Privacy Policy
Hej Nyfiken
hejnyfiken.com | hejnyfiken.se
Last updated: March 3rd, 2026
1. Introduction
This Privacy Policy explains how Hej Nyfiken (“we”, “us”, or “our”) collects, uses, stores, and protects your personal data when you use our website and services at hejnyfiken.com and hejnyfiken.se (the “Service”).
Hej Nyfiken is a web application that allows parents and guardians to generate AI-created illustrated books on topics of their child’s interest. The Service is designed for use by adults (parents and guardians) and is not intended to be operated directly by children.
We are based in Sweden and process personal data in accordance with the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
2. Data Controller
The data controller responsible for your personal data is:
Hej Nyfiken
Email: hejnyfiken@gmail.com
If you have any questions about this Privacy Policy or our data practices, please contact us at the email address above.
3. What Data We Collect
3.1 Account Information
When you create an account, we collect your name and email address (provided directly or via Google OAuth sign-in), and your chosen username and password if you register with email and password.
3.2 Content You Provide
When you use the Service, we collect the topics and questions you submit for book generation, and the AI-generated book content (text and images) if you choose to save a book to your account.
Important note: The Service is designed to generate books on general topics and does not encourage or require you to provide personal information about your child (such as their name, age, or interests). However, if you voluntarily include such information in a topic request, it will be processed as part of the book generation and may be stored as described in this policy.
3.3 Usage Data
We automatically collect certain technical and usage information, including your IP address, browser type and version, device information, pages visited and interactions with the Service, the number of books generated, and session and authentication data (cookies).
3.4 Payment Data
The Service is currently free. If we introduce paid features in the future, payments will be processed by Stripe, Inc. We do not receive or store your full credit card number or bank details. Stripe may share limited transaction information with us (such as the last four digits of your card and transaction status). Please refer to Stripe’s privacy policy for details on their data handling.
4. How We Use Your Data
We use your personal data for the following purposes:
To provide the Service: Processing your account registration, generating books based on your requests, and enabling you to access saved books.
To improve the Service: Analysing usage patterns, reviewing generated content quality, and developing new features. This includes reviewing stored topics and book content for quality assurance purposes.
To ensure security: Detecting and preventing fraud, abuse, or other harmful activity.
To communicate with you: Responding to your enquiries and sending essential service-related notifications (such as changes to this policy).
5. Legal Bases for Processing
Under the GDPR, we rely on the following legal bases for processing your personal data:
Contract performance (Article 6(1)(b)): Processing necessary to provide the Service to you, including account management and book generation.
Legitimate interests (Article 6(1)(f)): Processing for service improvement, quality review, usage analytics, and security. Our legitimate interest is to improve and maintain the quality and safety of the Service. We have assessed that this processing does not override your rights and freedoms.
Consent (Article 6(1)(a)): Where we use non-essential cookies or analytics tools, we will request your consent before placing such cookies. You may withdraw your consent at any time.
6. Cookies and Similar Technologies
We use cookies to operate and improve the Service. These include:
Essential cookies: Required for authentication and session management. These are necessary for the Service to function and do not require your consent.
Analytics cookies: Used to understand how visitors interact with the Service. These cookies are only placed with your explicit consent, which you can provide or withdraw via our cookie consent banner.
You can manage or delete cookies through your browser settings at any time. Disabling essential cookies may prevent parts of the Service from functioning correctly.
7. Third-Party Service Providers
We share personal data with the following categories of third-party service providers who process data on our behalf:
AI providers: Anthropic (Claude) and Google (Gemini) receive the topics and questions you submit in order to generate book text and images. These providers process data via their APIs and, under their current API terms, do not use API inputs for model training. Both are US-based companies.
Hosting: Vercel, Inc. hosts the Service. Vercel is a US-based company.
Authentication: If you sign in with Google, Google receives authentication data in accordance with their privacy policy.
Analytics: We may use Google Analytics or a similar service to collect anonymised usage statistics, subject to your cookie consent.
Payments (future): Stripe, Inc. will process payment transactions if paid features are introduced. Stripe is a US-based company.
All third-party providers are contractually bound to process data only in accordance with our instructions and applicable data protection law.
8. International Data Transfers
Several of our service providers are based in the United States. When your personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission, as applicable. You may request a copy of the relevant safeguards by contacting us.
9. Data Retention
Account data: Retained for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it.
Generated content: Saved books and associated topic queries are retained for as long as your account is active, or until you delete them. Unsaved book content may be retained for up to 90 days for quality review purposes, after which it is deleted.
Usage and analytics data: Aggregated and anonymised usage statistics may be retained indefinitely. Identifiable usage logs are deleted within 12 months.
10. Your Rights Under the GDPR
You have the following rights regarding your personal data:
Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may request that we correct inaccurate or incomplete data.
Right to erasure: You may request that we delete your personal data, subject to legal retention obligations.
Right to restriction: You may request that we restrict the processing of your data in certain circumstances.
Right to data portability: You may request to receive your data in a structured, commonly used format.
Right to object: You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent: Where processing is based on consent (e.g., analytics cookies), you may withdraw your consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at hejnyfiken@gmail.com. We will respond within one month of receiving your request, as required by the GDPR.
If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
11. Children’s Privacy
The Service is designed to be used by parents and guardians, not by children directly. We do not knowingly collect personal data from children under the age of 16 (the age of digital consent in Sweden).
If we become aware that we have inadvertently collected personal data from a child without appropriate parental consent, we will take steps to delete that data promptly.
If you believe that a child has provided us with personal data, please contact us at hejnyfiken@gmail.com so we can take appropriate action.
12. AI-Generated Content
Books generated through the Service are created using artificial intelligence. The topics and questions you submit are sent to third-party AI providers (as described in Section 7) to generate content. Please be mindful of the information you include in your requests, as it will be transmitted to these providers.
We do not use your submitted topics or generated content to train our own AI models. For information on how our AI providers handle data, please refer to their respective privacy policies.
13. Security Measures
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted data transmission (HTTPS), secure authentication practices, and access controls on stored data.
However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Service and updating the “Last updated” date at the top of this page. For significant changes, we may also notify you by email.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.
15. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us at:
Hej Nyfiken
Email: hejnyfiken@gmail.com
This Privacy Policy is provided in English. A Swedish-language version is also available. In the event of any inconsistency, the English version shall prevail.