Privacy Policy

Overview

The privacy of your data, and it is your data, not ours, matters to us. In this policy we lay out what data we collect and why, how it is handled, and your rights with respect to it. We never sell your data.

This policy applies to Paperkin, a service operated by Lora Labs AB, company number 559595-2275, Skogsslingan 3, 182 30 Danderyd, Sweden. Lora Labs AB is the data controller. It covers people who preview a book through an AI assistant, people who visit this website, and customers who place an order. We refer to all of them as "you".

It does not cover the AI assistant you use to reach us, such as ChatGPT. The assistant is operated by its own provider, which handles your conversation under its own privacy policy.

What we collect and why

Our guiding principle is to collect only what we need. Here is what that means in practice.

Book previews. When you create a book on this website or ask an AI assistant to create one with Paperkin, we receive the content of the book: its title, any name and personal message, the text of the book (for example chapters, recipes or journal prompts), and any pictures you choose to include. We use these to lay out the book and show you a preview. An assistant may also send a session identifier for limiting free previews. On this website we instead derive a scrambled, one-day identifier from your network address. We use these identifiers only to limit how many free previews one visitor can create in a day. The integration receives the content and identifiers sent to our tools, not your full chat history or account profile. Content you choose to include may itself contain personal information.

Orders and delivery. When you order, we collect your email address, phone number, delivery name and address, and what you ordered. We need these to print and deliver your book, to send you updates about the order, and to handle reprints and refunds. We send the delivery name, address, phone number and book specifications to Lulu before payment to confirm an available delivery service. After payment and print approval, we send the print files for production.

Payment information. You pay on our website through an embedded Stripe payment form. Card details go directly to Stripe; our servers never receive or store them. We receive confirmation that the payment succeeded, the amount, and the contact and delivery details you entered. We keep order and payment records because accounting and tax law require it.

Website interactions. When you load a page on this site, our hosting provider records standard server logs: IP address, browser type, the page requested and the time. We use them to keep the site secure and working, and they are kept for a short period.

Website analytics and advertising. We use Vercel Web Analytics for aggregate, cookie-free statistics about visits and devices. Our analytics integration excludes checkout, admin, order and API pages, removes query parameters, and removes individual book identifiers from page URLs. We do not send book contents, customer details or payment information as analytics events. We do not show ads. Our checkout uses an essential session cookie to keep your payment session private. Stripe may use cookies and similar technologies in its payment form to provide payment features and prevent fraud.

Voluntary correspondence. When you email us with a question or to ask for help, we keep that correspondence, including your email address, so that we have a history to refer back to if you contact us again.

Children's information. Paperkin is for adults buying a book for a child. You must be 18 or older to order. A child's first name and age are optional; if you give them, we use them only to personalize and print that book. We never use them for marketing and we do not knowingly collect information directly from children. Only include pictures of children in a photo book if you are their parent or guardian.

Automated decisions. Books are laid out by software. We make no decisions about you by automated means that have legal or similarly significant effects.

Our legal bases for processing (GDPR)

We do not send marketing emails. If that ever changes, we will ask for your consent first and you will be able to withdraw it at any time.

When we access or disclose your information

To provide the products you have requested. We use the following subprocessors to run Paperkin. We share information needed for their role. Their privacy terms and data processing agreements govern how they handle it; payment and delivery providers may also have their own legal obligations.

To check your book before it is printed. A member of our team may look at a book you have ordered before it goes to print, to catch drawing or printing faults and to confirm it meets our content rules. We do not look at previews that are never ordered except to investigate abuse.

To investigate, prevent, or take action regarding restricted uses. If we discover that the service is being used to produce content our terms prohibit, we will take action as necessary, including cancelling the order and, where warranted, notifying the appropriate authorities.

Aggregated and de-identified data. We may aggregate or de-identify information, for example counting how many books were ordered on a theme, and use that for any purpose, including improving the service.

When required under applicable law. Our policy is not to respond to government requests for customer data unless we are compelled by legal process. If a tax authority audits us, we may be required to disclose order and billing information, and will disclose only the minimum needed.

If Lora Labs AB is acquired by or merges with another company, we will tell customers with open orders before their personal information is transferred or becomes subject to a different privacy policy.

Your rights with respect to your information

We apply the same data rights to everyone, regardless of location. These rights include:

• Right to know. What personal information is collected, used and shared. This policy sets out both the categories and the specific data we collect and how they are used.
• Right of access. To obtain the personal information we hold about you and information about how it is shared, stored, secured and processed.
• Right to correction. To have inaccurate personal information corrected.
• Right to erasure. To ask that your personal information be erased from our systems and those of our service providers, subject to the limits in the law. We can delete a preview on request straight away. We cannot delete order records that accounting law requires us to keep.
• Right to restrict processing and right to object. To ask us to limit how your information is used, and to object to processing based on our legitimate interests.
• Right to portability. To receive the personal information we hold about you in a commonly used format.
• Right not to be subject to automated decision-making. We do not make decisions with legal or similarly significant effects about you by automated means.
• Right to non-discrimination. We will not charge you a different price or give you a lower level of service because you exercised a privacy right.
• Right to complain. To lodge a complaint with a supervisory authority.

To exercise any of these rights, email founders@loralabs.co. We may need to verify your identity first, usually by confirming the email address and order number on your order. We respond within 30 days. If we decline a request we will explain why and how you can appeal.

If you are in the EU you can complain to your national data protection authority; ours is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se). If you are in the UK you can contact the Information Commissioner's Office.

How we secure your data

All data is encrypted with TLS in transit between your browser, our servers and our subprocessors, and our database is encrypted at rest. Access to order data is limited to the people who fulfil orders. Card details are handled only by Stripe, which is certified to PCI DSS Level 1.

Order and preview pages are reachable only through a long, unguessable link. Anyone who has the link can see the page, so do not share it publicly.

Data retention and what happens when a preview is deleted

We keep your information for the time necessary for the purposes for which it is processed.

• Previews that are never ordered, including their images, are deleted automatically after 90 days. Once deleted, we cannot recover them.
• We retain order records for 7 years after the end of the financial year for bookkeeping. Delivery details and printed-book files are retained with the order to support fulfilment, disputes and reprints; contact us to request erasure of data we no longer need.
• Support correspondence is kept for up to 2 years after the matter is closed.

Location of site and data, and transfers from the EU

Lora Labs AB is established in Sweden. Our active application servers, database and book-file storage are hosted in Frankfurt, Germany. Our transactional email sending domain uses Resend’s Ireland region. Vercel's content delivery network and analytics, Stripe, Lulu, Resend and your AI assistant operate internationally and may process data outside the EU, including in the United States. A paused pre-migration copy of our database and files remains in the United States temporarily for recovery.

Personal data transferred out of the EU must be given the same level of protection it has under EU privacy law. Our transfers are covered by the EU–US Data Privacy Framework where the subprocessor is certified, and otherwise by the European Commission's Standard Contractual Clauses included in our data processing agreements. UK transfers are covered by the equivalent UK mechanisms.

Notice for residents of US states with privacy laws

In the last 12 months we have collected these categories of personal information: identifiers (name, email address, phone number, delivery address), commercial information (what you ordered and paid), and internet activity (server logs). We collect them from you directly and from the AI assistant you used, for the purposes described above, and disclose them to the subprocessors listed above.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information for any purpose other than providing the service.

Changes and questions

We may update this policy as needed to comply with relevant regulations and to reflect new practices. Whenever we make a significant change we will refresh the date at the top of this page and, where the change affects an open order, email the address on that order.

Have questions, comments or concerns about this policy, your data, or your rights? Email founders@loralabs.co or write to Lora Labs AB, Skogsslingan 3, 182 30 Danderyd, Sweden.