PRIVACY NOTICE · 22 OCTOBER 2026
Your memories stay yours.
Bumbletiger creates personal storybooks for adults who choose to preserve a child’s real-life memories. This notice explains how we use the information and photographs you share.
Who is responsible
Bumbletiger is the controller of information submitted through this website. Privacy questions and rights requests can be sent to hello@bumbletiger.com.
What we collect
We collect the ordering adult’s name, email, relationship to the child and delivery country; the child’s first name, approximate age, photographs, characteristics and story details; and production information such as proofs, revision notes and payment status. Please do not share medical information, school details, home addresses or other information that is not needed to make the book.
Why we use it
We use this information only to receive the order request, create and revise the commissioned storybook, communicate with the ordering adult, provide a proof, arrange payment through a third-party payment provider and fulfil the order. We do not use submitted photographs for advertising, facial recognition, model training or unrelated products.
Our lawful basis
We process the ordering adult’s information to take steps at their request and perform the order contract. We process the child’s limited information and photographs for our legitimate interest in producing the requested personalised book, balanced against the child’s rights and best interests, and on the ordering adult’s confirmation that they are authorised to share it.
Where it is stored
OpenAI processes the hosted information for Bumbletiger through ChatGPT Sites. Photos are held in private Cloudflare R2 object storage and order records in Cloudflare D1. ChatGPT Sites does not currently provide a fixed UK or EU data-residency guarantee. OpenAI’s Sites Data Processing Addendum incorporates safeguards for UK international transfers.
Who can see it
Access is limited to the Bumbletiger owner and service providers needed to host, secure, communicate about and fulfil the order. Customers can log in using a one-time email code. The server limits access to orders matching the verified email. Original private order links remain available as a fallback; anyone with that complete link can access the linked order. We do not sell personal information or make children’s photographs public.
Logging in and essential cookies
We use Resend to deliver login codes and order notifications. Login codes expire after 10 minutes, work once, and are stored only as hashes tied to the requesting browser. Login is available for any email address; it does not reveal whether that address has an order.
Strictly necessary, secure cookies keep the login challenge for up to 10 minutes and your customer session for up to two hours. We store only hashes of the random browser tokens. You can log out on this device or revoke all customer sessions from your account. Existing private order links remain valid independently of login sessions.
To protect access, we limit requests by email and network address. Rate-limit records become eligible for deletion after 24 hours and pseudonymised security events after 30 days. Expired authentication records are removed during the next login or owner-studio cleanup. These essential cookies are not used for advertising or analytics.
How long we keep it
- Unpaid order requests with no active production work: deleted after 30 days.
- Original reference photos and visual proofs: deleted 90 days after the order is marked complete.
- Essential order and accounting records: retained only for the period required for legal, tax and dispute purposes.
Customers can ask for earlier deletion. We may need to retain limited information where the law requires it.
Your rights
You may ask for access, correction, deletion, restriction or a copy of your information, or object to processing. Use the deletion-request control on the private order page or email hello@bumbletiger.com. You may also complain to the UK Information Commissioner’s Office.
Children and this service
This ordering service is for adults aged 18 and over. Children must not place orders or upload content themselves. The ordering adult must be a parent or guardian, or have their permission.