Privacy Policy

This Privacy Policy describes how Black Pixel AI Inc. ("Company", "we", "us", or "our") collects, uses, stores, processes, and protects personal data of users ("you", "user") who access and use the website everstory-ai.com and related services (the "Services").

By accessing or using our Services, you confirm that you have read, understood, and agreed to this Privacy Policy. If you do not agree with this Privacy Policy, you must not use the Services.

This Privacy Policy is drafted in accordance with applicable laws, including but not limited to the U.S. Federal Trade Commission (FTC) regulations, the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (EU GDPR), and the Israeli Protection of Privacy Law, 1981.

1. Legal Basis for Processing

We process personal data strictly on one or more of the following legal grounds:

• your explicit consent;
• the necessity of processing for the performance of a contract (order creation, personalization, printing, and delivery);
• compliance with legal obligations;
• our legitimate business interests, including security, fraud prevention, service improvement, and analytics.

2. Personal Data We Collect

We collect personal data that you voluntarily provide to us when you use the Services, including your full name, email address, phone number, billing and shipping address, and any communications you send to us.

We also collect user-generated content that you upload for the purpose of creating personalized products, including photographs, audio recordings, voice messages, video files, text captions, and written stories.

In addition, we automatically collect technical and usage data, including IP address, device type, browser type, operating system, approximate location derived from IP, cookies, and interaction data with the website.

Payment information is processed exclusively by third-party payment processors such as Stripe. We do not store full payment card numbers or sensitive authentication data.

3. Purposes of Data Processing

We process personal data strictly for the purpose of providing our Services, including but not limited to: creating, editing, animating, printing, and delivering personalized products; storing content for repeat orders; providing customer support; preventing fraud and ensuring platform security; improving our services through analytics; sending service-related and marketing communications with the ability to opt out at any time; and complying with legal obligations.

4. Data Retention

Photographs, audio recordings, videos, and related content uploaded by users are stored only for as long as necessary for the purposes of repeat orders, customer order history, quality control, legal compliance, and dispute resolution.

Personal data is retained only for the minimum period required to fulfill the purposes described in this Privacy Policy or as required by applicable law.

You may request deletion of your personal data at any time by contacting us at official@everstory.pro.

5. International Data Transfers

Your personal data is stored and processed on secure servers operated by Amazon Web Services (AWS) located in the United States.

For the purpose of manufacturing and delivering your order, your name, phone number, and shipping address are transferred to Prodigi, our print-on-demand production partner, whose facilities are located in the United Kingdom, United States, and Australia, depending on your delivery region.

By using the Services, you expressly consent to the international transfer, storage, and processing of your personal data outside your country of residence, including transfers to the United States, United Kingdom, and Australia. Such transfers are conducted in compliance with applicable data protection laws and based on your explicit consent.

For users in the European Economic Area (EEA): international transfers of personal data are conducted on the basis of your explicit consent (Article 49(1)(a) GDPR) and, where applicable, Standard Contractual Clauses approved by the European Commission. We ensure that recipients of personal data provide an adequate level of protection in accordance with GDPR requirements.

For users in Singapore: transfers of personal data outside Singapore are conducted in accordance with the Personal Data Protection Act 2012 (PDPA) and only where the recipient country or organisation provides a comparable standard of protection, or where contractual protections are in place.

6. Third-Party Service Providers

We may share personal data with carefully selected third-party service providers strictly to the extent necessary to provide the Services. These include:

• Stripe — payment processing;
• Amazon Web Services (AWS) — cloud infrastructure and data storage;
• Prodigi (prodigi.com) — print-on-demand production and delivery partner. We transfer your full name, phone number, and shipping address to Prodigi solely for the purpose of manufacturing and delivering your physical order;
• shipping and logistics carriers engaged by Prodigi for delivery;
• augmented reality technology providers;
• analytics and advertising platforms (e.g. Google Analytics, Meta Pixel).

All third-party service providers are contractually required to protect personal data and process it only in accordance with our instructions and applicable law. We do not sell personal data.

7. Your Rights

You have the right to request access to your personal data, request correction of inaccurate data, request deletion of your data, withdraw your consent at any time, restrict certain types of processing, and receive a copy of your data in a portable format.

For users in the United States (CCPA): In addition to the rights described above, California residents have the right: (i) to know what personal information is collected, used, shared or sold; (ii) to delete personal information held by us; (iii) to opt-out of the sale or sharing of personal information; (iv) to non-discrimination for exercising any CCPA rights. We do not sell or share your personal information for cross-context behavioral advertising. To exercise your rights, contact us at official@everstory.pro. We will respond within 45 days, with a possible extension of an additional 45 days when reasonably necessary.

For users in Singapore (PDPA): You have the right to withdraw consent for the collection, use or disclosure of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal and will not affect the fulfilment of any existing order. We will respond to all data access and correction requests within 30 days. We comply with Singapore's Do Not Call (DNC) Registry provisions and will not send marketing messages to registered numbers without your prior consent.

For users in the European Economic Area (GDPR): In addition to the rights described above, you have the right to: (i) access your personal data and receive a copy; (ii) rectify inaccurate or incomplete data; (iii) request erasure of your data ("right to be forgotten"); (iv) restrict processing in certain circumstances; (v) data portability — receive your data in a structured, machine-readable format; (vi) object to processing based on legitimate interests; (vii) withdraw consent at any time without affecting the lawfulness of prior processing; (viii) lodge a complaint with a supervisory authority in your EU/EEA member state. Our legal bases for processing are: consent (Article 6(1)(a)), performance of a contract (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)). To exercise your rights, contact us at official@everstory.pro. We will respond within 30 days.

For users in Israel: You have the right to file a complaint with the Israeli Privacy Protection Authority (PPA) at gov.il if you believe your rights under the Protection of Privacy Law, 1981 have been violated.

You may also opt out of marketing communications at any time by using the "unsubscribe" link in emails or by contacting us directly at official@everstory.pro.

8. Cookies and Tracking Technologies

We use the following categories of cookies and tracking technologies:

• Strictly necessary cookies: required for the website to function correctly. These cannot be disabled.
• Analytics cookies: help us understand how users interact with the website, including pages visited, time spent, and approximate location derived from IP address (e.g. Google Analytics).
• Advertising cookies: used to measure ad campaign performance and deliver relevant advertising (e.g. Meta Pixel, Google Ads tag, TikTok Pixel).

You may manage cookie preferences through your browser settings or via the cookie consent banner displayed on your first visit. Disabling certain cookies may limit functionality of the Services.

For users in the EEA, Singapore, and Israel: advertising and analytics cookies are only activated after your explicit consent via the cookie banner, in accordance with GDPR, PDPA, and Israeli privacy law requirements.

9. Children's Privacy

The Services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that personal data of a minor has been collected without proper consent, such data will be deleted.

10. Data Security

We use commercially reasonable administrative, technical, and organizational security measures to protect personal data, including encryption, secure access controls, and protected infrastructure. However, no method of transmission or storage is completely secure, and absolute security cannot be guaranteed.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. Changes become effective upon publication on the website with an updated effective date. Continued use of the Services after publication constitutes acceptance of the updated Privacy Policy.

12. Contact Information

All privacy-related inquiries should be sent to: