Privacy Policy and Personal Data Protection (PDPA)

1. Privacy Policy

babysunshine (babysunshine.app) is a product operated by AppWow (appwow.co), the data controller under PDPA ("we"). We collect only the data needed to create your personalized storybook, namely:

• Account data — your name, email, and profile picture from the sign-in provider you choose (LINE, Google, or Facebook)
• Your child's photo — one front-facing photo uploaded by a parent or guardian, used solely to create the storybook illustrations
• Order data — the story you chose, the book format, and the shipping address (printed books only)

We never sell or share your data with third parties for marketing. Payments are processed by our payment provider, Opn — we never store your card details.

2. Parental Consent

A child's photo is a minor's personal data, so we require a parent or legal guardian to give explicit consent before every upload by ticking the confirmation box on the upload page. This consent covers:

• Using the photo to create the storybook illustrations for that child, for a single order
• AI processing to paint the child's face into the illustrations
• Temporary storage for the period described in section 3

You can withdraw consent at any time via the contact channel in section 4 — withdrawing consent means we delete the photo and all related work immediately.

3. Deletion Within 14 Days

4. Analytics and Advertising Cookies

We use third-party cookies to measure site usage and advertising performance: Google Analytics 4, Google Ads, and the Meta (Facebook) Pixel, all managed through Google Tag Manager. These are not strictly necessary cookies, so you can accept or reject them from the cookie banner and change your mind at any time. If you reject them, the site continues to work exactly as normal.

• What we store — Google Analytics' browser identifier (the `_ga` cookie) and Meta's identifiers (the `_fbp` and `_fbc` cookies). These are random identifiers that contain no name, email, or photograph of you or your child.
• How they are used — when an order is paid, we send these identifiers and the order amount to Meta and Google so we can tell which advertisement led to the purchase. We never send your child's photograph or storybook content to any advertising provider.
• Email and phone number — shared with Meta only as a one-way (SHA-256) hash, never as the actual value.
• Retention — we erase these identifiers from the order as soon as the conversion has been reported, so they are not retained afterwards.

5. Your Rights as a Data Subject

Under PDPA you have the right to access, obtain a copy of, correct, delete, or withdraw consent for your and your child's personal data at any time. To delete your account and all of your data, follow the steps on the “Delete my data” page.

You can also contact us directly atsupport@babysunshine.appWe will respond within 30 days of receiving your request.