This policy applies only to the Lullashelf website and website-operated services. It does not govern use of the Lullashelf iPhone or iPad app; the app has a separate App Privacy Policy.
Lullashelf is operated by Four & More Limited, NZBN 9429053619358, New Zealand. Privacy enquiries can be sent to fourandmorenz@gmail.com with the subject "Privacy Request".
1. Website services covered
This policy covers the public website, Lulla Library browsing, email updates, website accounts, the self-service Book Creator, Premium Custom Storybooks, Stripe payment and delivery flows, customer support, and the website management service for organisation Private Libraries.
2. Information we collect
Browsing and updates
If you join updates, we collect your email address, optional name, signup source, status and timestamps. The website may also process basic request and security information needed to provide pages, protect the service and understand use of public library items.
Website accounts
If you create a customer website account, we store your email address, password hash, email-verification and password-reset records, session records, account timestamps, project history and records needed to export or delete your account data.
Book Creator and Premium Custom Storybooks
If you request or purchase a website-created storybook, we collect information you enter, which may include your name and email, story title and instructions, age range, family or character information, theme, format and package choices, reference image and image instructions, quote messages and project notes. Where a reference image contains an individual, we also record the timestamp and legal version for your confirmation that you have the rights, authority and permission required to use that individual's likeness. We also store previews, approvals, generated book files, output formats, status history, support actions, safety decisions, payment references and acceptance timestamps.
Website payments
Stripe processes payment details through Stripe Checkout. We receive information needed to complete and support your order, such as payment status, amount, currency, purchased service, Stripe transaction references and the checkout email address. We do not receive your full card number.
Private Libraries
For an organisation Private Library, we may store the organisation or library name, appointed account-holder name and login details (with passwords stored as hashes), session and access records, hashed member join codes, assigned libraries, uploaded .lullashelfbook files and cover images, book metadata, removal or moderation records, and support communications. A library's authorised members access available books through the app under the separate app policy.
Support
When you contact us, we receive the contact details, message, attachments and order or account details you choose to provide.
3. AI generation and reference images
The Book Creator and Premium Custom Storybooks use AI-assisted processing. Story instructions, selected personal details and reference images needed for moderation or creation may be sent to OpenAI to produce the service you request. Do not submit a person's name, likeness, image or other personal information unless you have authority to do so, especially where a child is involved.
Website-generated books are not published to the public Lulla Library merely because they were created through a paid service.
4. Why we use information
- to provide the website pages, accounts, newsletter signups and support you request
- to prepare previews and quotes, moderate requests, generate purchased digital books and make downloads available
- to process, confirm and support payments and fulfil orders
- to provide protected organisation Private Library management and delivery
- to prevent misuse, investigate errors, secure accounts and keep appropriate business, transaction and legal records
- to respond to access, correction, deletion, complaint and lawful authority requests
We do not sell your personal information or storybook content, and we do not use your storybook content for advertising.
5. Providers and overseas processing
To operate the website, Four & More Limited may disclose or process relevant information with service providers including Vercel for website hosting and configured application storage, Cloudflare R2 for protected finished-file storage, OpenAI for content moderation and AI generation, Stripe for checkout and payment confirmation, Resend or another email provider for transactional email and updates, and professional advisers or authorities where reasonably necessary or legally required.
These providers may process information outside New Zealand. We take reasonable steps required under New Zealand privacy law for overseas disclosures, including Information Privacy Principle 12 where it applies.
6. Children and other people in a request
The website is intended for use by an adult or an authorised organisation representative. A child should not create a website account, submit a paid request, or upload personal material without appropriate parent or guardian involvement.
If you provide information about another person, including a child, you confirm you have authority to provide it for the requested service. Where information is collected indirectly, Four & More Limited will take reasonable steps required by applicable privacy law, including New Zealand Information Privacy Principle 3A where it applies.
7. Storage and retention
- Self-service Book Creator drafts, submitted materials and finished downloads are retained for one month under the current account flow, then scheduled for deletion, except for records reasonably needed for payments, safety, disputes or legal obligations.
- Premium Custom Storybook project materials and delivery files are retained while the quoted service is being delivered and afterwards as reasonably needed for download, support, transaction, dispute and legal purposes, or until deleted where appropriate.
- Private Library uploaded books remain available while the organisation library service uses them, until removed by an account holder or support, or the service ends, subject to necessary records.
- Account, payment, acceptance, support and security records may be retained for a reasonable period for administration, compliance, accounting, fraud prevention and dispute handling.
- Newsletter details are retained until you unsubscribe or request deletion, subject to any suppression record needed to honour that request.
8. Your choices and rights
You can delete a website creator account through the website account controls. You can also request access to, correction of, or deletion of personal information we hold by emailing fourandmorenz@gmail.com. We may need to verify your identity, and some transaction, security, moderation or legal records may need to be retained.
New Zealand users may complain to the Office of the Privacy Commissioner if a privacy concern is not resolved.
9. Security and changes
We use reasonable measures appropriate to the website service, including hashed passwords and protected storage/access controls where configured. No online service is risk-free; keep login details and organisation join codes secure.
We may update this Website Privacy Policy if website functionality, providers or legal requirements change. A material change will be published with an updated version or effective date and, where appropriate, renewed acceptance will be requested.
10. Contact
Four & More Limited
NZBN 9429053619358
New Zealand
fourandmorenz@gmail.com