1. Data controller
The data controller for the personal data collected on the plushpages.com website is:
- Athanix OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia, which operates the Plush Pages service
- Email: contact@plushpages.com
The controller's full registration details (legal form, register, registration number) are set out in the legal notice.
2. Data collected
When you use the Site and our services, we collect the following data:
- Identification data: surname, first name, email address
- Cuddly toy photos: photographs of plush toys and fabric toys uploaded by the Customer to personalise the book
- Photos of the child and family members (optional): if they wish, the Customer may add a photo of their child and of family members so that they are better represented in the illustrations. This is optional: most books are created from appearance settings alone, with no photo of the child. When provided, these photos are sent to our artificial intelligence providers to generate the book (see the dedicated section below)
- Delivery address: full postal address for shipping the book
- Payment data: processed directly by Stripe, we do not store any card numbers or banking data on our servers
- Browsing data: IP address, browser type, pages viewed (for technical purposes only)
3. Purposes of processing
Your personal data is collected for the following purposes:
- Creating personalised books: using the photos (cuddly toy and, where applicable, the child and family members) and the personalisation choices to generate the AI illustrations and produce the book
- Order management: payment processing, printing and delivery
- Communication: sending order confirmations, tracking notifications and, with your consent, marketing communications
- Service improvement: usage analysis to improve the user experience
4. Legal basis
Data processing is based on the following legal grounds:
- Performance of a contract (Article 6(1)(b) GDPR): order processing, delivery, after-sales service
- Consent (Article 6(1)(a) GDPR): user account creation, sending marketing communications
- Legitimate interest (Article 6(1)(f) GDPR): service improvement, fraud prevention, site security
- Legal obligation (Article 6(1)(c) GDPR): retention of invoices and accounting data
5. Data retention period
Personal data is retained for 3 years after the Customer's last activity on the Site (last login or last order).
Order-related data (invoices, transaction records) is retained for 7 years in accordance with Estonian accounting and tax obligations (raamatupidamise seadus).
The photos (cuddly toy and, where applicable, the child and family members) are kept for the time needed to produce the book. The Customer may request their deletion at any time after their order has been delivered (see the "Photos, children and AI" section).
6. Data recipients
Your personal data may be shared with the following processors, strictly within the scope of the purposes described above:
- Stripe (San Francisco, USA): payment processing
- Gelato (Oslo, Norway): book printing and shipping
- Brevo (Paris, France): transactional and marketing emails
- Google (Mountain View, USA): Gemini API for AI illustration generation
- OpenAI (San Francisco, USA): gpt-image-1 image model, used for the second preview version (style comparison) when it is enabled, and to illustrate the whole book if the Customer chooses that version
- Cloudflare (San Francisco, USA): file storage (R2) with EU data centres available
- Vercel (Covina, USA): website hosting
7. Transfers outside the European Union
Some of our processors are established outside the European Union. The safeguard covering each transfer is stated row by row below:
As of today, no safeguard is published here for the following recipients: Google, OpenAI. Write to us at contact@plushpages.com for the current status of that transfer.
- Stripe (USA): certified under the EU-US Data Privacy Framework ; Standard Contractual Clauses (SCC)
- Gelato: headquartered in Norway (European Economic Area). Printing carried out in global production centres under a Data Processing Agreement (DPA)
- Google (USA): transfer outside the European Union. The safeguard covering this transfer is not published here yet; write to us at contact@plushpages.com for its current status
- OpenAI (USA): transfer outside the European Union. The safeguard covering this transfer is not published here yet; write to us at contact@plushpages.com for its current status
- Cloudflare (USA): Standard Contractual Clauses (SCC) ; option for EU data centre storage
- Vercel (USA): Standard Contractual Clauses (SCC) ; EU-US Data Privacy Framework
8. Your rights
In accordance with the GDPR and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus), you have the following rights over your personal data:
- Right of access: obtain confirmation that your data is being processed and receive a copy of it
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request deletion of your data (subject to legal retention obligations)
- Right to data portability: receive your data in a structured, commonly used format
- Right to object: object to the processing of your data on legitimate grounds
- Right to restriction: request restriction of processing in certain cases
To exercise any of these rights, contact us at: contact@plushpages.com. We undertake to respond within one month of receiving your request.
9. Photos, children and AI
Plush Pages places particular importance on protecting privacy, especially that of children. Here is how the photos you entrust to us are used:
- The cuddly toy photo is the only required item. To create a book, the Customer uploads one or more photos of their child's plush toy.
- Photos of the child and family members are optional. The Customer can describe their child's appearance using settings (without any photo) or, if they prefer, add a photo of their child and family members for a closer likeness. This is an explicit choice by the Customer, presented as such in the interface.
- Sent to the AI for generation: the cuddly toy photos are sent to Google (Gemini API) and, when the second preview version is enabled, also to OpenAI (gpt-image-1). The optional photos of the child and of family members are sent to Google (Gemini API) only, which draws the character sheets from them. If the Customer then chooses the OpenAI version, what is sent to OpenAI to illustrate the rest of the book is those drawings, not the photographs. The illustrations are not realistic reproductions of the people, and the photos are used only to produce your book. We do not sell them, we do not use them for advertising, and we do not use them to train any model.
- Secure storage: the photos are stored on Cloudflare R2 with EU data centres available. Access is limited to the processes necessary to create the book.
- Retention and deletion: the photos are kept for the time needed to produce the order and provide after-sales service. The Customer may request their deletion at any time by contacting us at contact@plushpages.com. The photos will then be deleted from our servers and those of our processors within 30 days.
10. Cookies
The plushpages.com website uses only strictly necessary cookies for the operation of the service:
- bd_builder_session: a session cookie (httpOnly) that keeps you securely signed in to your account
- NEXT_LOCALE: remembers your language preference
Our analytics tool (Plausible Analytics) runs without cookies and does not collect identifying personal data. The choice shown in the cookie banner is stored in your browser's local storage, not in a cookie.
We do not use any third-party advertising or behavioural analysis cookies. No specific consent is therefore required under the ePrivacy Directive for these strictly necessary cookies. For details, see our cookie policy.
11. Data protection officer
For any questions regarding the protection of your personal data, you can contact our data protection representative at: contact@plushpages.com.
12. Complaints
If you believe that the processing of your personal data breaches the GDPR, you have the right to lodge a complaint with a supervisory authority. The Seller is established in Estonia, where the lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). Under article 77 GDPR you may also complain to the authority of your own country of residence.
- Website: www.aki.ee
- Authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)