Almia Subprocessor List
Effective 7 June 2026
Almia Stories (ABN 25 380 435 979), trading as Almia, is based in Sydney, New South Wales, Australia.
When you create a book with Almia, your information is processed by Almia Stories (ABN 25 380 435 979), trading as Almia (“we”, “our”, “us”), and by a small set of trusted service providers (subprocessors) we rely on. This page lists each one by legal name, the data they access, the country they operate in, and the link to their published privacy commitments. The list is updated as our service stack changes. For the broader privacy framework, see our Privacy Policy at /privacy.
1. AI partners
Anthropic, PBC • Country: United States • Data accessed: Story text, generated illustrations, child profile text (name, age, interests, traits). Does not access your child’s photograph. • Purpose: Text generation and quality review. • Retention: 30 days, under their commercial API terms. • Trains on this data: No. • Privacy: anthropic.com/legal/privacy and privacy.claude.com/en/articles/7996866-how-long-do-you-store-personal-data Google LLC • Country: United States • Data accessed: Child photograph, generated illustrations, story text, child profile text. • Purpose: Image processing. • Retention: 30 days, for abuse monitoring only, under their paid Gemini API terms. • Trains on this data: No. • Privacy: ai.google.dev/gemini-api/terms and policies.google.com/privacy
2. Infrastructure
Amazon Web Services, Inc. • Country: Australia (Sydney region) for data storage and server access logging; United States for the corporate entity. • Data accessed: All Almia data at rest, including the original child photograph. Separately, server access logs containing the client IP address, user agent, request path, and timestamp of each request to our website and API. • Purpose: Encrypted cloud storage, hosting of backend services, and server access logging for incident response and security investigation. • Retention: Application data is Almia-controlled, per the retention rules in our Privacy Policy. Server access logs are retained for 180 days and then automatically deleted. • Trains on this data: Not applicable. • Privacy: aws.amazon.com/privacy Vercel Inc. • Country: United States. • Data accessed: Web hosting, request and error logs. • Purpose: Hosting the public website and edge delivery. • Retention: Per Vercel’s policy. • Trains on this data: Not applicable. • Privacy: vercel.com/legal/privacy-policy
3. Payments
Stripe, Inc. • Country: United States. • Data accessed: Parent name, email, billing address, payment instrument details (processed directly by Stripe; we do not store card details on our servers). • Purpose: Payment processing. • Retention: Per Stripe’s data processing agreement. • Trains on this data: Not applicable. • Privacy: stripe.com/au/privacy
4. Email, marketing and advertising
Postmark (Wildbit, LLC) • Country: United States. • Data accessed: Parent email address and the content of transactional emails (order confirmations, shipping updates, account emails). • Purpose: Transactional email delivery. • Retention: Per Postmark’s policy. • Trains on this data: Not applicable. • Privacy: postmarkapp.com/privacy-policy Brevo SAS • Country: France. • Data accessed: Parent email address and lifecycle event data (for example, that you placed an order or that your character approval is pending). • Purpose: Lifecycle communications related to your order, and marketing emails if you have opted in to marketing. • Retention: Per Brevo’s policy. • Trains on this data: Not applicable. • Privacy: brevo.com/legal/privacypolicy Google Ads (Google LLC) • Country: United States. • Data accessed: Ad-click identifiers and on-site conversion events (for example, that a visit from a Google ad led to a sign-up or purchase). Does not access your child’s photograph or profile text. • Purpose: Measuring and improving the performance of our Google advertising. • Retention: Per Google’s advertising data policy. • Trains on this data: Not applicable. • Privacy: policies.google.com/privacy and myadcenter.google.com (opt-out)
5. Print and shipping
Prodigi (Prodigi Group Ltd) or Gelato (Gelato Group AS), depending on the region your order ships from. • Country: United Kingdom (Prodigi) or Norway (Gelato). • Data accessed: Parent shipping name and address, and the finished printable book file. Does not access your child’s photograph. • Purpose: Printing the book and arranging shipment. • Retention: Per the relevant partner’s policy. • Trains on this data: Not applicable. • Privacy: prodigi.com/privacy and gelato.com/legal/privacy-policy
6. Updates to this list
We will update this page when we add, remove, or change a subprocessor. The effective date at the top of the page reflects the most recent update. If you have questions about a specific subprocessor or want to verify the data we share with them, please email privacy@almia.com.au.