Privacy Policy
Last updated: 8 October 2026
At Mi Libro De Mensajes we work with something very personal: your conversations. That is why we want to explain clearly what data we process, why, for how long and who we share it with. This policy complies with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).
1. Data controller
- Controller: Nathan Stephane Roze (sole trader), trading as Mi Libro De Mensajes
- Tax ID (NIF): Y6633116E
- Address: Calle Pedro Duque, Edificio 9B, Acceso Oeste, 46022 Valencia (Spain)
- Email: info@milibrodemensajes.com
2. What data we process
- Account and order data: first name, last name, email and shipping address.
- Content to create your book: the conversations you export and upload, with their texts, photos, emojis, voice notes and videos, plus the dedication and any texts you add.
- Guest book content (events): messages, photos, voice notes and videos uploaded by guests through the QR codes.
- Payment data: payments are handled by Stripe. We never see or store your full card details.
- Communications: the emails you send us and our replies.
- Browsing data: IP address, device and browser type, pages visited and cookies (see the Cookie Policy).
Conversations may contain data about other people (the other participants in the chat) and even sensitive information. You decide which conversation you upload and you can delete or edit messages before printing. See section 7.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating, laying out, printing and shipping your book or PDF, and managing your account and order | Performance of a contract (Art. 6.1.b GDPR) |
| Keeping your voice notes and videos so the QR codes work, and your digital version if you choose to | Performance of a contract (Art. 6.1.b GDPR) |
| Answering your questions and solving issues | Performance of a contract and our legitimate interest in helping you (Art. 6.1.b and 6.1.f GDPR) |
| Invoicing and tax and accounting obligations | Legal obligation (Art. 6.1.c GDPR) |
| Sending you news and offers by email | Your consent (Art. 6.1.a GDPR) or, if you are already a customer, our legitimate interest in telling you about products similar to the ones you bought (Art. 21.2 LSSI-CE). You can unsubscribe at any time using the link in every email. |
| Measuring the use of the website and the app and improving them (analytics) | Your consent through the cookie notice (Art. 6.1.a GDPR) |
| Measuring how well our ads work (Meta and Google) | Your consent through the cookie notice (Art. 6.1.a GDPR) |
| Service security and fraud prevention | Legitimate interest (Art. 6.1.f GDPR) |
We do not make automated decisions with legal effects on you and we do not build profiles from your conversations.
4. How long we keep it
- Conversations, photos and texts of the book: while the book is created and produced, and until 30 days after you receive it (or after the PDF is delivered), so we can solve any claim. After that they are deleted automatically.
- Voice notes and videos for the QR codes (printed book): 10 years from purchase, so you can scan them. You can ask us to delete them earlier.
- Event packs (guest books): the QR files are kept for the contracted period (10, 20 or 30 years depending on the pack), unless you ask us to delete them earlier.
- Digital version saved in your account: only if you choose to, and until you delete it or close your account.
- Account data: while your account is active.
- Order and invoice data: for the periods required by law (up to 6 years, Article 30 of the Spanish Commercial Code).
- Newsletter email: until you unsubscribe.
- Cookies: as indicated in the Cookie Policy.
5. Who we share it with
We never sell your data. We only share it with the providers we need to deliver the service, who act on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| OVH SAS (France) | Website hosting | European Union |
| Microsoft (Azure) | App hosting | Europe |
| Scaleway SAS (France) | Storage of your book’s content and files | European Union |
| Lulu Press, Inc. (USA) | Printing and shipping the book (receives the book file, your name and your shipping address) | United States and the printers and carriers it works with |
| Stripe | Payment processing | European Union, with possible transfers to the USA |
| Google (Google Analytics and Google tag) | Usage statistics for the website and the app, only if you accept cookies | European Union and USA |
| Microsoft (Clarity) | Understanding how the website and the app are used, only if you accept cookies. In the app it records browsing sessions with the content of your conversations and photos hidden. | European Union and USA |
| Meta Platforms Ireland Ltd. (Meta pixel) | Measuring how well our ads on Facebook and Instagram work, only if you accept cookies | European Union and USA |
| Brevo (Sendinblue SAS, France) | Sending news and offers by email | European Union |
We may also disclose data to public authorities (for example tax authorities or courts) when the law requires it.
6. Transfers outside the European Union
Some providers are located in the United States or may access data from there. In those cases the transfer is made with the safeguards required by the GDPR: the EU-U.S. Data Privacy Framework when the provider is certified, or the standard contractual clauses approved by the European Commission (as in the case of Lulu). You can ask us for more information at info@milibrodemensajes.com.
7. Other people’s data and minors
- By uploading a conversation you confirm that you are entitled to use it to make a private book and that the other people in the chat do not object. We recommend telling them, especially if the book is a gift for someone else.
- For guest books, the customer who buys the pack must inform guests that what they upload through the QR code will be used to create the book. If minors appear, the customer must have the permission of their parents or guardians.
- You must be of legal age to create an account and buy. Children under 14 may not give us their data without the consent of their parents or guardians.
8. How we protect your data
- Encrypted connection (HTTPS) on the website and in the app.
- Content stored encrypted on servers in the European Union.
- Automated process: nobody on our team reads your conversations. We would only access your order if you ask us to, to solve an issue.
- Automatic deletion of content within the periods in section 4.
9. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, at any time by writing to info@milibrodemensajes.com. If we have doubts about your identity, we may ask you for additional information to confirm it. You can also delete your data directly from your dashboard in the app.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country.
10. Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If the change is important, we will notify you by email.
