Privacy Policy

Coconut Story is a brand operated by Wander & Wonder OÜ, a company registered in Estonia.

Coconut Story creates personalised illustrated storybooks for children, inspired by real cultures, destinations, and magical adventures around the world.

For the purposes of applicable data protection law, Wander & Wonder OÜ is the data controller responsible for the processing of personal data described in this Privacy Policy.

Legal entity: Wander & Wonder OÜ
Registry code: 17571149
Registered address: J. Kunderi 26, Tallinn 10121, Estonia
Country of registration: Estonia
Contact: hello@coconutstory.co

Depending on how you use Coconut Story, we may collect:

• your name and email address;
• shipping and billing information;
• photographs you upload;
• your child's name and other personalisation details you provide;
• order and purchase information;
• communications with our customer support;
• technical information such as browser type, device information, IP address, and website usage data.

We aim to collect only the information reasonably necessary to provide, operate, protect, and improve our services.

Uploaded photographs are processed for the purpose of creating your personalised Coconut Story book.

We understand that these photographs will often depict children and treat this information with particular care.

By uploading a child's photograph or personal information, you confirm that you are the child's parent or legal guardian, or otherwise have appropriate authority to provide that information for the creation of the personalised product.

Uploaded photographs are not used for advertising, social media, promotional materials, or other marketing purposes without your explicit consent.

Uploaded photographs are not stored on our servers: they are sent once to our AI image provider to create the personalised illustrations. The provider may keep them for a short period under its own policies. Personalised illustrations and print files are deleted automatically 60 days after the order is shipped, subject to any limited retention that may be legally necessary.

We may process personal data to:

• create and personalise your Coconut Story book;
• process and manage your order;
• produce and deliver physical books;
• provide digital products;
• process payments;
• provide customer support;
• communicate with you about your order;
• maintain the security and functionality of our website;
• improve our products and website experience;
• comply with legal, accounting, and regulatory obligations.

We do not sell your personal data.

Where the General Data Protection Regulation (GDPR) applies, we process personal data only where we have an appropriate legal basis.

Depending on the circumstances, this may include:

• Performance of a contract — where processing is necessary to create, personalise, process, and deliver your order.
• Legal obligations — where we are required to retain or process certain information under applicable law, including accounting and tax requirements.
• Legitimate interests — where reasonably necessary to operate, secure, and improve Coconut Story, provided those interests do not override your fundamental rights and freedoms.
• Consent — where we specifically ask for your permission, such as for certain marketing or promotional uses.

Where processing is based on consent, you may withdraw that consent at any time.

Coconut Story uses artificial intelligence and other digital technologies to transform uploaded photographs into personalised illustrated characters and scenes.

This means that photographs and related personalisation information may need to be securely processed by technology service providers acting on our behalf.

We aim to share only the information necessary to provide the relevant service and to work with service providers that provide appropriate privacy and security safeguards.

Uploaded photographs are not provided to third parties for their independent advertising or marketing purposes.

We will not use customer photographs, personalised illustrations, or personalised books in advertising, social media, promotional materials, or other public marketing without explicit permission.

If we ask for permission to feature your Coconut Story creation, participation will always be optional.

You may withdraw previously given consent for future marketing use by contacting us at hello@coconutstory.co.

Payments are securely processed by Stripe. When you make a purchase, Stripe may collect and process information such as your name, billing details, payment information, transaction details, and other information necessary to process your payment, prevent fraud, and comply with legal obligations.

Coconut Story does not store your full payment card details on its own systems.

Stripe processes personal data in accordance with its own privacy practices. You can learn more in the Stripe Privacy Policy

To produce and deliver physical books, we may share necessary information with printing, fulfilment, and shipping providers.

Depending on the service, this may include your name, delivery address, order information, and the personalised book file required for printing.

We aim to share only the information necessary for production and delivery.

Our website may use cookies and similar technologies to operate the website, remember preferences, understand how visitors use Coconut Story, and improve the customer experience.

Depending on the technologies we use, certain cookies or analytics tools may require your consent before being activated.

Where required by law, you will be given an opportunity to manage your cookie preferences.

More detailed information may be provided in a separate Cookie Policy or cookie preference tool.

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

Because no method of electronic transmission or storage can be guaranteed to be completely secure, we cannot guarantee absolute security.

We retain personal data only for as long as necessary for the purposes for which it was collected or where retention is required by law.

Order, transaction, and accounting information may need to be retained for longer periods to comply with legal and financial obligations.

Uploaded photographs are never stored on our servers; our AI image provider may keep them briefly under its own policies. Personalised illustrations and print files are kept for 60 days after shipping, to allow reprints of damaged or lost books, and are then deleted automatically, subject to limited legal retention requirements.

Where the GDPR applies, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal data in certain circumstances;
• request restriction of certain processing;
• object to certain processing;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a competent data protection authority.

These rights may be subject to limitations or exceptions under applicable law.

To exercise your rights, contact hello@coconutstory.co.

We may need to verify your identity before fulfilling certain requests.

Coconut Story products and purchasing services are intended for adults.

We do not knowingly offer our purchasing services directly to children or ask children to submit their own personal information.

Where a customer provides a child's photograph, name, or other personalisation information, the customer confirms that they are the child's parent or legal guardian, or otherwise have appropriate authority to provide that information.

If you believe that a child's personal information has been provided to us without appropriate authority, please contact hello@coconutstory.co.

Some of our technology, hosting, payment, printing, fulfilment, or other service providers may process personal data outside Estonia or the European Economic Area.

Where personal data is transferred outside the EEA, we take appropriate steps where required by applicable law to ensure that suitable safeguards are in place.

These safeguards may include adequacy decisions recognised by the European Commission or approved contractual protections such as Standard Contractual Clauses.

We may use trusted third-party providers to operate Coconut Story, including providers of:

• website hosting and infrastructure;
• AI and image-processing technology;
• payment processing;
• printing and book production;
• shipping and fulfilment;
• customer communications;
• analytics and website functionality.

These providers may process personal data only to the extent necessary for the services they provide or as otherwise permitted by applicable law.

We may update this Privacy Policy from time to time to reflect changes to Coconut Story, our technology, our service providers, or applicable legal requirements.

The latest version will be published on our website together with the revised "Last updated" date.

For questions about this Privacy Policy, how we process personal data, or to exercise your privacy rights, please contact:

Wander & Wonder OÜ
Coconut Story
Registry code: 17571149
J. Kunderi 26
Tallinn 10121
Estonia
Email: hello@coconutstory.co