How AI storybooks use your child's photo — and what happens to it

The first question parents ask before uploading a photo of their child is not “will the book look good”. It is “where does the photo go”. That is exactly the right question, and the answer should be checkable rather than reassuring.

Here is the whole process, in the order it actually happens.

Step 1 — Consent comes first

The upload field stays disabled until you confirm that you are the child’s parent or guardian and consent to the photo being used to make the book. This is not a formality. Thailand’s Personal Data Protection Act requires guardian consent before a minor’s data is processed, and that consent has to be freely given — refusing must cost you nothing else.

Step 2 — The photo is uploaded encrypted

It travels over HTTPS into private storage that is not publicly readable. The upload link is short-lived and scoped to your order alone.

Step 3 — AI replaces a face in artwork that already exists

This is the part most people picture incorrectly. The system does not ask an AI to invent a storybook from nothing. All 14 pages of illustration are drawn and reviewed in advance. What the AI does is replace the hero’s face with your child’s.

Two things follow. The artwork quality is predictable — no strange surprises on page nine. And your child’s photo is used for exactly one job: rendering the face in your copy. It is not used to train a model.

Step 4 — The original photo is deleted within 14 days

The photo you upload is automatically deleted within 14 days of upload, in every case — whether or not you paid, whether or not you order again. Deletion is a storage rule, not a task somebody has to remember.

The finished book stays with paid orders. Unpaid orders expire on the same 14-day clock.

Who sees the photo

• The image generation service — during processing only, to render the face in your book.
• The babysunshine team — only if you report a problem with a specific order.
• Advertising platforms — never. A child’s photo is never sent to any ad platform.

What PDPA gives you

Right	What it means here
Access	Ask what we hold about you and your child
Erasure	Ask for your account and its data to be deleted, at any time
Withdraw consent	Withdraw at any point; it applies to future processing
Rectification	Correct wrong details, such as a shipping address

The full detail is in the privacy policy, and deletion requests go through the data deletion page.

Three questions worth asking any provider

If you are comparing services, these separate the serious ones quickly.

1. When is the uploaded photo deleted — automatically, or only on request?
2. Is the photo used to train an AI model?
3. Is guardian consent collected before the upload, or buried in the terms?

In short

One photo, used for one job, held for no more than 14 days, then deleted automatically. That is the baseline to expect from any service that asks for a picture of a child — and worth confirming before you upload anywhere.