Privacy Policy

Last updated: October 13, 2026. · Version 2026-10-13.v4

Who is responsible for the data?

Nepar is the data controller for the NEPAR Kids service. Use the email above for privacy questions or requests to access, correct or delete data.

What do we collect?

• parent name and email for the response
• the child’s name, age and idea description
• optional holiday personalization details, including the name of the person the message comes from
• selected voices, style, world and other creative instructions
• a pet photo only when you choose to include a pet
• technical data needed to protect the form and create a private link

Why do we use it?

We use the data to create the short idea description, contact the parent, prepare a private creative proposal, provide support and protect the form from automated submissions. We do not sell data or use it to publish a child publicly.

Legal basis

We ask for your explicit acknowledgement of this policy before submitting an idea description. We use data needed to provide the requested service, and legitimate interest for form security and system protection. We record the accepted text version and confirmation time.

Which services do we use?

• Cloudflare Turnstile processes security data needed to protect the form.
• R2 privately stores a pet photo when you upload one; the photo is not attached to email.
• Resend sends transactional emails to the parent and NEPAR team.
• OpenAI may process the order description and creative instructions to prepare a proposal; the pet photo is not sent in that request.

Recording a reaction

When you record a reaction, the recording is processed only in your browser. NEPAR Kids does not receive, store or upload it to its servers. The camera and microphone turn on only after your click and permission. You can download the recording or choose to share it using your device. An unsaved recording is lost when you close the page. This does not change order retention periods.

Usage analytics for the creation process

During the wizard flow we record a limited set of technical events — starting the wizard, completing a step, reaching the review screen, sending the description, opening a holiday page and printing a free letter (without what is written in it) — together with the product type, step number and language. We use a temporary, browser-generated session identifier; it is not linked to a name, email, idea description, photos or payment data. As with the rest of the service, Cloudflare, our infrastructure provider, technically records standard connection data (such as an IP address) for security and system operation, independent of these events.

How long do we keep it?

• the idea description, contact details and production files are kept while the order is active and for no longer than 365 days after delivery, after which we delete or anonymize them
• a pet photo is kept privately until the order is complete and automatically deleted no later than 30 days after delivery
• the private magic link is valid for 30 days (720 hours), can be reopened during that period and stops working after expiry or revocation
• creation-flow analytics events (containing no personal data) are deleted no later than 90 days after being recorded

Who can access an upload?

A pet photo is not public and is not attached to email. Access is limited to NEPAR team members who need it for production, quality review or support. The private proposal link does not expose the original photo.

Deletion and your rights

You can request access, correction or deletion by emailing [email protected]. Include the email used for the order and the order ID if available. We will respond without unnecessary delay and verify identity when needed.