Subprocessor List
Effective 25 April 2026
Almia (ABN 25 380 435 979) is based in Sydney, New South Wales, Australia.
When you create a book with Almia, your information is processed by us and by a small set of trusted service providers (subprocessors) we rely on. This page lists each one by legal name, the data they access, the country they operate in, and the link to their published privacy commitments. The list is updated as our service stack changes. For the broader privacy framework, see our Privacy Policy at /privacy.
1. AI partners
Anthropic, PBC • Country: United States • Data accessed: Story text, generated illustrations, child profile text (name, age, interests, traits). Does not access your child’s photograph. • Purpose: Text generation and quality review. • Retention: 30 days, under their commercial API terms. • Trains on this data: No. • Privacy: anthropic.com/legal/privacy and privacy.claude.com/en/articles/7996866-how-long-do-you-store-personal-data Google LLC • Country: United States • Data accessed: Child photograph, generated illustrations, story text, child profile text. • Purpose: Image processing. • Retention: 30 days, for abuse monitoring only, under their paid Gemini API terms. • Trains on this data: No. • Privacy: ai.google.dev/gemini-api/terms and policies.google.com/privacy
2. Infrastructure
Amazon Web Services, Inc. • Country: Australia (Sydney region) for data storage; United States for the corporate entity. • Data accessed: All Almia data at rest, including the original child photograph. • Purpose: Encrypted cloud storage and hosting of backend services. • Retention: Almia-controlled, per the retention rules in our Privacy Policy. • Trains on this data: Not applicable. • Privacy: aws.amazon.com/privacy Vercel Inc. • Country: United States. • Data accessed: Web hosting, request and error logs. • Purpose: Hosting the public website and edge delivery. • Retention: Per Vercel’s policy. • Trains on this data: Not applicable. • Privacy: vercel.com/legal/privacy-policy
3. Payments
Stripe, Inc. • Country: United States. • Data accessed: Parent name, email, billing address, payment instrument details (processed directly by Stripe; we do not store card details on our servers). • Purpose: Payment processing. • Retention: Per Stripe’s data processing agreement. • Trains on this data: Not applicable. • Privacy: stripe.com/au/privacy
4. Email and marketing
Postmark (Wildbit, LLC) • Country: United States. • Data accessed: Parent email address and the content of transactional emails (order confirmations, shipping updates, account emails). • Purpose: Transactional email delivery. • Retention: Per Postmark’s policy. • Trains on this data: Not applicable. • Privacy: postmarkapp.com/privacy-policy Brevo SAS • Country: France. • Data accessed: Parent email address and lifecycle event data (for example, that you placed an order or that your character approval is pending). • Purpose: Lifecycle communications related to your order, and marketing emails if you have opted in to marketing. • Retention: Per Brevo’s policy. • Trains on this data: Not applicable. • Privacy: brevo.com/legal/privacypolicy
5. Print and shipping
Prodigi (Prodigi Group Ltd) or Gelato (Gelato Group AS), depending on the region your order ships from. • Country: United Kingdom (Prodigi) or Norway (Gelato). • Data accessed: Parent shipping name and address, and the finished printable book file. Does not access your child’s photograph. • Purpose: Printing the book and arranging shipment. • Retention: Per the relevant partner’s policy. • Trains on this data: Not applicable. • Privacy: prodigi.com/privacy and gelato.com/legal/privacy-policy
6. Updates to this list
We will update this page when we add, remove, or change a subprocessor. The effective date at the top of the page reflects the most recent update. If you have questions about a specific subprocessor or want to verify the data we share with them, please email privacy@almia.com.au.