Privacy policy

Your child's photos are the most sensitive thing you will ever give us. This page says exactly what we do with them, in plain language, under POPIA.

Last updated 5 October 2026

Who we are

Hero Tales is operated by Ernys Sweets Holdings (Pty) Ltd, trading as HeroTales (registration 2023/198991/07), [Street address], KwaDukuza, KwaZulu-Natal, South Africa. We are the responsible party under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is [Full name of your POPIA Information Officer], reachable at hello@herotales.co.za.

What we collect

Children's information and consent

POPIA treats a child's personal information as special. We only process a child's photos and details with the consent of a competent person (a parent or legal guardian), which you give when you tick the consent box while creating a book. By uploading photos you confirm you are that person, or that the parent or guardian has authorised you.

Why we use it

We do not sell personal information, and we do not use photos for advertising.

Artificial intelligence

To illustrate your book, photos are sent to our AI illustration provider together with a description of each scene, and the story text is written with an AI language model. We use paid business tiers of these services whose terms prohibit the provider from using your data to train their models. Your photos are never used to train AI, by us or anyone else.

How long we keep photos

Where it lives

Photos, generated artwork and book files are stored encrypted on servers we control. Our payment provider (Yoco), email provider and AI providers each receive only what they need to perform their part, under their own privacy terms. Some of these providers operate outside South Africa; where they do, we rely on their contractual safeguards as permitted by section 72 of POPIA.

Cookies

We use one essential cookie to keep you signed in. We do not run advertising or tracking cookies.

Your rights

You may ask what personal information we hold, correct it, have it deleted, or object to its processing by emailing hello@herotales.co.za. We respond within 30 days. If you are not satisfied, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

Security

Encryption in transit and at rest, access limited to staff who need it to fulfil your order, and automatic deletion timers. If a breach ever affects your information we will notify you and the Regulator as POPIA requires.

Changes

If we change this policy we will update the date above and, for material changes, email you.

Privacy policy — Hero Tales