Privacy Policy

Lamp & Kin Version 1 (draft). Effective [DATE]. Last updated 24 October 2026.

Lamp & Kin makes illustrated picture books that star your family. To do that we ask for something precious: photos of the people you love, often your children. This policy explains, as plainly as we can, what we collect, why, who helps us, where it goes, how long we keep it, and how you stay in control.

If you only read one part, read this:

• You choose what to share. We collect photos only from adult account holders, never directly from children.
• Original photos don't stay. We delete them automatically: 7 days after your book is finished or ordered, or 30 days after you last worked on an unfinished draft (we email you first). You can delete them sooner at any time.
• Your photos and books are not used to train AI models. Not by us, and not by the AI services we use, under the terms we have with them (details below).
• We don't sell your information, and we don't show ads.
• You can delete everything with "Delete my account and everything" in your account settings.

1. Who we are

Lamp & Kin is a sole proprietorship owned by Sumeet Singh Mankoo, based in Burlington, Ontario, Canada ("Lamp & Kin", "we", "us"). We are responsible for the personal information described in this policy.

• General questions: hello@lampandkin.com
• Privacy questions and requests: privacy@lampandkin.com
• Mailing address: [BUSINESS MAILING ADDRESS], Burlington, Ontario, Canada

Person in charge of the protection of personal information (privacy officer): Sumeet Singh Mankoo, Owner. Reach him at privacy@lampandkin.com or at the mailing address above. This role is required by Quebec's private-sector privacy law, and it is also our accountable person under Canada's PIPEDA.

2. Who this policy covers

• Account holders: the adult (18 or over) who signs up, makes a book and buys it.
• People in the photos: the children, relatives, friends and pets whose photos an account holder uploads. We don't have a direct relationship with them, so we rely on the account holder to have their permission (see section 6).
• Gift recipients: people whose name and shipping address you give us for a hardcover.
• Visitors to lampandkin.com.

Lamp & Kin is for adults. Children don't use it and can't have accounts.

3. What we collect

We don't ask for, and ask you not to upload, government ID, health information, school records, or photos that show anyone undressed.

Is any of this "biometric" data? We don't create face-recognition templates or faceprints, and we don't use photos to identify or verify anyone. Our system looks at a photo to paint a likeness, much as a portrait artist would, and keeps only a short written description of lasting features (see "Character descriptions" above).

4. Why we use it

We use your information only to:

1. Make your book: turn photos into drawn characters, help write and illustrate the story, build the ebook and print files.
2. Check photos before anything is drawn: an automated check turns away photos that show nudity, a public figure or a cartoon character, or that are too unclear to draw. If a photo is turned away and you think that's a mistake, write to hello@lampandkin.com and a person will look at it.
3. Sell and deliver your book: take payment through Shopify, deliver your digital files, and send hardcovers to Lulu to print and ship.
4. Sign you in and keep your account secure: magic links sent by email, and fraud and abuse prevention.
5. Talk to you: sign-in links, order confirmations, shipping updates, deletion reminders and replies to your messages. We'll only send marketing email if you opt in, and every marketing email has an unsubscribe link.
6. Keep the service working: fix bugs, monitor costs and prevent misuse, using technical logs. We don't use your photos or books for this.
7. Meet our legal obligations: tax and accounting records, responding to lawful requests, and proving consent.

We do not:

• sell or rent your personal information, or "share" it for cross-context behavioural advertising;
• show ads, or use your information to profile you;
• use your photos, characters, stories or books to train AI models, or let our providers do so;
• use photos to recognise or identify people;
• show your book to anyone else, or use it in our marketing, unless you give us separate, written permission.

5. Legal bases (for people in the EU and UK)

If EU or UK data-protection law applies to you, we rely on:

• Contract: to make and deliver the book you asked for and run your account.
• Consent: for processing photos of you and your family, and for any optional marketing. You can withdraw consent at any time by deleting the photos or characters. This doesn't affect what we did before you withdrew.
• Legitimate interests: to keep the service secure, prevent abuse, and improve how it works using technical logs. We have weighed these interests against your rights.
• Legal obligation: tax, accounting and responses to lawful requests.

6. Children's privacy, and the people in your photos

Lamp & Kin is made for parents and families, not for children to use. Accounts are for adults 18 and over. We don't knowingly collect personal information directly from anyone under 18, and children are never asked to sign in, upload or type anything. If we learn a child has created an account, we'll close it and delete its data.

We do, of course, receive photos and details of children, from their parents or guardians. Here is how we handle that:

• The account holder gives permission for each photo. Before any photo is uploaded, you confirm that you are the person's parent or legal guardian, or that you have permission from them (or, for a child, from their parent or guardian), and that you agree to how we'll use it. We keep a record of that confirmation for every photo.
• The adult behind the account is the person consenting. We check that you are an adult when you sign up, the account is tied to your verified email address, and we only ever deal with the account holder. [[To settle: verifiable parental consent method.]]
• We collect only what we need: a photo good enough to draw from, a first name or nickname, and an age. We don't need surnames, schools or locations, so please leave them out.
• We use it only to make your book. Children's information goes only to the service providers who help make and deliver it (section 8), never to advertisers or data brokers, and is never used to train AI.
• We delete it on a fixed schedule (section 10). Original photos are deleted within days. Drawn characters stay only while you keep them.
• You stay in control. You can see, change or delete your children's information at any time from your account, or by writing to privacy@lampandkin.com.

United States (COPPA): The US Children's Online Privacy Protection Act protects personal information collected online from children under 13. Lamp & Kin isn't directed to children and doesn't collect information from them. Even so, because a photo of a child is personal information, we follow COPPA's protections for the photos and details parents give us: clear notice, the parent's consent, use limited to making the book, no disclosure beyond what's needed to deliver it, a written retention schedule with deletion, and the parent's right to review and delete.

Canada and Quebec: Canadian privacy regulators expect a parent's or guardian's consent for children who are too young to consent for themselves (generally under 13). Quebec's law requires a parent's or guardian's consent to collect personal information about a minor under 14. That's why consent always comes from the parent or guardian.

Other adults in your photos (grandparents, aunts, friends): please ask them first. If someone in a book asks us to delete their image, contact us and we'll work with you to remove it.

7. Where your information is stored, and transfers outside Canada

Our main systems run on Amazon Web Services in Canada (Montreal, ca-central-1). Some of our service providers process information in the United States, and their own subcontractors may process it in other countries. That includes the AI services that write the story and paint the illustrations, our email service, and our printer.

When your information is outside Canada, it's protected by our contracts with those providers and by their security, but it's also subject to the laws of that country, and the authorities there may be able to access it. For Quebec residents: we assess the risks before any personal information leaves Quebec, as Quebec law requires.

If we start serving the EU or UK, we'll rely on an adequacy decision (for transfers to Canada) and on the European Commission's Standard Contractual Clauses, the UK addendum, or the EU-US Data Privacy Framework (for transfers to the United States), and we'll update this section.

8. Who helps us (service providers)

We share personal information only with the providers below, only as much as each needs for its job, and under terms that stop them using it for their own purposes, except where noted.

We may also disclose information when the law requires it (for example a valid court order), to protect someone's safety, or to investigate fraud or misuse. If the business is ever sold or transferred, your information would move with it only under this policy's protections, and we'd tell you first.

9. How AI is used

The AI parts of Lamp & Kin draw your characters, suggest and polish story text, and check photos before drawing. Every AI result is shown to you before you buy, and you can edit, redraw or delete any of it. AI doesn't make decisions about you that have legal or similarly significant effects. The one automated decision is the photo check that can turn a photo away, and you can ask a person to review it. More detail, in plain language: AI and your photos.

10. How long we keep things

We keep personal information only as long as we need it for the purposes above, then delete it or make it anonymous.

11. Your rights and choices

Wherever you live, you can:

• See the personal information we hold about you and your family, and get a copy in a portable format (you can also download your books at any time).
• Correct anything that's wrong. Most things you can edit directly in the app.
• Delete photos, characters, books or your whole account. In the app: Delete my photos removes every original photo right away; Delete my account and everything removes your account, photos, characters, books and consent records, apart from order and tax records we're required to keep.
• Withdraw consent for any photo or character by deleting it. We'll stop using it.
• Opt out of marketing email at any time.
• Ask how we use your information, who we share it with, how long we keep it, and who on our side can see it.
• Complain to us, and to a privacy regulator (below).

Quebec residents also have the right to ask us to stop sharing your information or to de-index it, to have computerized information you gave us sent to you or to another organization in a structured, commonly used technological format, and to be told about, and have a person review, any decision made solely by automated processing. You can complain to the Commission d'accès à l'information du Québec.

California residents have the right to know, delete, and correct personal information; to opt out of the sale or sharing of personal information (we don't sell or share it); to limit the use of sensitive personal information (we use it only to provide the service you asked for); and not to be treated differently for exercising these rights. You may use an authorized agent. Residents of other US states with privacy laws have similar rights, and we honour them the same way.

EU and UK residents also have the rights to restrict or object to processing, to data portability, and to lodge a complaint with your local data-protection authority.

How to make a request

Email privacy@lampandkin.com from the email address on your account, and tell us what you'd like. To protect your family, we'll confirm the request comes from the account holder before acting, usually by sending a link to that address. We'll reply within 30 days. If we need longer, we'll tell you why. Requests are free. If we can't do something you've asked (for example, because the law requires us to keep tax records), we'll explain why and tell you how to complain.

Regulators

• Canada: Office of the Privacy Commissioner of Canada
• Quebec: Commission d'accès à l'information du Québec
• California: California Privacy Protection Agency
• UK: Information Commissioner's Office. EU: your local data-protection authority.

12. How we protect your information

• Everything is encrypted in transit (HTTPS/TLS) and at rest.
• Photos are stored privately, never at public web addresses. Files are served through short-lived, signed links.
• Location and camera data are stripped from photos on arrival.
• Access is limited to the owner, with multi-factor authentication. Production systems are separate from development and testing.
• Sign-in uses single-use, time-limited email links, so there's no password to steal.
• Photos are checked automatically before anything is drawn, and per-draft limits slow down misuse.
• We keep a written security programme covering children's information, review it at least once a year, and require our service providers to protect information at least as well as we do.

No system is perfectly secure, but we work hard to deserve your trust.

13. If something goes wrong (breach notification)

If there's a breach of security safeguards involving your information, we will:

• contain it and investigate straight away;
• notify you as soon as feasible if it creates a real risk of significant harm (Canada) or a risk of serious injury (Quebec), with what happened, what information was involved, what we're doing, and what you can do;
• report it to the Office of the Privacy Commissioner of Canada and/or the Commission d'accès à l'information du Québec, as the law requires, and notify any other organization that can help reduce the harm;
• notify affected people and regulators under other applicable laws (for example US state breach laws, and, if we serve the EU or UK, the authority within 72 hours where required);
• keep a record of every breach and confidentiality incident, as the law requires.

14. How we manage privacy (governance)

The privacy officer (section 1) approves our privacy practices. They include a register of the personal information we hold, the retention and deletion schedule in section 10, privacy impact assessments before new systems or transfers outside Quebec, a breach and incident register, privacy-protective default settings, and a complaint process: write to privacy@lampandkin.com and we'll answer within 30 days.

15. Changes to this policy

When we make a meaningful change, we'll email you and show a notice in the app at least 30 days before it takes effect, and ask for fresh consent where the law requires it. We will never start using existing photos in a new way, such as training AI, without your express permission. Earlier versions are available on request.

16. Contact

Privacy officer: Sumeet Singh Mankoo privacy@lampandkin.com [BUSINESS MAILING ADDRESS], Burlington, Ontario, Canada