to what the requested feature needs. The website uses HTTPS; access to the launch list requires a private access token.

Our hosting services receive ordinary connection information, including IP addresses. We use limited technical information and daily story-writing and drawing counts to protect the service against abuse and control costs, based on our legitimate interest in operating a reliable service.

Your choices

Depending on your circumstances, you can request access, correction, deletion, restriction or a portable copy of your information, object to processing based on legitimate interests, or turn off advertising measurement. Withdrawal does not affect processing already carried out. UK visitors can raise a concern with the Information Commissioner's Office.

For provider details see OpenAI's privacy policy and Cloudflare's privacy policy.