Bindery

Privacy Policy

Last updated: 30 October 2026

Bindery is a service of My Tomo Space Ltd, a company registered in England and Wales (company number 17394661) with its registered office at 10 Whittle Road, London SE3 9GT. In this policy "Bindery", "we" and "us" mean My Tomo Space Ltd trading as Bindery. We are the data controller for the personal data described here.

Questions about this policy or your data: [email protected].

1. What this policy covers

This policy explains what personal data we collect when you use bindery.london, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to the website, the books you make with it, printed copies you order from us and the emails we send you.

2. The data we collect

Account data. Your email address, a hashed version of your password (we never store the password itself), the date you registered, your invitation code, your credit balance and the record of how credits were granted and spent. If you sign in with Google we also receive your Google account identifier and the email address and name Google provides; we do not receive your Google password. If you join with a friend's invite, or invite friends yourself, we keep a record of who invited whom and of the invite rewards on your account.

Your photographs and books. The photographs you upload, the way you sort them, the books you create (page layouts, titles, captions, generated pages) and the drafts you leave unfinished. If you upload photographs without an account, we delete them 48 hours after your last upload unless you sign in or create an account.

Face grouping (optional). If you turn on "Find people", we analyse faces in your photographs so that pictures of the same person can be grouped together. This involves processing biometric data and is done only with your explicit consent, which you give when you turn the feature on and can withdraw at any time. The face data is used only to group your own photographs, is stored with the batch it belongs to and is deleted with it. It is never used to identify people outside your photographs or shared with anyone.

Orders. When you order a printed book: your name, delivery address, the book files sent to print, the price paid and the status of the order. Card details are entered on Stripe's payment page and are never stored on our systems; we receive only a confirmation of payment and the last four digits of the card.

Communications. Emails you send us and our replies, and the emails we send you (verification codes, password resets, order updates).

Technical data. Our server keeps a short access log of the pages requested — the path, time and status, without your IP address, browser details or cookies — for 14 days, so we can keep the site running. We count page visits with a daily anonymised key and remember which link brought you here; we store no IP address and set no tracking cookie. We also record which country a visit or a sign-up comes from, as reported by our network provider, Cloudflare, but not your IP address. The site is delivered through Cloudflare, which handles your connection, including your IP address, as our service provider under its own privacy terms. We use only the cookies the site needs to work: one keeps you signed in, one protects our forms against misuse, one keeps photographs you upload before signing in linked to your browser until you sign in or they are deleted, and one remembers the code from a friend's invite link for 30 days so that your discount can be applied. Your browser also remembers, for the rest of the day, that you closed the invite note. We do not run advertising trackers.

3. Why we use your data and our legal basis

| Purpose | Data | Legal basis (UK GDPR) | |---|---|---| | Creating and running your account, signing you in, verifying your email | Account data, technical data | Performance of a contract | | Sorting your photographs, designing and generating your books | Photographs, books | Performance of a contract | | Grouping photographs by face | Face data | Your explicit consent | | Printing and delivering books you order; taking payment | Orders, books | Performance of a contract; legal obligation (accounting records) | | Running invite rewards | Account data, orders | Performance of a contract | | Sending verification codes, password resets and order emails | Email address | Performance of a contract | | Keeping the service secure, preventing fraud and abuse, enforcing credit rules | Technical data, account data | Legitimate interests (running a safe service) | | Answering your messages | Communications | Legitimate interests (helping you) | | Complying with the law | As required | Legal obligation |

We do not use your photographs or books to train artificial-intelligence models, and we do not sell personal data.

4. Artificial intelligence

Some books are designed and illustrated by AI. To do this we send your selected photographs (reduced in size), together with design instructions, to AI providers acting as our processors:

Both providers process your photographs only to return the result to us and, under the terms we have with them, do not use data sent through their business interfaces to train their models. Transfers to the United States are protected by safeguards recognised under UK law, including the UK Addendum to the EU Standard Contractual Clauses. AI output is produced from your photographs and may differ each time; see our Terms for how that works.

5. Who else receives your data

We use the following service providers, each bound by a contract that limits what they may do with your data:

We may also disclose data when the law requires it, to protect our rights or in connection with a sale or reorganisation of our business, in which case this policy will continue to apply.

6. How long we keep your data

When you delete your account, we delete your photographs, books and account data at once, except records we must keep by law.

7. Where your data is stored

Your photographs and books are stored on servers in the European Union. Some providers listed above process data in the United States; where they do, we rely on the safeguards described in section 4.

8. Your rights

Under UK data-protection law you can ask us to: give you a copy of your personal data; correct it; delete it; restrict or object to how we use it; and, where we rely on consent, withdraw that consent. You can also ask for the data you gave us in a portable form.

To exercise any of these rights, email [email protected]. We will respond within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

9. Children

Bindery is for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, tell us and we will delete it.

10. Security

Passwords are stored hashed, connections are encrypted, access to our servers is restricted and credentials are stored encrypted. No system is perfectly secure; if we discover a breach that puts your data at risk we will tell you and the regulator as the law requires.

11. Changes to this policy

We will post any changes here and update the date at the top. If a change materially affects how we use your data we will email you before it takes effect.

12. Contact

My Tomo Space Ltd (trading as Bindery), 10 Whittle Road, London SE3 9GT. Email: [email protected].