Privacy Policy
Your privacy matters. This policy explains how Rawissimo collects, uses, and protects your personal information. We are committed to transparency and compliance with GDPR, CCPA, and other data protection laws.
1. Information We Collect
Account Information
- Name and email address
- Password (encrypted)
- Billing and shipping addresses
- Order history and preferences
Book Personalisation Data
- Names, ages, and descriptions you provide for story characters
- Photos uploaded for character illustration (see special protections below)
- Story preferences and customisation choices
- Language preferences
Payment Information
Payment card details are processed securely by our payment provider (Stripe). We never store complete card numbers on our servers.
Technical Data
- IP address and browser type
- Cookies and usage analytics
- Device information
2. How We Use Your Information
We use collected data to:
- Create your books: Generate personalised stories and illustrations
- Process orders: Handle payments and arrange delivery
- Provide support: Respond to inquiries and resolve issues
- Improve our service: Analyze usage patterns and optimize features
- Send communications: Order confirmations, shipping updates, and optional marketing (with your consent)
3. Special Protections for Children's Data
Photos you upload:
- Used only to generate cartoon-style character illustrations
- All GPS and metadata stripped immediately upon receipt
- Original photos permanently deleted within 90 days of generation
- Only the AI-generated illustration is retained after that window
- No staff member views uploaded photos, unless you contact support about an issue — for example, a problem with your delivery — and viewing the photo is needed to resolve it
We do not knowingly collect personal information from children under 13 without parental consent. Parents and guardians create accounts and provide information on behalf of children.
4. Data Sharing and Disclosure
We share your data only with:
- Service providers: Payment processing (Stripe), account and database infrastructure (Supabase), transactional email delivery (Resend), shipping companies, and cloud hosting — all bound by confidentiality and data processing agreements
- Legal requirements: When required by law or to protect rights and safety
We never sell your personal data to third parties.
5. Your Privacy Rights
Depending on your location, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate information
- Erasure: Request deletion of your data ("right to be forgotten")
- Data portability: Receive your data in a structured format
- Object to processing: Opt out of certain data uses
- Withdraw consent: Unsubscribe from marketing at any time
To exercise these rights, contact privacy@rawissimo.com
6. Data Security
We implement industry-standard security measures including:
- Encryption of data in transit (HTTPS/TLS)
- Encrypted storage of sensitive information
- Regular security audits and updates
- Access controls and authentication
- Secure payment processing via PCI-compliant providers
7. Data Retention
Retention periods vary by data type:
- Uploaded photos: deleted within 90 days of generation (see Section 3)
- Account and order data: retained for as long as your account is active, or as needed to provide the service you've requested
- Payment and financial records: retained for 7 years, as required by law
- Support correspondence: retained for a reasonable period after resolution to maintain service quality
When data is no longer needed, it is securely deleted or anonymized.
8. Cookies and Tracking
We use cookies for:
- Essential cookies: Required for site functionality (login, cart)
- Analytics cookies: Understand usage patterns (Google Analytics)
- Marketing cookies: Personalized ads (only with your consent)
You can manage cookie preferences through our cookie banner or browser settings.
9. International Data Transfers
Your data may be processed in countries outside your own. We ensure adequate protection through:
- Standard Contractual Clauses (SCCs) for EU/UK data transferred outside the EEA or UK
- The EU–U.S. Data Privacy Framework (DPF), where our service providers participate in it
- Equivalent protections for all user data, regardless of where it is processed
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on our website. Continued use after changes constitutes acceptance.
11. Contact Us
Rawissimo is operated by Herbs Fusion SRL (CUI 45107350, Nr. Reg. Com. J23/6579/2021), registered in Romania with its registered office at Str. Ceahlau 24, Loc. Voluntari, Ilfov, Romania. As a Romania-based company, we are directly subject to, and regulated under, EU/GDPR data protection law — no separate EU representative is required.
For privacy questions or to exercise your rights:
Email: privacy@rawissimo.com
Data Protection Officer: dpo@rawissimo.com
General Support: support@rawissimo.com