Privacy Notice

Last updated: 2026-05-06

This Privacy Notice explains what personal data Lilybee collects, why we collect it, how long we keep it, and what rights you have. We have written it in plain language because we believe you deserve to understand exactly what happens to your data — and your child's data.

If you have questions not answered here, email support@lilybee.app. We will respond within 2 business days.

Who we are

Lilybee is operated as a solo project from Berlin, Germany. The operator is the data controller for the personal data described in this notice. You can reach us at support@lilybee.app.

For our full legal information (operator name, address, tax details required under § 5 TMG), please see the Imprint.

What data we collect

When you place an order with Lilybee, we collect the following:

Your email address, used to deliver your order and send transactional messages.
Your order details — what you ordered, when, and the delivery status.
A photo of your child's drawing, and optionally a short voice clip if you choose to provide one.
Payment metadata from Stripe (a reference ID and payment status). We never see or store your card number.
Basic technical data sent automatically by your browser: IP address, user-agent, server logs.
Anti-bot signals to prevent automated abuse of our service.
Analytics data (only if you consent): page views and click events, via Google Analytics.
Error reports sent to our error-monitoring service when something breaks. These do not include your uploaded drawing, voice clip, or email address.

We do not collect your name, phone number, or postal address. We do not run advertising profiles. We do not sell or rent your data to anyone.

Why we collect this data

Fulfilling your order — your drawing and voice are needed to create the animation; your email is needed to deliver it.
Transactional email — order confirmation, delivery notification, refunds.
Security and abuse prevention — IP addresses and bot-prevention signals help us block misuse.
Service improvement (with consent) — analytics tell us where the order flow gets stuck.
Error monitoring — so we can fix bugs quickly.
Accounting and legal compliance — order metadata is retained for the period required by EU and German tax rules.

Children's data

This section is especially important. Please read it.

Lilybee processes drawings and voice recordings of children. We take this responsibility seriously.

You are responsible for having the authority to upload. By uploading a drawing or voice clip, you confirm that you are the parent or legal guardian of the child involved (or have written consent from one). We rely on your representation; we cannot independently verify the identity of the child.
We do not directly collect data from children. Children do not create accounts, submit forms, or interact with the Lilybee website. All data is submitted by an adult on the child's behalf.
We do not market to children and we do not build profiles of children. The drawing and (optional) voice clip are used solely to render your specific order.
We do not train AI models on your child's drawing or voice.
We do not share children's data with anyone other than the service providers listed below.
Refunds revoke access — when you refund, the link in your delivery email stops working, scanning the drawing in the app no longer plays the animation, and we delete the underlying files from our storage.

If you believe a child's data has been submitted without proper authority, email support@lilybee.app immediately and we will investigate and delete the data as appropriate.

Who has access to your data

We rely on a small number of service providers to run Lilybee. None of them sell or use your data for their own marketing.

Google (Firebase / Cloud Storage / Cloud Functions / App Hosting) — stores your files and order data, and runs our website and backend. Hosted in the European Union.
Stripe — processes your payment. Their privacy policy: stripe.com/privacy.
Resend — sends our transactional emails.
An AI rendering service — receives your drawing and (optional) voice clip to generate the animation, and only for that purpose.
An error-monitoring service — receives technical error reports (no drawing, voice, or email).
Google Analytics — only if you accept analytics cookies.
Law enforcement or regulators — only when legally required.

Where a service provider is based outside the EU/EEA, the transfer is governed by the European Commission's Standard Contractual Clauses.

Retention

We keep your data for only as long as necessary:

Data	How long we keep it
Uploaded drawing and (optional) voice clip	Kept while your order is active, so you can rewatch and re-scan from any device. Deleted on refund or on your request.
Animated video	Same as above.
Email address and order metadata	7 years (EU/German accounting requirements).
Server request logs	Up to 30 days.
Refunded orders	Files and rendered video deleted automatically when the refund is processed.

We deliberately do not auto-delete your drawing or video on a fixed timer, because doing so would break the service if you reinstall the app, switch phones, or want to scan the drawing on a new device. If you want your content removed, email support@lilybee.app — we will remove it within 30 days.

Cookies and similar technologies

Essential cookies and storage — a small record of your cookie banner choice and short-lived bot-prevention tokens. These don't identify you.
Analytics cookies (only with your consent) — Google Analytics. We load these only after you click Accept on the cookie banner. You can withdraw consent at any time.
Stripe sets its own cookies on the checkout page to detect fraud. These are necessary to process payments.

We do not use advertising cookies, tracking pixels, or any other marketing cookies.

If you are based in the European Union, the European Economic Area, or the United Kingdom, you have the following rights regarding your personal data:

Right of access — ask us for a copy of the data we hold about you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure — ask us to delete your data. We will comply unless we are legally required to keep it (e.g., accounting records).
Right to data portability — ask us to provide your data in a machine-readable format.
Right to object — object to processing based on our legitimate interests.
Right to restrict processing — ask us to pause processing in certain circumstances.
Right to withdraw consent — for analytics cookies, you can withdraw consent at any time.

To exercise any of these rights, email support@lilybee.app. We aim to respond within 30 days. Please include your order email address so we can locate your data.

You also have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for Lilybee is the Berliner Beauftragte für Datenschutz und Informationsfreiheit:

Website: datenschutz-berlin.de
Email: mailbox@datenschutz-berlin.de

You may also contact the data protection authority in your country of residence.

Legal basis for processing

Processing activity	Legal basis
Fulfilling your order (rendering + delivery)	Performance of a contract — Art. 6(1)(b) GDPR
Transactional email	Performance of a contract — Art. 6(1)(b) GDPR
Accounting records	Legal obligation — Art. 6(1)(c) GDPR
Security and abuse prevention	Legitimate interests — Art. 6(1)(f) GDPR
Error monitoring	Legitimate interests — Art. 6(1)(f) GDPR
Analytics cookies	Consent — Art. 6(1)(a) GDPR

Changes to this notice

We may update this Privacy Notice as the service evolves. When we do, we update the "Last updated" date at the top. Significant changes will be communicated by email to the address on your most recent order.

Contact

For any privacy-related questions or to exercise your rights, email support@lilybee.app.

We aim to respond within 2 business days for general questions, and within 30 days for formal rights requests.