Privacy Policy
Effective 25 April 2026
Almia (ABN 25 380 435 979) is based in Sydney, New South Wales, Australia.
Almia (“we”, “our”, “us”) is committed to protecting the privacy of you and your family. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website (almia.com.au, almia.au) and purchase our personalised children’s books. We handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the New Zealand Privacy Act 2020, and applicable data protection laws. For a complete list of the service providers we work with and the data each one accesses, see our Subprocessor List at /privacy/subprocessors.
1. Information We Collect
1.1 Information You Provide Directly
When you create a book or interact with our services, we may collect: • Parent or caregiver information: name, email address, phone number, shipping address, and payment information (processed securely by our payment provider). • Child profile information: the child’s first name, nickname, age, interests, personality traits, and any themes or messages you choose for the story. • Child photograph: a photo of the child that you upload to personalise the book’s illustrations. • Account information: email address and password if you create an account. • Communications: any messages or feedback you send us.
1.2 Information Collected Automatically
When you visit our website, we may automatically collect: • Device information (browser type, operating system, screen resolution). • IP address and approximate location. • Pages visited, time spent on pages, and referral sources. • Cookies and similar technologies (see Section 8 below).
2. How We Use Your Information
We use your personal information for the following purposes: • To create your personalised book: the child’s name, profile details, and photograph are processed by our AI partners to generate a unique story and illustrations tailored to the child. • To fulfil your order: your contact and shipping details are used to produce, ship, and deliver the book. • To process payment: payment details are transmitted securely to our payment provider. We do not store your card details. • To communicate with you: we send order confirmations, shipping updates, and respond to your enquiries by email. • To improve our service: we may analyse aggregated, de-identified usage data to improve our website, product quality, and customer experience. • To comply with legal obligations: we may use or disclose information where required by law or to protect our legal rights. We will not use your personal information for purposes other than those described above without your consent.
3. AI Processing and How Our Partners Handle Your Data
Almia uses AI to create your personalised book. We use two AI partners under their commercial API terms: • Anthropic, PBC (United States): text generation and quality review. • Google LLC (United States): image processing. Your child’s photograph: We share it only with Google for image processing. We do not share it with Anthropic. The original photograph is stored encrypted at rest on Amazon Web Services in the Sydney region. Our print partners and shipping providers never receive the photograph. Their commitments to your data: • Neither partner uses your inputs (text or images) to train their AI models when serving Almia under their commercial API terms. • Both partners automatically delete API inputs and outputs within 30 days, except where required by law or to enforce their abuse-monitoring rules. You can read each partner’s published commitment here: • Anthropic: privacy.claude.com/en/articles/7996866-how-long-do-you-store-personal-data • Google Gemini API terms: ai.google.dev/gemini-api/terms Almia’s own retention of your photograph (which is separate from, and in addition to, the partner retention above) is described in Section 7.
4. Children’s Information
Almia’s books are designed for parents, guardians, and other caregivers to create books for children. We take the privacy of children seriously and we do not knowingly collect personal information directly from children. Who provides the information: All information about a child must be provided by the child’s parent or legal guardian, or by someone with parental permission to do so. This explicitly covers gift-givers (for example, a grandparent, godparent, aunt, uncle, or family friend creating the book as a gift). By uploading a photograph or providing a child’s details, you confirm that you fall into one of these categories. Limited collection: We collect only the child information necessary to create the personalised book. No marketing to children: We do not use children’s information for marketing or advertising. We do not sell or share children’s information with third parties for their own purposes. The child as the data subject: Even when an account is held by a gift-giver or another caregiver, the child whose information appears in a book remains the data subject. If you are the parent or guardian of a child whose photograph or details appear in an Almia book and you did not place the order yourself, you can contact us at privacy@almia.com.au to request access, correction, or deletion of that information. We will act on your request within 30 days, subject to verification of your relationship to the child. Special handling of children’s photographs: see Section 3. If we become aware that we have collected information from a child without parental consent, we will take steps to delete that information promptly.
6. International Data Transfers
Some of our service providers operate outside Australia and New Zealand. When your information is transferred internationally, we take reasonable steps to ensure it receives comparable protection. Where your information goes: • United States: Anthropic, Google, Stripe, Postmark, Vercel. • France: Brevo. • United Kingdom or Norway (depending on your shipping region): our print partner. • Australia: storage of Almia data on Amazon Web Services in the Sydney region. How we protect transferred information: we rely on each partner’s contractual data handling commitments, including their published privacy and security terms. The full list of subprocessors and the data each one accesses is at /privacy/subprocessors.
7. Data Retention
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected: • Order and account information: retained for the duration of your account and for 7 years after your last order for tax, legal, and warranty purposes. • Child photograph (the original you upload to Almia): retained for 90 days after your book is delivered, then permanently deleted, unless you request earlier deletion. Note that under Section 3, our AI partners delete their copies within 30 days under their own commercial terms. • Generated book content (story text and illustrations): the final book file is retained in your account for reordering purposes. You may request its deletion at any time. • Website analytics data: aggregated and de-identified data may be retained indefinitely. Individual browsing data is retained for no more than 26 months.
9. Your Rights
9.1 Under the Australian Privacy Act
You have the right to: • Access the personal information we hold about you. • Request correction of inaccurate, out-of-date, or incomplete information. • Request deletion of your data. • Withdraw consent at any time, including consent to process your child’s photograph. • Make a complaint about our handling of your personal information.
9.2 Under the New Zealand Privacy Act 2020
If you are in New Zealand, you have the right to: • Access the personal information we hold about you. • Request correction of personal information that is inaccurate. • Request that we stop using your information for direct marketing.
9.3 How to Exercise Your Rights
To make an access, correction, or deletion request, please email us at privacy@almia.com.au. This inbox is monitored for privacy-related requests only; for any other question, please use the chat bubble in the corner of the page. Our service level: we will respond to privacy requests within 30 days. We may need to verify your identity (and, for requests about a child, your relationship to that child) before acting on your request. If you are not satisfied with our response, you may lodge a complaint with: • Australia: Office of the Australian Information Commissioner (OAIC) at oaic.gov.au • New Zealand: Office of the Privacy Commissioner at privacy.org.nz
10. Data Security
We implement technical and organisational measures to protect your personal information, including: • Encryption in transit (TLS 1.2 or higher for all browser and API traffic). • Encryption at rest for stored data, including your child’s photograph. • Australian data residency for storage: Amazon Web Services in the Sydney region. • Access controls limiting who within our organisation can access personal information. • Secure payment processing through PCI DSS compliant providers. • Multi-factor authentication on all administrative accounts. • Continuous monitoring and review of security practices and service provider arrangements. No method of electronic transmission or storage is completely secure. While we take reasonable precautions, we cannot guarantee absolute security.
11. Marketing Communications
We will only send you marketing communications if you have opted in to receive them. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting us. Unsubscribing from marketing will not affect transactional emails related to your orders. We handle marketing communications in line with the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ).
12. Notifiable Data Breaches
If a data breach is likely to cause serious harm, we will notify affected individuals and the relevant authorities in line with the Notifiable Data Breaches scheme (Australia, Privacy Act 1988 Part IIIC) and the New Zealand Privacy Act 2020. Our commitment: • We will assess any suspected breach within 30 days of becoming aware of it. • Affected individuals will be notified by email and, where appropriate, by in-product notice. • Where a breach affects information about a child, we will notify the parent or guardian on file. • Notifications will include a description of the breach, the information affected, the steps we are taking to remediate, and any recommended steps for you. The primary channel for any privacy concern, including suspected breaches, is privacy@almia.com.au.
13. Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing any personal information.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be posted on our website with an updated effective date. If we make significant changes to how we handle children’s information, we will take reasonable steps to notify affected users.
15. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights: Privacy enquiries: privacy@almia.com.au (monitored for privacy-related requests only). For all other questions, please use the chat bubble in the corner of almia.com.au.