Privacy Policy

The data controller is APATEC, a SASU with capital of €1,000, registered with the Perpignan Trade Register, headquartered at 39 rue de la Coutibe, 66540 Baho, France. To exercise your rights or for any questions, contact us at contact@fabolia.com.

We only collect data strictly necessary to create and deliver your personalized book. We apply the GDPR data minimization principle.

Uploading photos is optional. If you choose to send photos, here is exactly what happens:

We use the following subcontractors, each bound by a Data Processing Agreement (DPA):

Data transfers to countries outside the European Economic Area are governed by the standard contractual clauses (SCCs) approved by the European Commission, in accordance with Articles 46 and 49 of the GDPR.

Payments are fully processed by Stripe, PCI-DSS level 1 certified. Your card details (number, expiry date, CVV) never pass through our servers and are never stored by Fabolia. We only keep the Stripe transaction ID, the amount paid, and the payment date, necessary for order management and accounting obligations.

Your data is hosted on a dedicated server located in France, operated by Unyc (Inherent/ADISTA group), whose datacenters are exclusively located in France. Data does not leave the European Union territory, except when transmitted to the subprocessors listed above strictly for the described purposes.

We use a minimal number of cookies:

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access : obtain a copy of all data we hold about you, in JSON format, directly from your account.
• Right to rectification : request correction of inaccurate or incomplete data.
• Right to erasure : delete your entire account and data from your account or by contacting us. Deletion is immediate and irreversible.
• Right to data portability : export your data in a structured, machine-readable format (JSON) from your account.
• Right to restriction : request temporary suspension of data processing.
• Right to object : object to the processing of your data for direct marketing purposes.

To exercise these rights, log in to your account or email us at contact@fabolia.com. We will respond within 30 days.

In case of dispute, you may file a complaint with the French Data Protection Authority (CNIL) — www.cnil.fr.

By uploading photos or providing information to create your book, you declare and guarantee: (1) you are the parent or legal guardian of any minor child depicted, or have written permission from the parent or guardian; (2) you hold all necessary rights to the uploaded photos; (3) you do not upload photos featuring characters, toys, peluches, or elements protected by copyright or trademark (cartoon characters, licensed toys, brand logos, etc.). If these conditions are not met, APATEC reserves the right to refuse or cancel the order without refund. You are solely responsible for the content you provide and indemnify APATEC against any third-party claims.

We send transactional emails related to your order (confirmation, generation tracking, book ready, shipping). These emails are necessary to fulfill the contract and do not require separate consent. We may also send a reminder email if you have not completed your order (abandoned cart), based on our legitimate interest. Each such email includes an option to unsubscribe. We do not send newsletters or promotional emails without your explicit prior consent.

You can share your book via a unique link. By enabling sharing, the book's illustrations (including faces generated from photos) become accessible to anyone with the link. Sharing can be disabled anytime from your account. We recommend sharing this link only with trusted people.

We implement technical and organizational measures to protect your data: HTTPS encryption on all communications, passwordless authentication (single-use magic link), secure cookies (HttpOnly, Secure, SameSite=Strict), application firewall (UFW), intrusion detection (CrowdSec), rate limiting on sensitive endpoints, anti-bot protection (Cloudflare Turnstile), strict validation of uploaded files (MIME type and extension). No passwords are stored: authentication works exclusively via magic link sent by email.

Fabolia is a service intended to be used by adults (parents, legal guardians, relatives) to create books for children. We do not collect any data directly from minors. The user placing an order involving a minor child declares to be their parent or legal guardian, or to have obtained their authorization. Children's first names and photos are treated with the same security and confidentiality guarantees as adult data and are subject to the same retention and deletion rules.

We reserve the right to modify this privacy policy. In case of substantial changes, we will inform you by email or via a notification on the site. The date of the last update is indicated at the top of this page. We encourage you to check this page regularly.