Privacy Policy

Last updated: 10 September 2026

1. About this policy

This policy explains what we do with the personal information you give us when you use DearYou to create personalised birthday invitations, at uk.dearyou.ai and dearyou.ai.

The controller of that information is DearYou (dearyou.ai), a business established in Spain. You can reach us about anything in this policy at hello@dearyou.ai.

2. What information we collect

• The photo you upload. The image of the person the invitation is for — usually your child. This is what we use to create the design.
• Your delivery email address. Where we send the finished invitations.
• What you tell us in the chat. The details you give us so we can personalise the design: the name that will appear, the theme, colours, the date of the party, and anything else you ask for.
• Payment information. Payments are handled directly by Stripe. We do not store your card details.
• Measurement and advertising data. Only if you accept the corresponding cookies — see section 9.

3. How we collect it

Almost all of it comes straight from you: you upload the photo, you type the details into the chat, and you give us the email address you want the invitations sent to. Payment details go directly to Stripe and never reach us.

Measurement and advertising data is collected automatically by the providers listed in section 6, and only after you have accepted that category in the cookie banner.

4. What we use it for

• Creating and delivering the personalised invitations you ask for.
• Taking payment for your order.
• Emailing you the result and answering your questions.
• Meeting our legal obligations around invoicing and tax.
• With your consent, measuring how the site is used and showing you our advertising.

5. Our lawful bases

Under the UK GDPR we need a lawful basis for everything we do with your information. Ours are:

6. Who we share it with

To run the service we work with providers who act as our processors. Each one only handles the information it needs to do its job:

We do not sell your personal information. The measurement and advertising services above (Google Analytics, Meta, TikTok, Google Ads) are only switched on if you consent in the cookie banner.

We may also disclose information where the law requires it, or to establish or defend legal claims.

7. How long we keep it

• The original photo: we delete it from our servers once your order has been delivered, and in any case within 24 hours.
• Billing records: we are a Spanish business, and Spanish law generally requires invoices and tax records to be kept for 4 years for tax purposes and 6 years under commercial law. In some cases the period can be longer.
• Your email address and order details: for as long as you are a customer, and afterwards for as long as we need them to meet the legal periods above.

8. Sending information outside the UK

Our main hosting is in Germany, in the European Union. Some of our providers (Stripe, Google, Meta, TikTok) may process information outside the UK and the European Economic Area.

Where information leaves the UK, those transfers are covered by UK adequacy regulations where they apply, and otherwise by the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, which are designed to give your information a level of protection equivalent to the one it has in the UK.

9. Cookies

We use cookies and storage that are necessary for the site and the chat to work and, with your consent, cookies for measurement and advertising. You can accept them, reject them or change your mind at any time from the cookie banner (the "Customize" button).

10. Children's privacy

Our invitations often feature a child, so it is worth being precise about how that works.

The person who orders the invitations and uploads the photo must be an adult with parental responsibility for the child, and confirms when ordering that they have the authority to let us use that image. We do not create accounts or profiles for children, and the service is not directed at children. The photo is used only to generate the design and is deleted after delivery, as set out in section 7.

In the UK, a child can consent on their own behalf to an online service processing their personal data from the age of 13. Below that age, consent has to come from whoever holds parental responsibility.

11. Your rights

You can ask us at any time to:

• Access the personal information we hold about you, and get a copy of it.
• Correct anything that is wrong or incomplete.
• Erase it.
• Restrict what we do with it.
• Object to us using it.
• Port it — receive it in a portable format, or have us send it to someone else.
• Withdraw your consent, at any time, where we relied on it. Withdrawing consent does not affect anything we did with your information before you withdrew it.

Write to hello@dearyou.ai and we will deal with it. Exercising these rights is free, and we will not treat you differently for doing so.

If you are unhappy with how we have handled your information, you can complain to the UK's data protection regulator, the Information Commissioner's Office (ico.org.uk). Because we are established in Spain, you may also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).

12. Security

We apply reasonable technical and organisational measures to protect your information: an encrypted connection, restricted access, and deletion of the original photo after delivery. No system is infallible, but we work to keep the risk as low as we can.

13. Changes to this policy

If we change how we handle your information, we will update this page and change the date at the top. If the change is significant, we will tell you before it takes effect.

14. Contact us

For anything to do with your privacy, including any of the rights in section 11, write to hello@dearyou.ai.