- Coracao.ai is for parents, guardians and other adults. Children don't use it themselves.
- You choose what to upload. We use your story details and photos only to make and deliver your book.
- Photos are kept in private storage, location metadata is removed, and photos never appear on a public page.
- We never sell your data, and we never use your family's photos in ads or marketing.
- You can ask us to delete your photos, stories or whole account at any time: support@coracao.ai.
1. Who we are
Coracao.ai ("Coracao", "we", "us") is operated by Coracao. We make personalized, AI-illustrated children's storybooks, sold as a digital PDF and as a printed keepsake book. This policy explains how we handle personal information on coracao.ai and in the books we make for you. We are responsible for the personal information we control. Privacy requests go to support@coracao.ai.
2. Children & parental consent
Coracao.ai is designed for and directed to adults. You must be 18 or older to create an account. We do not knowingly allow children to register or to give us personal information directly. If we learn that a child has created an account, we will delete it.
Our books are about children, so the adult creating a book may give us information about a child, such as a first name, age, a description, and reference photos. By uploading a child's photo or details, you confirm that you are that child's parent or legal guardian, or that you have that parent's or guardian's permission to do so. The same applies to any other person whose photo you upload: you must have their permission (or, for a child, their parent's or guardian's permission).
A parent or guardian can at any time ask to review the information we hold about their child, ask us to delete it, or tell us to stop using it, by emailing support@coracao.ai. We will verify the request comes from the account holder before acting on it.
We do not require more information about a child than is reasonably needed to make the book, we do not create profiles of children, and we do not use children's information for advertising.
3. What we collect
Information you give us
- Account details: your email address and a password (stored by our authentication provider in hashed form; we never see it).
- Story details: your story idea, character names, descriptions, ages or relationships you choose to share, your answers to follow-up questions, extra details, and your language choice (English or Spanish).
- Reference photos: optional photos of up to six characters (individual photos or one group photo) and up to six photos of places, plus any notes about who is who.
- Edits and feedback: requests to retouch a page or cover.
- Order and shipping details (printed books): recipient name, shipping address and phone number (our printer's carriers require a phone number).
- Payment details: entered directly into Stripe's secure checkout. We do not receive or store your full card number; we receive confirmation of payment, the amount, and limited details such as card type and last four digits.
- Messages: your name, email and message when you contact us through the contact form or by email.
Information collected automatically
- Usage and device data: pages viewed, approximate location derived from IP address (city/country level), browser and device type, and referring site, collected through Google Analytics and the Meta Pixel (see section 7).
- Technical logs: our hosting and security providers record IP addresses and request logs to keep the service running and protect it from abuse.
What we do not collect
- We remove location metadata (GPS/EXIF) from reference photos when they are processed.
- We do not use your photos to create facial-recognition templates or biometric identifiers, and we do not use them to identify anyone.
4. How we use your information
| Purpose | Information used | Legal basis (where GDPR/UK GDPR applies) |
|---|---|---|
| Writing and illustrating your book, and letting you preview, edit and download it | Story details, reference photos, edits | Performance of our contract with you; your consent for photos |
| Printing and shipping your keepsake book | Final book files, shipping details | Performance of contract |
| Taking payment and preventing fraud | Order and payment confirmation details | Performance of contract; legal obligation; legitimate interests |
| Your account, customer support and service messages (e.g. order confirmations) | Email, messages, order history | Performance of contract |
| Keeping the service secure and working, and fixing errors | Technical logs, usage data | Legitimate interests |
| Understanding how the site is used and measuring our ads | Usage and device data (never photos or story content) | Consent where required; otherwise legitimate interests |
| Occasional product news and offers | Email address | Your consent; you can unsubscribe any time |
| Meeting legal, tax and accounting obligations | Order and payment records | Legal obligation |
Purpose limitation for photos. Reference photos and story details are used only to create, edit, print and deliver your book and to support you with it. We will not use them for marketing, we will not show them publicly, and we will not use your family's photos, names or stories to train our own AI models. If we ever want to feature a book as an example, we will ask you first and only use it with your explicit permission.
5. How the AI uses your photos
To write and illustrate your book, we send your story details, and the reference photos you choose to add, to third-party AI providers that generate text and images on our behalf. Before sending, photos are resized/normalized and their location metadata is removed. The providers process this content to return the story and illustrations to us.
Those providers process the content to return the story and illustrations to us. We do not use your family's photos, names, or stories to train Coracao's own models.
AI-generated illustrations are interpretations, not photographs. They are inspired by your references but will not be exact likenesses.
6. Who we share information with
We do not sell or rent personal information, and we do not "share" it for cross-context behavioural advertising using your photos or story content. We share personal information only with service providers that help us run Coracao.ai, only as needed for their task, and under contracts or terms that require them to protect it:
| Provider | What they do | What they receive |
|---|---|---|
| AI text and image generation providers | Write the story and paint the illustrations | Story details, reference photos (metadata removed) |
| Supabase | User accounts, database and private file storage | Account details, story details, photos, generated books |
| Render | Hosts our website and backend servers | All data that passes through our servers; technical logs |
| Cloudflare | Content delivery and security for our website | IP addresses, technical request data |
| Stripe | Payment processing and fraud prevention | Payment details, email, billing/shipping details |
| Lulu Press (Lulu Print API) | Prints and ships keepsake books | Final book files, recipient name, shipping address, phone number, email |
| Google Analytics | Website usage analytics | Usage and device data via cookies |
| Meta Platforms (Meta Pixel) | Measuring and improving our ads | Usage and device data and events such as "started checkout" via cookies; never photos or story content |
| EmailJS | Delivers contact-form messages to us | Your name, email and message |
Your printed book file (which includes the illustrations and story text) is shared with Lulu so it can be printed. Lulu does not receive your original reference photos.
We may also disclose information if required by law or valid legal process, to protect the rights, safety or property of our customers, children, the public or Coracao, or to a successor if the business is sold or reorganized (in which case this policy will continue to apply to your information, and we will tell you).
7. Cookies, analytics & ads
We use cookies and similar technologies to keep you signed in (essential), to understand how people use our site (Google Analytics), and to measure our ads (Meta Pixel). Analytics and ad cookies receive browsing information, such as pages visited and whether checkout was started. They never receive your photos, character names or story content.
You can opt out of Google Analytics with the Google Analytics opt-out add-on, manage Meta ad preferences in your Facebook ad settings, and block or delete cookies in your browser settings.
8. How long we keep information
- Reference photos: kept in private storage so you can edit and retouch your book. Email support@coracao.ai if you want them deleted.
- Your stories and finished books: kept in your library for as long as you keep your account, so you can re-download or reorder them. You can delete a story or your account at any time.
- Account details: until you delete your account. We delete account data within 30 days of a verified deletion request.
- Order, payment and tax records: kept as long as tax and accounting law requires (generally up to 7 years in Canada), even after account deletion, but without your photos or story content.
- Support messages: up to 2 years after the conversation ends.
- Backups: deleted information may remain in backups until those backups are replaced.
9. Your choices & rights
Wherever you live, you can ask us to:
- give you access to, or a copy of, the personal information we hold about you or your child;
- correct information that is inaccurate;
- delete your photos, a specific story, or your whole account;
- stop using your information for a particular purpose, or withdraw consent (for example, for photos or marketing emails); and
- tell you which service providers have received it.
Email support@coracao.ai from the email address on your account. We'll respond within 30 days. Depending on where you live (for example in the EU, UK, or certain US states), you may have additional rights, such as data portability or the right to object to processing, and you may complain to your local privacy regulator. In Canada, that is the Office of the Privacy Commissioner of Canada. We'd appreciate the chance to fix things first.
Withdrawing consent for photos means we can no longer illustrate characters from them, but you can still create a text-described story.
10. Security
We use reasonable administrative, technical and physical safeguards, including encrypted connections (HTTPS), private (non-public) storage for photos, access controls on our database, and limiting staff access to what's needed for support. No system is perfectly secure. If a breach affects your personal information and creates a real risk of significant harm, we will notify you and the relevant regulators as the law requires.
11. Where your data is stored
Our service providers may store and process information in countries other than yours, including for our database and photo storage. Your information may therefore be accessible to courts and authorities in those countries.
12. Changes to this policy
We may update this policy as our service changes. We'll post the new version here with a new "last updated" date, and if the changes are significant, especially anything affecting children's information or photos, we'll email account holders before they take effect. We will not use previously collected photos in a materially new way without your consent.
13. Contact us
Questions, requests or concerns about privacy:
- Email: support@coracao.ai (subject line "Privacy")