Privacy Notice

Version: 2 October 2026

This notice explains how we process personal data when you use our website loewenbuch.de and the services of Löwenbuch, create an account, upload photographs or voice recordings, have personalised content generated, access digital content or order printed books. It is written against the EU General Data Protection Regulation (GDPR) and German data-protection law. The German version prevails.

1. Controller

LoewenKI, owner: Mohammad Hadi Foroughmand Araabi
Einzelunternehmen
Trading as Löwenbuch
Bultenweg 50
38106 Braunschweig
Germany
Email: [email protected]

We have not appointed a data protection officer because we are not required to do so under Article 37 GDPR in conjunction with section 38 of the German Federal Data Protection Act (BDSG). For any data-protection question, contact [email protected].

2. Adults only

Accounts, orders and uploads are for adults only. Children must not create accounts or upload information directly. A child depicted in a photograph or heard in a recording remains a data subject even though an adult places the order.

3. Information we process

What we collect depends on the level you choose:

• Basis – the printed book with your details (for example names, dedication, colours and objects). At this level we collect no photographs and no voice recordings; the characters in the book remain the drawn characters of the book template.
• Klassik – in addition, photographs of the child or the other people in the book. An AI image model turns them into a drawn character in the style of the book, which replaces the template character.
• Premium – in addition, a short voice recording per person. An AI model uses it to create a replica of that voice which reads the book’s text aloud. We also create short page videos and content for the app or web player (augmented reality) from the finished pages.

Depending on your use, we process:

• account and contact information, including name, email, password hash, billing and delivery address;
• order, contract, payment and refund information;
• names, approximate ages, roles, relationships and story-personalisation details;
• uploaded photographs, image metadata, crops and technical intermediate files (Klassik and Premium only);
• voice recordings, the voice replica created from them and the audio generated with it (Premium only);
• generation parameters, drafts, previews, approvals and final files;
• support messages, complaints and evidence of authority or consent;
• IP address, device, browser, timestamps, security and error logs;
• your choice in the cookie notice, with its time and IP address.

We do not use photographs or voice recordings to authenticate, recognise or uniquely identify a person. Any such future use would be announced separately in advance.

4. Purposes and lawful bases

4.1 Accounts, orders and fulfilment

We process the adult customer’s information to provide accounts, accept orders, take payment, produce products, provide digital content, deliver orders and offer support. The lawful basis is Article 6(1)(b) GDPR. We process information required for invoicing, tax, security and legal compliance under Article 6(1)(c) GDPR.

4.2 Images, names and voices of children or other people

The depicted or recorded person is often not the contracting customer. We therefore process that person’s media on the basis of documented consent or an authorisation provided by a person with parental responsibility or other lawful authority, Article 6(1)(a) GDPR. The uploader must confirm that they have authority to provide the material and permit its use. We may request reasonable evidence.

Consent can be withdrawn for future processing. Withdrawal may prevent us from completing or continuing to provide the personalised product where the information is still required. Processing completed before withdrawal remains lawful. Limited evidence may be retained where required by law or necessary to establish, exercise or defend legal claims.

4.3 AI-assisted personalisation

Images (Klassik and Premium): an AI image model creates a drawn depiction of the child or the other people in the style of the book from the uploaded photographs and places it in the pages. The result is an AI-generated illustration, not a photograph.

Voice (Premium only): the voice recording is used solely to create, by AI, a replica of that voice (“voice cloning”) that reads the text of your book aloud – and only for your order. The voice replica is not used for any other purpose or any other person. If you save a character in your account under “My characters”, we keep its photograph and recording there until you delete the character, so that you can use it for further orders.

Videos and app content (Premium only): an AI video model creates short page animations from the finished, personalised pages.

This processing is necessary to perform the order (Article 6(1)(b) GDPR) and, for media relating to children or other third parties, is also based on the consent described above (Article 6(1)(a) GDPR). We use only the AI providers named in section 5, through their business programming interfaces; we do not use any other AI service, in particular publicly available chat applications, for orders.

We do not use customer photographs, voice recordings or personal generation data to train our own AI models. The AI providers act as our processors; they may process the material only to provide their service to us and may not use it to train their general models.

4.4 Security, abuse prevention and legal claims

We process logs, upload metadata and support information to secure accounts and systems, prevent fraudulent or unlawful uploads, investigate incidents, and establish or defend claims. The basis is Article 6(1)(f) GDPR. Our legitimate interests are operating a secure and lawful service and protecting children, customers and third parties.

4.5 Cookies, analytics and marketing

We use no analytics, tracking or marketing technology. We use only strictly necessary cookies and storage (section 25(2) no. 2 TDDDG); our Cookie Policy lists them.

5. Recipients and service providers

We disclose information only where necessary for the purposes described. Processors act under contracts pursuant to Article 28 GDPR. Currently these are:

• Server hosting: Oracle Cloud Infrastructure (Oracle Corporation), Frankfurt am Main – operation of the server our shop runs on.
• Cloudflare, Inc., San Francisco, USA – content delivery network, reverse proxy, DNS and protection against attacks: every request to this website passes through Cloudflare’s network, where connection data such as the IP address, the page requested and technical metadata are processed. We also store your uploads and order files in Cloudflare R2 object storage with data located in the European Union; the shop’s public book illustrations and sample pages (no customer data) are delivered through Cloudflare Pages, and email sent to our former gooki.de addresses is forwarded to our mailbox through Cloudflare Email Routing.
• Resend, Inc., San Francisco, USA, using its EU region (Ireland) – sending transactional email (for example confirmations, status updates, password links) and receiving the email you send to our addresses.
• OpenAI (OpenAI, L.L.C., San Francisco, USA) – creating and editing the illustrations: uploaded photographs and the book’s pages (Klassik and Premium).
• ElevenLabs (Eleven Labs Inc., USA) – creating the voice replica and narrating the book’s text: voice recordings and the text to be read (Premium only).
• fal.ai (Features & Labels, Inc., San Francisco, USA) – creating the page videos and app content from the personalised pages (Premium only).
• Stripe Payments Europe, Ltd., Dublin, Ireland – payment processing for card, Apple Pay, Google Pay or SEPA Direct Debit.
• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg – payment processing for PayPal.
• Mollie B.V., Amsterdam, Netherlands – payment processing for bank transfer through Mollie.
• A transfer made directly to our own account involves no payment service provider; we receive the transfer details through our bank.
• Picanova GmbH, Cologne, Germany – printing and dispatch of the book: the print files (including the personalised illustrations, names and dedication) and the recipient’s name and delivery address.
• Deutsche Post AG / DHL, commissioned by Picanova – delivery: name and delivery address.

Payment providers, carriers and public authorities may also process some information as independent controllers, for example for fraud prevention or to meet their own legal obligations; their own privacy notices apply to that processing.

6. Transfers to third countries

Some of the providers named above (in particular Cloudflare, Resend, OpenAI, ElevenLabs, fal.ai and group companies of Stripe and PayPal) also process data in the USA. Such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR) where the provider is certified under it, and otherwise on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can request a copy of the standard contractual clauses at [email protected].

7. Retention

We retain information only as long as necessary:

• photographs, voice recordings, the voice replica held by the AI provider, and technical intermediate files, drafts and previews: if you agreed when ordering, until you delete them in your account or withdraw your consent (Art. 6(1)(a) GDPR); otherwise until 30 days after the book has been delivered. Once the book has been delivered you can delete them yourself in your account at any time. Characters you have saved yourself under “My characters” are excluded and kept until you delete them.
• finished digital content (narrated pages, page videos, app content): for as long as your customer account exists or until you ask us to delete it;
• account and profile data: until the account is deleted, unless a statutory retention duty applies;
• order, invoice and accounting records: ten years from the end of the calendar year of the order (section 147 AO, section 257 HGB);
• support and complaint correspondence: until the regular three-year limitation period ends, counted from the end of the year in which the matter was closed (sections 195 and 199 BGB); six years where it constitutes commercial or business correspondence (section 257 HGB, section 147 AO);
• consent and authority evidence: for the duration of the processing and then until the regular three-year limitation period ends;
• security logs: only as long as necessary to identify and investigate misuse.

Data we may not delete because of a statutory retention duty is restricted and used only for that purpose. If a backup is restored, previously deleted information is not returned to use and is deleted again.

8. Information required to provide the service

Contact, delivery, payment and core personalisation information is required to perform the contract. Optional fields are identified. Without permission to process a depicted person’s image or voice, we cannot produce that form of personalisation; the Basis level needs no photographs or voice recordings.

9. Automated decisions

We do not make solely automated decisions that produce legal or similarly significant effects (Article 22 GDPR). AI systems create content but do not determine your legal rights. Every illustration, voice and page is checked and approved by a person before printing.

10. Your rights

Subject to the legal conditions, data subjects have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). Consent may be withdrawn at any time with effect for the future (Article 7(3) GDPR).

Right to object: where we process data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

Contact [email protected]. To protect children and other people, we may require proof of identity and authority.

11. Complaints

You have the right to lodge a complaint with a data-protection supervisory authority (Article 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, [email protected]

You may also contact the authority where you live.

12. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, separated storage, security logging, time-limited download links and incident procedures. No internet service can guarantee absolute security.

13. Changes

We update this notice when our processes, providers or the law change. Material changes will be announced on the website or by email where required.