Privacy Policy

1. Who is responsible for your data

LightStories Studio determines why and how personal data connected with the website and Miracle Film service is processed and acts as the data controller under the GDPR. Privacy questions may be sent to hello@lightstories.studio.

2. Data we collect

• Customer contact data: name, email address, telephone number, preferred messenger, username and the content of communications.
• Project data: selected format or story, occasion, desired date, language, ideas, preferences and other order details.
• Child data: name, age, interests, favourite characters, dreams, traits and other details voluntarily supplied to personalize the film.
• Photos, videos, audio and other materials supplied for creating the film.
• Technical and analytics data: IP address, device and browser type, language, approximate location, referral source, UTM parameters, pages visited, clicks, form events and sessions.

3. Children’s data

The service is intended for adult customers. By providing a child’s personal data, photographs or videos, the customer confirms that they are the child’s parent or legal guardian, or that they otherwise have the necessary permission. Please do not provide information that is not needed to create the film.

4. How we use data

• To process requests, contact customers and agree project details.
• To create, edit, deliver and support a personalized film.
• To operate and secure the website and prevent spam, abuse and technical failures.
• To measure website and advertising effectiveness, understand visitor interactions and improve the service.
• To comply with legal obligations and protect legal rights.

5. Legal bases

Depending on the circumstances, we process data to perform a contract or take steps requested before entering into a contract; on the basis of your consent; to comply with legal obligations; or for our legitimate interests in operating, protecting and improving the service where those interests are not overridden by your rights. Where required, optional cookies and analytics are used on the basis of consent.

6. Photographs and videos

We use submitted media only to discuss, produce, edit and deliver the order unless something else is separately agreed. We do not publish the finished film or source materials in a portfolio, advertising or social media without separate permission.

7. Providers and third-party services

We may use providers that process data on our instructions or act as independent controllers to operate the website and service.

• Vercel — website hosting, delivery, logs and technical protection.
• Notion — request and project-detail management.
• Resend — transactional email delivery.
• Google Analytics, Meta Pixel, PostHog and Microsoft Clarity — analytics, effectiveness measurement, diagnostics and user-experience improvement.
• YouTube — embedded video playback; when a video is started, YouTube may receive technical data and set its own cookies.

8. Cookies and similar technologies

The website may use essential cookies and local storage for core functionality and duplicate-event protection. Analytics and advertising services may also use cookies, pixels and identifiers under their own policies and applicable law. You can adjust cookie settings in your browser; blocking some technologies may affect website functions.

9. Data sharing

We do not sell personal data. We may share the minimum necessary data with providers and contractors that help us deliver the service, professional advisers where needed to protect rights, and public authorities where required by law.

10. International transfers

Some providers may process data outside Portugal, the EEA or your country of residence. Where relevant, we rely on an adequacy decision, Standard Contractual Clauses or another GDPR-recognised safeguard.

11. Retention

We keep data only for as long as necessary for the purposes described in this Policy, performance of the contract, resolution of disputes and compliance with legal obligations. The period depends on the data type and applicable requirements. When data is no longer needed, we delete, anonymize or securely isolate it. You may ask us about the retention period that applies to specific data.

12. Security

We use reasonable technical and organisational measures, including access controls, protected transmission, data minimisation and provider oversight. No method of transmission or storage can guarantee absolute security.

13. Your GDPR rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your data; object to processing; withdraw consent without affecting prior lawful processing; and lodge a complaint with a supervisory authority, including Portugal’s Comissão Nacional de Proteção de Dados (CNPD). We may need to verify your identity before completing a request.

14. Third-party links and policies

The website may contain third-party links and embedded content. Their data practices are governed by their own policies. We recommend reviewing the official privacy information of Vercel, Notion, Resend, Google, Meta, PostHog, Microsoft and YouTube.

15. Changes to this Policy

We may update this Policy when the service, providers or legal requirements change. The current revision date appears at the top of this page.

16. Contact

For privacy questions or to exercise your rights, email hello@lightstories.studio. Country: Portugal.

hello@lightstories.studio