1. Who is the data controller?
The controller of your personal data is FLOWBLOG, a French single-member limited liability company (EURL) registered under number SIREN 993 014 307, publisher of the "Toutes mes histoires" service available at toutesmeshistoires.com (the "Service").
The company Devhighway LLC (United States) acts as a technical service provider and operates payment processing (via Stripe) on behalf of and under the responsibility of FLOWBLOG.
For any question about your data or to exercise your rights: contact@toutesmeshistoires.com.
2. Our commitment to children’s data
"Toutes mes histoires" creates personalized books, videos and audio stories from a child’s photo — sensitive data that we protect by design. The photo (and, optionally, a voice sample) is only used to produce the creation, then automatically deleted. We never keep it, never share it, and never use it to train artificial intelligence models.
3. Data collected, purposes, legal basis and retention
We apply the principle of data minimization: we only collect the data necessary for the Service.
Child’s photo
- Purpose :
- Generate the child’s stylized avatar (illustration).
- Legal basis :
- Explicit parental consent (art. 6.1.a and 9.2.a GDPR).
- Retention :
- Temporarily uploaded to a private space, used for generation, then AUTOMATICALLY DELETED immediately afterwards (immediate purge + security task). Never kept.
Parent’s voice (optional, Magic plan and up)
- Purpose :
- Temporarily clone the voice to narrate the story.
- Legal basis :
- Explicit consent.
- Retention :
- Temporarily processed by our voice synthesis provider (MiniMax), used for narration, then deleted after use. Never kept.
Avatar & creations (PDF book, illustrations, video, audio)
- Purpose :
- Return your creations to you in your library.
- Legal basis :
- Performance of the contract. These are derived stylized works, not the original photo.
- Retention :
- Kept as long as your account exists; deleted on request or when the account is closed.
Account (email)
- Purpose :
- Create and secure your account, contact you.
- Legal basis :
- Performance of the contract.
- Retention :
- As long as the account is active, then deleted after closure or prolonged inactivity.
Child’s first name & age
- Purpose :
- Personalize the story and narration.
- Legal basis :
- Performance of the contract / consent.
- Retention :
- Kept with the creation as long as the account exists.
Order (payment, and delivery address if printed book)
- Purpose :
- Process the order, delivery and invoicing.
- Legal basis :
- Performance of the contract & legal obligation (accounting).
- Retention :
- Billing data kept for 10 years (accounting and tax obligations). Delivery address kept for the time necessary for fulfillment and after-sales service.
Technical data & audience measurement
- Purpose :
- Security, proper operation and improvement of the site.
- Legal basis :
- Legitimate interest (essential) / consent (audience measurement).
- Retention :
- See the Cookies section below.
4. Parental consent & minor children’s data
The Service is aimed at adults (parents or holders of parental authority) creating a work for their minor child. The processing of the child’s image and, where applicable, voice is only carried out after obtaining your explicit consent, given via a mandatory checkbox at the time of creation. By checking this box, you warrant that you hold parental authority or the authorization of its holders.
You may withdraw your consent at any time. As the processing of the photo and voice is ephemeral, there is no residual raw data to delete once the creation is complete; the creations and the account, however, remain deletable at your request.
5. Processors & recipients
We use carefully selected processors, governed by data processing agreements (DPAs) and bound by confidentiality. Your data is never sold.
- ✦Google (Gemini) — Generation of images / avatars. (outside the EU (United States))
- ✦MiniMax — Temporary voice synthesis and cloning. (outside the EU)
- ✦Prodigi — Printing and shipping of the physical book. (EU / international depending on production)
- ✦Stripe — Secure payment processing. (EU / outside the EU)
- ✦Supabase — Hosting of the database and files. (European Union)
- ✦Vercel — Hosting and delivery of the site. (international (CDN))
6. Transfers outside the European Union
The Service’s data is hosted within the European Union (Supabase, EU region). Some content-generation (Google Gemini, MiniMax) and delivery processors may process data outside the EU, in particular in the United States. These transfers are governed by appropriate safeguards within the meaning of the GDPR, in particular the European Commission’s standard contractual clauses. Regarding the photo and voice, the ephemeral nature of the processing (immediate deletion after generation) limits exposure to strictly the time of creation.
7. Your rights
In accordance with the GDPR, you have the following rights:
- ✦Right of access — obtain a copy of the data we hold about you.
- ✦Right to rectification — correct inaccurate or incomplete data.
- ✦Right to erasure — delete your account and the associated creations.
- ✦Right to portability — retrieve your data in a structured format.
- ✦Right to object & to restriction — object to processing or request its restriction.
- ✦Right to withdraw your consent — at any time, without retroactive effect.
To exercise these rights, write to us at contact@toutesmeshistoires.com. We respond within one month. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).
8. Cookies & audience measurement
We use essential cookies (login, security, proper operation) that do not require your consent and, only with your agreement, audience measurement that helps improve the site. No tracker is placed before your consent. You can accept, refuse or customize your choice via the cookie banner, and change it at any time by clearing your browser’s cookies.
9. Security
We implement appropriate technical and organizational measures (encryption in transit, private storage spaces, access control, minimization and automatic deletion of sensitive data) to protect your information.
10. Contact & DPO
For any question about the protection of your data, to exercise your rights or to contact the data protection officer:
FLOWBLOG (EURL, SIREN 993 014 307) — contact@toutesmeshistoires.com