Privacy Policy

Last updated: May 2026

1. Introduction

Little Legends ("we", "our", "us") is committed to protecting your privacy and that of your children. This privacy policy explains how we collect, use, store and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable laws.

MXML S.à r.l. (Luxembourg) and Scancafe Inc (United States) are affiliated entities operating Little Legends jointly. MXML S.à r.l. is the registered entity for SMS messaging services.

2. Data Controller

The data controller for personal data is:

3. Data We Collect

We collect the following data:

• Identity data: name, email address
• Child data: first name, age, appearance, interests (for book personalisation)
• Photos: photos of your child that you choose to upload for inclusion in the book
• Delivery data: postal address for shipping the printed book
• Payment data: transaction information (processed by our secure payment providers)
• Technical data: IP address, browser type, browsing data (via cookies and analytics)

4. Purposes of Processing

We use your data to:

• Create and personalise your child's book
• Process and fulfil your order
• Contact you about your order
• Improve our services and website
• Comply with legal obligations
• Send you email marketing communications, only if you opt in via a separate dedicated checkbox. SMS is never used for marketing.

5. Legal Basis

Processing is based on:

• Contract performance: for creating and delivering your personalised book
• Consent: for optional email marketing communications (separate checkbox) and use of photos. SMS consent is collected separately.
• Legitimate interest: for improving our services and security
• Legal obligation: for retaining transaction data

6. Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected:

• Order data: 3 months after the last transaction
• Photos and personalisation data: 3 months after the last order
• Contact data: 3 months after last contact

After this 3‑month period, your data is automatically deleted from our systems.

7. Sharing Data

We may share your data with:

• Service providers: hosting, payment, shipping
• Analytics: to analyse use of our site (e.g. Amplitude)
• Legal authorities: when required by law

We never sell your personal data to third parties for commercial purposes.

8. SMS Terms

Our SMS program is strictly transactional and used solely to notify customers when their personalized book preview is ready. We never send marketing or promotional content by SMS, even with consent. Email marketing (if you opt in separately) is a separate program and is never sent via SMS.

If you opt in, we use your phone number to send SMS notifications when your personalized book preview is ready or has been updated.

We do not send marketing, promotional, shipping, or other non-preview SMS messages.

Message frequency: typically 1–2 messages per order. Message and data rates may apply.

You can opt out at any time by replying STOP. For help, reply HELP.

We do not share or sell mobile information or phone numbers with third parties or affiliates for marketing purposes.

9. Your Rights

Under the GDPR you have the right to:

• Access: obtain a copy of your personal data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data
• Restriction: restrict processing
• Portability: receive your data in a structured format
• Object: object to processing
• Withdraw consent: at any time

To exercise these rights, contact us at contact@little-legends.co

10. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration. No method of transmission over the Internet is completely secure.

11. Cookies

Our site uses cookies and similar technologies to improve your experience and analyse site use. You can manage cookie preferences in your browser settings.

12. International Transfers

Your data may be transferred and stored in the United States. We ensure appropriate safeguards are in place to protect your data in accordance with the GDPR.

13. Changes

We may update this privacy policy at any time. Changes will be posted on this page with an updated "Last updated" date.

14. Contact

For any questions about this privacy policy or to exercise your rights:

← Back to home