Skip to main content
BoekjesAtelier
Login

Privacy Policy

1. Data Controller

BoekjesAtelier is based in Houten, the Netherlands, and is registered with the Dutch Chamber of Commerce under number 99671220. BoekjesAtelier is the data controller for the processing of personal data as described in this privacy policy. Contact details: Email: info@boekjesatelier.nl

2. Scope

This privacy policy applies to all users of the BoekjesAtelier service and describes how we handle personal data and images in accordance with the General Data Protection Regulation (GDPR).

3. What data we process

We only process personal data that is necessary to provide our service.

  • 3.1 Account data: email address (for registration and authentication), password (encrypted), and address details (for shipping).
  • 3.2 Project data: text input, story summaries, character descriptions, and project settings.
  • 3.3 Referral data: when you register, we may store the source through which you found our website (e.g. search engine, social media, or campaign name), the referring website domain, and your language preference. This data is collected from URL parameters and your browser at the time of registration and is used solely for understanding how users discover our service. No tracking cookies are used for this purpose; the data is temporarily held in your browser’s local storage and only transmitted to us when you create an account. Stored account-level referral fields are not shared with third parties. After analytics consent, a Google Ads click identifier may be provided to Google for conversion attribution as described below. Referral data is retained for the lifetime of your account and deleted upon account deletion.
  • 3.4 Images: uploaded images are not stored permanently on our servers. After processing, they are deleted. A temporary copy may be stored in the user’s browser (local storage) to improve the user experience.
  • AI-generated images are stored in secure cloud storage. These images are linked to the user account. Users can submit a deletion request via info@boekjesatelier.nl. Requests are handled within the statutory period of up to 30 days.

4. Legal basis for processing

We process personal data on the basis of:

  • Performance of the contract: to provide our photobook service.
  • Legitimate interest: for understanding how users discover our service (referral attribution), where this interest does not override your rights.
  • Consent: where applicable.
  • Legal obligations: where required.

5. Retention periods

We do not retain personal data longer than necessary for the purpose for which it was collected.

  • Account data and project data are retained for as long as the account remains active.
  • AI-generated images and project data are retained for as long as the account remains active.
  • Users can submit a deletion request by email.
  • After account deletion, personal data is removed within a reasonable period unless legal obligations require otherwise.
  • Technical logs are retained only temporarily to the extent necessary for security and operational purposes.

6. Use of third parties (processors)

To provide our service, we use external service providers such as cloud storage, hosting, and AI processing providers.

  • We select our external service providers carefully and prefer to work with parties that demonstrably comply with internationally recognized security standards, such as SOC 2 or ISO 27001, or comparable standards.
  • Google Analytics 4 and Meta Pixel process limited website-use, conversion, and advertising-attribution data. The Meta Pixel and Meta Conversions API are used only after explicit consent. Google Analytics 4 runs in Google Consent Mode v2: without consent it receives only cookieless signals that store nothing on your device and contain no click or user identifiers, used solely for aggregated, modelled statistics. Only after explicit consent does it process identifiable website-use and advertising-attribution data, and may Google receive Google Ads click identifiers from a landing page. For enhanced conversion measurement, we may then send Google a one-way SHA-256 hash of an account email address together with a pseudonymous internal user ID. We do not send Google the plain-text email address, phone number, or address details for this purpose.

7. Automated processing and AI

BoekjesAtelier uses AI technology to generate images.

  • There is no automated decision-making that produces legal effects for users or otherwise significantly affects them.
  • AI output is used solely for creative purposes within the user’s photobook project.

8. Data security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, or disclosure.

  • All data transfers take place via encrypted connections (SSL/TLS).
  • Access to data is restricted to authorized persons.

9. Data subject rights

Under GDPR, you have the right to:

  • Access your personal data.
  • Have inaccurate data corrected.
  • Have your data deleted.
  • Object to processing.
  • Request data portability.
  • Withdraw your consent at any time.

10. Cookies and local storage

BoekjesAtelier uses functional cookies and local browser storage required for the service. Analytics and marketing cookies are optional and are activated only after explicit consent.

  • No tracking or marketing cookies are placed without explicit consent.
  • For Google Analytics 4, the consent choice controls analytics storage, advertising storage, advertising user data, and advertising personalization through Google Consent Mode v2. Without consent the Google tag does load, but is restricted to cookieless signals: it places no cookies, receives no click or user identifiers, and contributes only to aggregated, modelled statistics. Only after consent are cookies placed, and may a one-way SHA-256 hash of the account email address and a pseudonymous internal user ID be used for enhanced conversion measurement.
  • Local storage is also used to temporarily hold referral attribution data (see 3.3) until account registration.
  • Users can clear local storage via their browser settings.

11. Minors

Our service is not specifically directed at children under the age of 16.

  • If we become aware that personal data of minors has been processed without valid consent, we will delete that data.

12. Changes

We reserve the right to amend this privacy policy.

  • The most current version is always available on our website.

Contact

You can submit a request via info@boekjesatelier.nl. We respond within the statutory period of up to 30 days.

Last updated: August 4, 2026