ClevarooPrivacy Policy
Last updated: 21 October 2026
This policy explains how Clevaroo handles personal data when you create and buy a personalised book. We collect only what we need to make your book, never use your child's details for marketing, and never use them to train AI models.
1. Who we are
Clevaroo is operated by POM3 Consulting AB, org. nr 559080-7862, Ekbacksvägen 28, Bromma, Sweden ("we", "us"). We are the controller of the personal data described here. Contact us about privacy at clevaroo@pom3group.com or by post at the address above. We have not appointed a data protection officer, as we are not required to.
2. Who this policy is for
Clevaroo is for parents, guardians and other adults buying books for children. You must be 18 or older to use the site. Children should not use the site or enter information themselves.
3. What we collect
| Data | Whose | Where it comes from |
|---|---|---|
| First name or nickname, age, gender | The child the book is for | You |
| Optional first names of siblings or friends | Those children or people | You |
| Optional drawing or photo of a toy you upload | Created or owned by you or the child | You |
| Story choices: themes, lesson, interests, language | About the child | You |
| Name, email, delivery address, phone (for printed books) | You | You |
| Gift recipient’s name, delivery address and phone number (if given) | The person you send a book to | You |
| Order details: product, price, date, consent records | You | Generated at checkout |
| Payment confirmation (we never see full card details) | You | Stripe |
| Technical data: IP address, browser, device, security logs | You | Your device |
We ask only for first names or nicknames, never surnames. Please do not upload photos of children or include sensitive details such as health information, full names or addresses in drawings or text fields. Only enter another child's name if you have their parent's permission.
4. Why we use it and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating a free preview at your request | Child and story data, drawing or toy photo | Your data: steps you ask us to take before a purchase, Art. 6(1)(b). Other named people’s data: legitimate interest, Art. 6(1)(f). |
| Creating, printing and delivering your book | Child and story data, drawing, your contact and delivery details | Your data: performance of our contract with you, Art. 6(1)(b). The child's and other named people's data: our and your legitimate interest in fulfilling the order you placed, Art. 6(1)(f). |
| Taking payment and preventing fraud | Order and payment data | Contract, Art. 6(1)(b); legitimate interest in preventing fraud, Art. 6(1)(f) |
| Order emails, download links, customer support, complaints | Contact and order data | Contract, Art. 6(1)(b) |
| Delivering a book you send as a gift | Gift recipient’s name, address and phone | Our and your legitimate interest in delivering the gift you ordered, Art. 6(1)(f) |
| Bookkeeping and tax | Order and payment records (no child data) | Legal obligation, Art. 6(1)(c), under the Swedish Bookkeeping Act (1999:1078) |
| Running and securing the website | Technical data | Legitimate interest in a secure, working service, Art. 6(1)(f) |
| Marketing emails (only if you opt in) | Your email | Consent, Art. 6(1)(a); you can withdraw it at any time |
We never use your child's details for marketing or profiling.
5. How AI is used
Your story choices and the details you enter are sent to AI services to write the story and create the illustrations: Anthropic writes the story text and checks the illustrations, and Google (Gemini) and Black Forest Labs (FLUX) create the illustrations. When you upload a drawing or toy photo, an AI service first checks it for people, faces and brands. Names are not sent to the services that create the illustrations. We use these services under business terms that do not allow them to use your data to train their models. The providers keep the data only for a short period for operating the service and preventing abuse, as stated in their terms. No decisions with legal or similarly significant effects are made about you or your child by automated means.
6. Who we share data with
We do not sell personal data. We share it only with providers that help us run Clevaroo:
| Provider | Role | What they do | Location |
|---|---|---|---|
| Anthropic, PBC | Processor | AI generation of story text and checks of the illustrations | USA |
| Google Cloud (Google Ireland Ltd / Google LLC) | Processor | Hosting and storage; AI generation of illustrations (Gemini) | EU |
| Black Forest Labs | Processor | AI generation of illustrations (FLUX), when Google is busy | EU/USA |
| Stripe Payments Europe Ltd | Processor, and independent controller for its own legal and fraud obligations | Payments | EU/USA |
| Brevo (Sendinblue SAS) | Processor | Sending order emails from pom3group.com | EU (France) |
| PostNord (PostNord Sverige AB and its delivery partners in the destination country) | Independent controller | Delivering printed books to you or your gift recipient (name, address, phone) | Sweden and destination country |
We may also disclose data if the law requires it, for example to authorities.
7. Transfers outside the EU/EEA
Some providers process data in the USA. We protect these transfers with the EU–US Data Privacy Framework where the provider is certified, or with the European Commission's Standard Contractual Clauses (GDPR Art. 45–46). You can ask us for a copy of the safeguards. For UK customers, the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum applies.
8. How long we keep it
| Data | Kept for |
|---|---|
| Free previews not followed by a purchase | 30 days, then deleted |
| Story inputs and uploaded drawings | 90 days after delivery, then deleted |
| Uploads that fail the automatic check | Deleted immediately |
| Finished PDF and download link | 12 months after purchase, so you can download again |
| Order emails and support conversations | 24 months after the order, to handle complaints |
| Delivery details (name and address of you or your gift recipient) | With the order records: 24 months after the order |
| Recipient’s phone number | Deleted once the book is delivered (30 days after we send it) |
| Bookkeeping records (no child data) | 7 years after the end of the financial year, as Swedish law requires |
| Security logs | 30 days |
You can ask us to delete your book and inputs earlier at any time.
9. Your rights
You have the right to access, correct or delete your data, to restrict or object to processing, and to receive your data in a portable format (GDPR Art. 15–22). You can withdraw consent to marketing at any time. Because we do not have accounts, please write from the email address used for your order so we can verify the request. We reply within one month.
You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or to the authority in your own EU country. UK customers can complain to the Information Commissioner's Office, ico.org.uk.
10. Cookies
We use only cookies that are strictly necessary for the site and checkout to work, including cookies set by Stripe to prevent fraud. These do not require consent under the Swedish Electronic Communications Act (2022:482).
11. Security
Data is encrypted in transit, stored with access limited to the people who need it, and deleted on the schedule above. If a breach is likely to put you at high risk, we will tell you.
12. US residents
We do not sell or share personal data for cross-context behavioural advertising. You can ask to know, correct or delete the data we hold about you using the contact details above, and we will not discriminate against you for doing so.
13. Changes
We will post any changes here and update the date at the top. If a change is significant, we will tell customers with active download links by email.