1. Controller
The controller within the meaning of the GDPR and the revised Swiss Data Protection Act (revDSG) is: Miraix Creators by M. Rötzer, Birkenstrasse 9, 4123 Allschwil, Switzerland. Email: hello@heldio.ch.
2. What we process
(a) Account: email address, optional name, country, language. Basis: contract (Art. 6(1)(b) GDPR). (b) Book data: details about your child you enter in the wizard. (c) Photo data: photos of your child you upload. They are used as a visual reference, not to train a model. (d) Payment: handled by Stripe — we never see full payment details. (e) Technical: hashed/truncated IP, user-agent, timestamp.
3. Photos: special guarantees
Because children's photos are particularly sensitive, the following binding rules apply:
• Storage: EU-only (Frankfurt or Amsterdam, Cloudflare R2). • Retention: 30 days from upload, then automatically deleted via a daily cron. • Force-delete: available in your account under "Privacy" any time. • Purpose: the photo is used solely as a visual reference so your child stays recognisable in your book's illustrations. We do NOT train a lasting model of your child. • No cross-user face recognition, no face database. • No training use: neither our service providers nor any third party may use the photos to train base models. • After the 30 days elapse, no image material of your child remains in our systems.
4. Sub-processors
• Replicate Inc. (image generation (reference-conditioned, no training); EU region where available) • Anthropic PBC (text generation; data not used for training) • Cloudflare, Inc. (storage; EU region) • Stripe Payments Europe Ltd. (payments) • Resend.com (email delivery) • Cloudprinter (print + shipping, EU printers)
All sub-processors are covered by Art. 28 GDPR data processing agreements.
5. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Complaints can be filed with the FDPIC (Switzerland) or any EU data protection authority. Questions or requests: hello@heldio.ch.
6. Cookies
We use only strictly necessary cookies (session, language preference). If we enable web analytics, it will be cookieless, anonymised and EU-hosted.