This translation is provided for information only. In case of any discrepancy, the Spanish version prevails.
Last updated: 6 October 2026
🔒
At Iraya Books we keep your child's photo for a maximum of 30 days, only to check that the character looks like them and to improve it if not. After that it is deleted automatically. It is not used to train AI, it is not shared, and you can ask for it to be deleted sooner.
The generated illustrations are kept in private storage for a maximum of 2 years, and we delete them sooner if you ask us to.
1. Who are we?
Iraya Books is a service that creates personalised children's stories using artificial intelligence. The data controller is Norelyn Galindez. You can contact us at fernando@irayabooks.com.
2. What data do we collect?
Photo of the child: it is used to create the illustrated portrait of the character and is kept encrypted in private storage for a maximum of 30 days to check the quality of the character. It is deleted automatically when that period ends, or sooner if you ask (by writing to fernando@irayabooks.com). The AI providers to which we send the image to draw the character may temporarily retain samples for abuse review in accordance with their terms (section 3).
Generated illustrations (derivatives): the illustrated portrait of the character, the cover and the pages of the book are AI-generated drawings based on the photo. As they are recognisable, we also treat them as personal data of the child (see section 4).
Name and age of the child: These are used only to personalise the text and illustrations of the story.
Email: We use it for notifications about your order (confirmation, approved/at the printer, shipping) and to send you the preview you have created (your little one's cover) so that you can pick it up again if you left it half-finished. We never pass your email on to third parties for commercial purposes.
Commercial communications (news and offers about our own stories): only in two cases. (a) If you have made a purchase, we may send you information about our own products similar to those you have already bought, on the basis of legitimate interest and under art. 21.2 of the LSSI (Ley 34/2002, the Spanish Information Society Services and E-commerce Act); we give you the option to object at the time of purchase (a box at checkout) and in every email we send you. (b) If you have not made a purchase, only if you expressly tick the optional box “Also tell me about news and offers from Iraya Books”, which is unticked by default and separate from creating your story (art. 6(1)(a) of the GDPR, the EU General Data Protection Regulation). In both cases you can withdraw your consent or object at any time, without giving reasons and without affecting your order: all our commercial emails include an unsubscribe link, and you can also write to us. We keep the date and the version of the text of the box you ticked as proof of that consent.
Delivery address and phone number (physical orders): These are used exclusively to print and deliver your book.
Consent record: when you tick the consent box we store the date, the IP address and the version of the text accepted, as proof that the parent or guardian authorised the processing.
3. Processing of images of minors
We understand how sensitive photographs of children are. That is why:
The photo is transmitted encrypted (HTTPS/TLS) between your browser and our server.
It is processed to create the illustrated portrait of the character and stored encrypted in private storage, separately from the illustrations, for a maximum of 30 days.
It is sent to the artificial intelligence services that create the drawing, exclusively to generate the illustrations for your story: Microsoft (Azure AI Foundry) to create the illustrated portrait of the character, and Google (Vertex AI) for the rest of the book's illustrations and as an alternative if the former is not available. Both act as data processors and do not use your data to train their models. As required by their own security systems, both providers may temporarily retain samples for abuse review in accordance with their terms —Microsoft may keep the image and have it reviewed solely to detect misuse of its service (for example, illegal content), and Google may log the request for up to 90 days if its classifiers detect suspicious activity—, after which they delete it. They do not use it for any other purpose or to train their models.
Only the Iraya Books team can access the photo, with authenticated and logged access; it is deleted automatically after 30 days and as soon as you request it.
We automatically check that the uploaded photo is appropriate (a real child, dressed, in an everyday situation) and reject any that are not.
We also keep, for the same 30-day period, the photos that our automatic filter discards for quality reasons (blurry, no visible face, very small), whether the rejection happens when the photo is chosen or when the story is created, to check that the filter gets it right and to correct it when it gets it wrong. We only keep them if you have ticked the consent box. Photos rejected for inappropriate content are never kept.
4. What do we store, and for how long?
The generated illustrations (character portrait, cover and the book PDF) are stored in Google Cloud Storage in a private bucket: they are not publicly accessible, only through protected links that we send to you or that the printer uses to produce your book.
Retention period: a maximum of 2 years from their creation, with automatic deletion when that period ends. We keep them for that time so that we can reprint your book or deal with complaints. You can ask us for early deletion at any time (section 7) and we will do it within a maximum of 30 days.
The original photo of the child: in the same private bucket, for a maximum of 30 days and solely to check that the character looks like the child (sections 2 and 3).
Order data: the child's name, age, chosen story, email, delivery address and date, to manage your order and meet the tax and accounting obligations required by law.
5. Legal basis and data processors
The processing is based on your explicit consent when you upload the photo (Art. 6(1)(a) GDPR) and on the performance of the contract to manage your order and delivery (Art. 6(1)(b) GDPR). As this is data relating to minors, consent is given by the parent or legal guardian using the service (as declared in the consent box).
The holder of the account and of the order is always a person aged 18 or over —a parent or legal guardian— who uses the service and gives consent on behalf of the child. The service is not intended for people under 18, who may not contract it (see clause 5 of the Terms and conditions).
We work with the following data processors, all under a data processing agreement (DPA) in accordance with Art. 28 GDPR:
Microsoft (Azure AI Foundry): creates the illustrated portrait of the character from the photo. It receives only the image; it does not receive your email, your address or your order details. It does not use your data to train models, and the developer of the drawing model has no access to it.
Google Cloud (Vertex AI, Cloud Storage, Firestore): generation of the rest of the book's illustrations and storage. It does not use your data to train models.
Gelato (printer): receives the book PDF, the name and the delivery address, exclusively to print and deliver your order.
Google Workspace: sending transactional emails.
Stripe (payment gateway): Stripe Payments Europe, Ltd. (Ireland) takes payment for your order. It receives your name, your email, the amount and the billing and delivery address, and your card details, which you enter directly into its embedded form and which never pass through our server: Iraya Books neither sees nor stores them. Stripe uses them to process the payment and, as an independent controller, to prevent fraud and comply with its legal obligations.
6. International transfers
The illustrated portrait of the character —the step in which the photo is used— is generated by Microsoft (Azure AI Foundry), whose servers may be located outside the European Economic Area. This transfer is covered by the European Commission adequacy decision for the EU-US Data Privacy Framework, under which Microsoft Corporation is certified, and additionally by the standard contractual clauses (SCCs) included in Microsoft's data processing agreement (DPA) as an additional safeguard.
The Google Cloud servers we use are in the United States: that is where the photo is processed and stored (in private storage, for a maximum of 30 days) and where the illustrations and order data are generated and stored. This transfer is covered by the European Commission adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified, and additionally by the standard contractual clauses (SCCs) included in Google Cloud's data processing agreement as an additional safeguard. In practice, your data enjoys the same protection in the US as the GDPR requires.
Orders for Spain are printed and delivered by Gelato using printers located in the European Union, so the book PDF and the delivery address do not leave the EU at that stage.
Payment is processed by Stripe Payments Europe, Ltd. (Ireland), within the European Union, which may share payment data with its parent company Stripe, Inc. (United States) and the rest of its group. This transfer is covered by the European Commission adequacy decision for the EU-US Data Privacy Framework, under which Stripe, Inc. is certified, and additionally by the standard contractual clauses (SCCs) included in Stripe's data processing agreement (DPA) as an additional safeguard.
7. Your rights
Under the GDPR, you can exercise your rights of access, rectification, erasure, portability and objection by writing to: fernando@irayabooks.com. We handle erasure requests within a maximum of 30 days (we delete the portraits, the cover and the PDF, and anonymise the order record). You can also lodge a complaint with the Agencia Española de Protección de Datos (the Spanish Data Protection Agency).
8. Cookies
This site only sets measurement cookies if you expressly accept them in the consent banner. If you accept them, we use Google Analytics 4 (site usage statistics) and, when campaigns are running, the Meta pixel (ad measurement). If you reject them, no tracking tool is loaded and the site works exactly the same; we only use your browser's local storage to remember your preferences (language, consent). You can withdraw your consent by clearing this site's data in your browser.
On the payment screen we load Stripe.js, which sets the cookies Stripe needs to process the payment securely and detect fraud. They are strictly necessary to provide the service you have requested, so they do not depend on the banner and are not used to measure you or for advertising.
When you complete a purchase, our server tells Meta that it has happened, to measure the results of our ads: the order amount and your email converted into a code (SHA-256 hash), which Meta can only match to a Meta account that uses that same email. Neither the photo, nor your child's name, nor your address is sent. If you accepted the measurement cookies, the Meta pixel identifiers are added.
If you came to our website from a Google ad, we store in your browser (for up to 90 days) the click identifier that Google adds to the link and, when you complete a purchase, our server tells Google Ads that it has happened: that click identifier, the amount and the order reference. Neither your email, nor the photo, nor your child's name, nor your address is sent. If you did not accept the measurement cookies, we tell Google so that it does not use the data to personalise ads.
9. Contact
For any privacy questions: fernando@irayabooks.com