Museme ("we", "us") operates the website at museme.ai. The service is operated by CEDARLIGHT LABS LLC, a Wyoming limited liability company in the United States, which is responsible for your personal data as described here. This document explains what data we collect, why we need it, and what choices you have. It applies whenever you visit our site, place an order, or interact with us through any channel.
Effective date: 6 November 2026 (see "Policy Updates" at the end for what changed)
The rules for ordering, refunds, gift cards and use of the service are in our Terms of Service.
When you use Museme to create a personalized art book, you voluntarily share:
- Your child's name and age — used to personalize the book and your ordering experience.
- Photographs — the images you upload, from which our system generates the artistic portrait pages.
- Email address — so we can send order confirmations, delivery updates, and reply to your questions.
- Delivery details — your name, postal address and phone number, collected at checkout to fulfil your order.
- Browser and device data — browser type, screen resolution, operating system, device model.
- Access logs — pages viewed, timestamps, referring URLs and IP address. When you register an account, we store the IP address used at registration alongside the account.
- Performance metrics — page load times and error reports, which help us keep the service stable.
- Essential cookies — keep the site working: staying signed in, remembering your language, securing checkout. The site cannot function without them, so we don't ask separately.
- Analytics cookies (Google Analytics) — how this works depends on where you are:
- European Economic Area, United Kingdom and Switzerland: off by default. We ask at the bottom of the page on your first visit, and Google Analytics is only enabled after you choose "Accept analytics". If you choose "Essential only", Google Analytics stores no cookies on your device.
- Everywhere else (including the United States): on by default, to count visits. You can turn it off at any time with "Cookie settings" at the bottom of every page and choosing "Essential only".
- Google decides which group you are in from your IP address. Your choice is stored in your browser; if you clear your browser data, the default for your region applies again. We do not use advertising cookies anywhere.
- Product analytics and session replay (PostHog) — we use PostHog to understand how visitors move through the site: which pages they open, which buttons they click, and where an order form gets abandoned. Where it is enabled, PostHog may also record a replay of the session (mouse movement, scrolling, clicks) so we can find confusing parts of the page.
- What it never sees: everything typed into a form field is masked in replays; photo upload areas, your child's photos and book pages, and names shown on screen are blocked or masked. Replays are switched off entirely on order pages, the book preview (studio), the gift card redemption, card and thank-you pages, sign-in pages and all account pages.
- What events contain: page addresses with personal parts removed, the language and country you chose, and plain facts such as how many books are in the cart. Order events carry a one-way code instead of your order number, and never include your email, your name or your child's name.
- European Economic Area, United Kingdom and Switzerland: PostHog does not load until you answer the banner (we use your browser's time zone to decide whether to ask). If you accept analytics it works as described above. If you choose "Essential only", PostHog stores nothing on your device, records no replays and only counts visits anonymously.
- Everywhere else: on by default, like Google Analytics. Choosing "Essential only" in "Cookie settings" switches it to the same anonymous, cookie-free counting.
- PostHog stores this data in the United States (PostHog US Cloud).
- Creating your art book — your photographs are processed by AI models to generate the artistic portrait pages.
- Fulfilling your order — printing, packing and shipping the book to the address you gave us.
- Payment processing — charging your order securely through our payment provider.
- Customer communication — order status updates and replies to your questions.
- Improving the service — where analytics cookies are allowed, analyzing aggregated usage patterns.
We do not use your photographs for marketing, advertising, or anything unrelated to producing your book, and we do not use them to train our own models.
Your child's photograph is the heart of this service. Here is where it actually goes — please read this before uploading:
- Photos are transmitted over an encrypted connection (TLS) and stored in Cloudflare R2 object storage.
- Photos are sent to third-party AI services for processing. This is a necessary step in generating the pages. The services involved are listed in the next section.
- Images are served from unguessable links. We do not publish these links, but the link itself is the access credential — anyone who has the full link can view that image without signing in. Please don't forward these links to people you don't want seeing the photo.
- Retention: the original photos you upload are deleted automatically 90 days after your order is delivered, shipped, or canceled. This runs as a daily job and does not depend on anyone remembering to do it. Once deleted, that photo can no longer be used to reprint or modify the book.
- Finished book pages are not covered by that deletion — they are the work you bought, and we keep them so you can sign in and view your book whenever you like. If you want the book pages deleted too, write to us.
- You can ask us to delete your photographs sooner at any time.
To paint a child who is recognizably your child, we have to analyze their face. Some laws — for example the Illinois Biometric Information Privacy Act — treat information derived from a face as biometric information, so here is exactly what happens. Before any photo is uploaded, we ask you to confirm with a checkbox that you are the child's parent or guardian (or have their permission) and that you agree to this analysis. We record which version of that wording you agreed to and when.
- What we derive. A written description of the child's visible features — such as face shape, hairstyle, skin tone and eye color — produced from the photo by the image-processing providers listed below. Some image-generation models also compute a numerical representation of the face internally while they paint a page. We do not keep those numerical representations, and we never use a photo or anything derived from it to recognize or identify who a child is.
- Why. Solely to make the book you ordered: so the child in every painting looks like your child. Nothing derived from the photo is used for advertising, sold, rented, traded or used to train models for any other purpose.
- Who sees it. Only the providers in the Third-Party Services table marked "Your child's photo", and the Museme staff who produce and check your book.
- How long we keep it. The original photo is deleted 90 days after the order is delivered, shipped or canceled (see above). The written feature description is stored with the finished book pages, because it is part of how those pages were made, and is deleted when the book pages are deleted — at any time on request. Each provider handles the photo under its own terms, as described below.
- Saying no or changing your mind. If you don't agree, please don't upload a photo — we can't make the book without this analysis. You can ask us at any time to delete the photo, the feature description and the book pages.
To deliver the product we work with the following providers. Apart from analytics, all are necessary to provide the service:
| Provider | Purpose | What it sees |
|---|
| Cloudflare | Hosting, database, image storage | All data |
| fal.ai | AI image generation | Your child's photo |
| Segmind | AI face swap (fallback path) | Your child's photo |
| Google (Gemini API) | AI image generation | Your child's photo |
| Google (sign-in) | If you choose to sign in with Google | Your email and avatar |
| Google Analytics | Visit statistics | Browsing behavior (in the EEA, UK and Switzerland only after you consent) |
| PostHog (US) | Product analytics and session replay | Browsing behavior and masked session replays (in the EEA, UK and Switzerland only after you consent) |
| Stripe | Payment processing | Your payment details |
| Resend | Sending email | Your email address |
| Printing and shipping partners | Production and delivery | Final artwork and delivery address |
On payments: we never store your full card number on our own servers; card details go directly to a PCI-compliant payment partner.
On AI providers: your photograph is subject to each provider's own terms and privacy policy, and we cannot promise or guarantee on their behalf how long they retain it. We can only commit to what happens on our side, which is what this policy describes. If you would rather your photo were not sent to a third party for processing, please don't use this service — we currently have no way to produce a book entirely in-house.
We do not sell, rent or trade your personal information for any third party's own marketing purposes.
Your data may be stored or processed outside your country of residence; the providers above are spread across several jurisdictions. Where such transfers occur, we ensure appropriate safeguards are in place — including contractual commitments with providers — to protect your information in line with applicable data protection law.
- Account and order data — kept while you have an active relationship with us, plus any period required by tax, accounting or legal obligations.
- Original photographs you upload — deleted automatically 90 days after delivery, shipping or cancellation; sooner on request.
- Finished book pages — kept long-term so you can sign in and view your book. Deleted on request.
- Access logs and analytics — handled by Cloudflare, Google Analytics and PostHog under their own retention policies; we do not keep additional long-term server access logs of our own.
Depending on your jurisdiction, you may have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectify — ask us to update inaccurate or incomplete data.
- Erase — ask us to delete your personal data (subject to any legal retention obligations).
- Restrict processing — ask us to limit how we use your data in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Object — opt out of certain kinds of processing.
All of these are currently exercised by email — the site does not yet have self-service export or account deletion. Write to the address at the end of this page and we will respond within 30 days.
It matters that this is stated plainly: the core function of this service is processing children's personal data — a child's name, age and photograph.
That data does not come to us from the child. It is provided by the adult placing the order (a parent, grandparent or other gift-giver). By using this service you confirm that you are the child's parent or guardian, or that you have their permission to upload this photograph and place this order.
We do not market to children, and we do not offer child-facing account registration on the site.
If you believe someone has uploaded a photograph of your child without proper authority, contact us immediately — we will delete the data and tell you what we did.
We use industry-standard practices to protect your data, including encrypted transmission, secure cloud storage and access controls. No system is perfectly secure, however, and we cannot guarantee absolute protection. Please also see the note above about image links.
For a gift card we keep the buyer's email, the recipient's name and email, the optional message and the delivery date, so that we can deliver the gift and answer questions about it. The code itself is stored only in hashed and encrypted form. The rules for buying, redeeming and refunding gift cards are in our Terms of Service.
We may revise this policy as our practices evolve or the law changes. Material changes will be announced on our website. The "Effective date" at the top of this page always reflects the most recent version.
Note on the 6 November 2026 revision. The privacy policy and the terms of service are now two separate pages; this page is the privacy policy and the Terms of Service have their own page. We now state that CEDARLIGHT LABS LLC, a Wyoming company, operates the service and is responsible for your data, and added a postal address for contact. The rules for gift cards moved to the Terms of Service; how we handle gift card data stays here. Nothing about what we collect or how we use it changed.
Note on the 5 November 2026 revision. We added "Facial Features in Your Photo", which explains what is derived from your child's face, why, who sees it and how long it is kept. Before a photo is uploaded we now ask you to confirm with a checkbox that you are the child's parent or guardian (or have their permission) and agree to this analysis, and we record that consent.
Note on the 31 October 2026 revision. We added PostHog for product analytics and session replay. It follows the same consent choice as Google Analytics, never records order pages, the book preview or account pages, and masks form fields, photos and names in replays.
Note on the 29 October 2026 revision. Google Analytics now asks for consent first only in the European Economic Area, the United Kingdom and Switzerland. Elsewhere it is on by default and can be turned off with "Cookie settings" at the bottom of every page.
Note on the 13 October 2026 revision. We checked this policy line by line against what the system actually does, and corrected the following discrepancies:
- The policy promised photos were "permanently deleted" after 90 days, but no automatic deletion existed — photos were kept indefinitely. A daily cleanup job has now been implemented, so the promise now holds.
- The policy said analytics cookies could be managed "in your browser", when in fact Google Analytics ran by default. It is now off until you agree.
- The policy stated that AI providers "do not retain your data beyond what is needed". We cannot give that guarantee on a third party's behalf; this has been replaced with an accurate description and a named list of providers.
- The policy said logs and analytics were "anonymised within 12 months". We had no such process; this has been rewritten to describe what actually happens.
- The policy did not disclose that images are served from unguessable public links. It now does.
- The children's privacy section read as though we did not hold children's data, which contradicts what this service does. It has been rewritten.
For questions, concerns or data-rights requests:
CEDARLIGHT LABS LLC (operator of Museme)
Post: 5830 E 2nd St, Ste 7000 #39581, Casper, WY 82609, USA
Web: museme.ai
Email: support@museme.ai