Privacy Policy
Last updated: September 30, 2026
Hynaka publishes audio stories for children aged 3 to 8. To sell them to you, and to make the personalised creations you order, we need some information about you and sometimes about your child. This page explains what we collect, what we do with it, who we entrust it to, how long we keep it, and how to exercise your rights.
1. Who is responsible for your data
The data controller is Sébastien LELEU, sole trader, who runs the site under the name Hynaka:
59 rue de Ponthieu, Bureau 326, 75008 Paris, France
SIRET 791 982 010 00039
Email: contact@hynaka.com
Hynaka has not appointed a data protection officer: for any question, write to the address above.
2. The data we collect
We only collect what we need, depending on what you do on the site:
- Creating an account: first name, last name, email address, password (stored in encrypted form, which we cannot read back), phone number if you give it, site language, dates of sign-up, email confirmation and last login.
- Placing an order: products bought, amount, order number, invoices (name, email, address if you give it). Payment takes place on Stripe's secure page: we never see or store your card number. We only keep the payment reference and, if a payment fails, the reason it was declined.
- Personalised song: the child's first name and its pronunciation, their age, and the details you choose to give (eye colour, hair colour…). The first name appears in the lyrics, in the product name on the payment page and on the invoice.
- Portrait from a photo: the photo you send and, for each person shown, the gender, age and, if there are several people, where each one is in the photo. We also keep the portraits produced from that photo.
- Newsletter: email address, sign-up date and the place on the site where you signed up, which serve as proof of your consent.
- Contact form: name, email, subject, order number if any, and message. It is not stored on the site: it reaches us by email.
- Browsing: IP address and technical information (browser, pages requested), processed by our host and our content delivery network to run and protect the site. Audience statistics are only collected if you accept them (see section 8).
- Games: your best scores stay in your browser. They are never sent to us.
3. Why we use it, and on what legal basis
| What we do | Legal basis (GDPR, Art. 6) |
|---|---|
| Manage your account, process your orders, make and deliver your personalised creations, write to you about an order | Performance of the contract you enter into with us |
| Issue and keep invoices | Our legal obligations (accounting) |
| Send you the newsletter | Your consent, which you can withdraw at any time |
| Tell you, as a customer, about new products similar to what you bought | Our legitimate interest, within the framework of Article L34-5 of the French Postal and Electronic Communications Code. You can object at any time, free of charge |
| Measure site traffic | Your consent, given through the cookie banner |
| Secure the site, prevent fraud and abuse (for example, limiting repeated attempts) | Our legitimate interest |
| Reply to your messages | Our legitimate interest in replying to you, or the contract if it concerns an order |
We never sell or rent your data.
4. Your children's data
The site is aimed at parents and at adults who give our stories as gifts. It is you, not the child, who creates the account and entrusts us with information about them.
- The child's first name, age and description are only used to make the creation you ordered.
- The photo sent for a portrait is only used to produce that portrait. It is never published, shown to other customers, used for advertising, or used by Hynaka to train an artificial intelligence model. It is accessible to Hynaka and to the service providers strictly necessary to produce the portrait, under the conditions described in section 6.
- It is deleted automatically 30 days after the portrait is delivered, along with the intermediate portraits you did not receive. Only the delivered portrait remains in your customer area.
- At fal.ai, the provider that produces the portrait, the photo is not kept after processing, and generated files are deleted after 24 hours.
- If the photo shows people other than your child, you must have their consent, or their parents' consent, before sending it to us.
5. How long we keep it
| Data | Retention period |
|---|---|
| Customer account | As long as your account exists. You can ask for it to be deleted at any time |
| Orders and invoices (including the child's first name shown on them) | 10 years from the end of the financial year, as required by the French Commercial Code (Art. L123-22) |
| Photo sent for a portrait, and intermediate portraits not selected | Deleted automatically 30 days after delivery, or 30 days after upload if the order was never paid |
| Delivered portrait, delivered song | In your customer area, as long as your account exists |
| Email confirmation link | 24 hours |
| Password reset link | 1 hour |
| Newsletter subscription | Until you unsubscribe |
| Customer list at Brevo | Until you object, and at most 3 years after your last purchase |
| Messages sent through the contact form | As long as needed to handle and follow up on your request, at most 3 years |
| Host's technical logs (IP address, pages requested, errors) | A few weeks at most, for security and troubleshooting |
| Host's backup copies (files and database) | About 7 days: deleted data, such as a purged photo, may remain there for that time before being overwritten |
| Cookies | See section 8 |
At the end of these periods, the data is deleted or made anonymous.
6. The service providers we entrust it to
We use service providers that process some data on our behalf, only for the service described, and under contract:
| Provider | What it does | Data involved | Where |
|---|---|---|---|
| Render (Render Services, Inc.) | Hosting of the site, database and files | All site data | Servers in Frankfurt (Germany); US company |
| Cloudflare, Inc. | Site delivery and protection against attacks | IP address, technical browsing information | Global network; US company |
| Stripe (Stripe Payments Europe, Ltd) | Online payment | Email, bank card (entered directly with Stripe), amount, product name (which may contain the child's first name) | Ireland; US group |
| Brevo (Sendinblue SAS) | Sending emails (email confirmation, orders, invoices) and customer list | Email, first name, last name, email content | France (European Union) |
| fal.ai (Features & Labels, Inc.) | Producing portraits from your photo. Data processing agreement (DPA) with the European Commission's standard contractual clauses | Photo sent, gender and age of the people. fal does not keep the request, photo included; generated files are deleted from its servers after 24 hours. fal reserves the right to use de-identified data to improve its services | United States |
| Google (Google Ireland Ltd) | Audience statistics (Google Analytics, via Google Tag Manager), loaded only if you accept them; YouTube videos, loaded only when you click on them | IP address, browsing information, cookie identifier | Ireland; US group |
| jsDelivr | Delivery of the site's display libraries (Bootstrap) | IP address, technical browsing information | Global network |
Personalised songs are not currently on sale. They are composed by Mureka (Skywork AI Pte. Ltd., Singapore, servers in the United States), which receives the lyrics, and therefore the child's first name; this also applies to songs ordered before 26 September 2026. Its terms state that this content is not used to improve its services, that generated files are kept for one month at most, and that content is deleted no later than 30 days after the end of the contract. This page will set out the safeguards covering this transfer before songs go back on sale.
7. Transfers outside the European Union
Some of our providers are based outside the European Union, or belong to groups that are. Their access to your data is then covered by the safeguards provided for by the GDPR: an adequacy decision of the European Commission (including the Data Privacy Framework for US companies that have joined it), or standard contractual clauses adopted by the European Commission. You can ask us for a copy of these safeguards at contact@hynaka.com.
8. Cookies
On your first visit, a banner asks for your consent. Until you accept statistics, Google's measurement tool is not loaded at all: no cookie is set and no data is sent to Google. You can change your mind at any time with the “Cookie settings” button at the bottom of the page; if you withdraw your consent, the measurement cookies are deleted.
| Cookie | What it is for | Duration |
|---|---|---|
| Session (PHPSESSID) | Makes the basket and login work. Essential | Until you close your browser |
| Form protection (csrf-token_…) | Prevents another site from submitting a form on your behalf. Essential | Until you close your browser |
| Stay logged in (REMEMBERME) | Keeps you logged in, only if you tick the box provided | 7 days |
| Cookie choice (cookie_consent, cookie_consent_date) | Remembers your preferences so we do not ask again on every page | 12 months |
| Language choice (hynaka_lang_suggestion_closed, stored in your browser) | Stops suggesting another language after "No thanks". Nothing is sent to us | Until you clear it |
| Google Analytics (_ga, _ga_*) | Measures traffic, only if you accept it | 13 months at most |
The YouTube videos on the Guardians' pages only load when you click on them: YouTube may then set its own cookies.
9. Your rights
You have the following rights over your data at any time:
- Access: find out what data we hold about you and get a copy;
- Rectification: correct inaccurate data;
- Erasure: have your data deleted, except what the law requires us to keep, such as invoices;
- Restriction: freeze the use of your data while a dispute is examined;
- Portability: receive the data you gave us in a machine-readable format;
- Objection: refuse messages about our new products, or any processing based on our legitimate interest;
- Withdrawal of consent: for the newsletter or cookies, at any time, without affecting what was done before;
- Instructions after your death: say what you would like to happen to your data.
To exercise them, write to contact@hynaka.com from your account's email address. We reply within one month. If we have reasonable doubts about your identity, we may ask you to confirm it. To leave the newsletter, the link in every mailing is enough.
10. Security
- The whole site uses an encrypted connection (HTTPS).
- Passwords are stored encrypted: nobody, not even us, can read them.
- Photos, portraits, ordered songs and invoices can never be reached through a simple web address: the site checks every time that you are the person concerned.
- Only Hynaka has access to the site's administration.
- Children's photos are deleted automatically at the end of the stated period.
If a data breach posed a risk to you, we would report it to the CNIL, the French data protection authority, and, where the law requires, to you directly.
11. Contact us, or complain to the CNIL
For any question about your data or this policy: contact@hynaka.com.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), the French data protection authority: www.cnil.fr/fr/plaintes. If you live in another EU country, you can also contact your own national authority.
12. Changes to this policy
We update this page when our practices change, for example when we add a service provider. The date at the top of the page shows the last change. If a change affects how we use data already collected, we will let you know by email.