Privacy notice
A life story book holds precious, personal things. Here is exactly what we collect, why, who sees it and when we delete it.
Last updated: 8 November 2026
The short version
- We use your photos and answers only to make your book.
- We never ask about diagnosis, medication or medical history.
- We delete every photo and answer 30 days after your book is posted.
- We never sell your information or use book content for advertising.
- Analytics and advertising cookies stay off unless you say yes.
Who we are
Treasurefold is a trading name of Lime Creations Limited, which is the controller of the personal information described here. Our registered office is 71-75 Shelton Street, London WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO) under number ZA864594. You can contact us about anything in this notice at [email protected].
What we collect
| Whose | What | Why |
|---|---|---|
| You, if you order | Name, email, delivery address, order details. Payments are handled by Stripe; we never see your full card number. | To make and deliver your book, send order emails and keep accounting records. |
| The person the book is about | Their names, photos, captions and the answers you and your family give, including the "About me" sheet. An optional "What I believe" chapter may mention faith. | Only to make the book and sheet you asked for. |
| Relatives who add to a book | The name and relationship they type, and the photos and memories they add. | To show the organiser who added what, and to make the book. |
| People who ask for our free template | Email address, optional first name, and whether you agreed to occasional emails (with the wording and time). | To send the template and, only if you agreed, occasional emails. |
| Everyone who visits | IP address and browser details, used briefly for security and to stop abuse. Analytics and advertising data only if you accept those cookies. | To keep the site secure and, with your consent, to understand visits and measure adverts. |
We deliberately don't collect health information. There are no questions about diagnosis, medication, conditions or political views.
Our legal reasons (lawful bases)
- Contract: to make, proof, print and deliver the book you ordered.
- Legal obligation: to keep order and payment records for tax and accounting.
- Legitimate interests: to keep the site secure, prevent fraud and abuse, and answer your messages.
- Consent: for marketing emails and for analytics and advertising cookies. You can withdraw consent at any time.
A book can reveal sensitive things about a person, such as their faith, or simply that they live with dementia. We ask the person ordering to confirm they are acting in the best interests of the person the book is about, to involve them as much as they are able, and to include only what they would be comfortable with carers and visitors knowing. Contributors confirm they have permission to share photos of other living people.
Who we share it with
Only the companies we need to run the service, under contracts that require them to protect your information:
- Nobody prints your book but us. We print and pack every book ourselves, so no outside printer receives your photos or print files.
- Stripe, for payments.
- Shippo (Popout, Inc., USA), which checks your delivery address and buys the Royal Mail postage label, and Royal Mail, which delivers the book. They receive the delivery name and address, never the book's content.
- Amazon Simple Email Service (Amazon Web Services EMEA SARL, London region), our email provider, to send order, sign-in and proof emails.
- Our hosting and security providers, including Cloudflare, which protects the site and runs the security check on our forms.
- An email checking service (Emailable), which may check that an email address entered on our forms can receive email.
- Google and Meta, only if you accept advertising cookies (analytics runs only alongside them). If you have accepted marketing cookies when you order, your browser sends them a scrambled (hashed) copy of your email address so they can tell us whether an advert led to the order. We never share book content with them.
Some of these providers may process information outside the UK. Where they do, we rely on UK adequacy regulations or approved contract terms to protect it. We never sell personal information.
How long we keep it
| Information | Kept for |
|---|---|
| Photos, captions, answers, proofs and print files | Deleted 30 days after your book is posted, unless you ask us to keep them longer for reprints |
| Unfinished books that were never paid for | Deleted after 90 days without activity (we email a reminder first) |
| Cancelled books (for example after a refund) | Deleted 30 days after cancelling |
| Order records (name, email, address, amount, dates) | Six years, for tax and accounting. No book content. |
| Free template requests without email consent | Deleted after 30 days |
| Email list (only if you agreed) | Until you unsubscribe |
| Reviews you leave us | Three years after you last change the review, kept with your order rather than your book |
| Security logs | 30 days, containing IDs only, never names or captions |
| Backups | No longer than 30 days |
Reviews
About a week after your book is posted, we email to ask how we did, and once more about two weeks later if you haven't left a review or asked us to stop. If you leave us a review, we keep your star rating, any comment you write and, only if you tick the box allowing us to quote it, your first name and town, together with the wording you agreed to and when. We keep this with your order rather than your book, so it stays after the book's photos and words are deleted, and we delete it 3 years after you last changed it. If you choose "Don't ask me again", we keep a coded (hashed) form of your email address so we never ask you again.
How we protect it
- Every book is reached only through long, random, private links; invite and sign-in links are stored only in scrambled form.
- Photos are re-saved when uploaded, which strips hidden information such as location, and are only ever shown to people with the right link.
- Everything is sent over encrypted connections and stored privately, never in a public folder. Our server is hosted by SpeedyPage in its London data centre and managed through the RunCloud control panel. RunCloud is run by RunCloud Sdn Bhd in Malaysia and can access our server; their data processing agreement includes the ICO’s UK Addendum to the EU standard contractual clauses. Our backups are made through RunCloud and stored with Amazon Web Services.
- Access to our admin area needs a password and a second security code, and admin actions are logged.
Your rights
You can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it to another service. You can withdraw consent at any time. Email [email protected]; we'll reply within one month.
If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
Children
Our service is for adults. Grandchildren are welcome to add memories with a parent's help.
Changes to this notice
If we make important changes we'll update the date at the top and, if you have an order in progress, tell you by email. Our cookie page explains cookies in more detail.