This Privacy Policy explains how CEDARLIGHT LABS LLC ("Cedarlight Labs," "we," "us") collects, uses and protects personal information when you use our website and products, including Copywa and Museme (the "Services"). Our approach is simple: we collect only what we need to run the Services, and we don't sell your personal information.
Information we collect
Information you give us
- Account information: name, email address, login details and preferences. Passwords, where used, are never stored in plain text.
- Order and shipping information: for physical products, the recipient name, shipping address and phone number (if the carrier needs it).
- Content you provide: for Copywa, persona, brand voice and source materials you add; for Museme, the photo you upload and personalization details such as a child's first name.
- Support messages: emails and contact-form messages you send us.
Billing information
Payments are handled by Stripe. Stripe collects your card details directly. We don't receive or store full card numbers. We receive limited information from Stripe, such as the last four digits, card brand, billing country and transaction status.
Information collected automatically
- Usage analytics: we use privacy-friendly, cookie-free analytics (such as Cloudflare Web Analytics) that measure page views and performance without tracking you across sites.
- Technical data: IP address, browser type and device information in server and security logs, used to keep the Services secure and working.
- Product usage: within our products, basic records of feature use needed to provide, bill and improve the Services.
We don't use advertising cookies or cross-site tracking on this website.
Cookies and similar technologies
This website (cedarlightlabs.com) doesn't set advertising or analytics cookies. It stores one preference in your browser's local storage, your light or dark theme choice, which never leaves your device. If the contact form is enabled, Cloudflare Turnstile checks that you're not a bot; it may use strictly necessary technical data for that purpose only.
Our product websites may use cookies needed to sign you in, keep a shopping cart or remember settings. Where a product uses optional cookies, it asks for your consent first.
How we use information
We use personal information to:
- Provide the Services, including generating content and producing and shipping your order.
- Process payments, prevent fraud and manage subscriptions.
- Respond to support requests and send service messages (such as receipts, shipping updates or important changes).
- Keep the Services secure, debug issues and improve performance.
- Comply with legal obligations and enforce our Terms of Service.
We send marketing emails only if you've opted in, and every marketing email includes an unsubscribe link.
Legal bases for EEA and UK users
If the GDPR or UK GDPR applies to you, we rely on these legal bases:
- Contract: to provide the Services you've requested.
- Legitimate interests: to secure, maintain and improve the Services, in ways that don't override your rights.
- Consent: for optional marketing, and where we ask for it for specific processing. You can withdraw consent at any time.
- Legal obligation: for tax, accounting and other legal requirements.
Children and Museme photos
Our Services are not directed to children, and we don't knowingly collect personal information directly from children under 13.
Museme creates books featuring children, so some orders include a child's photo and first name. This information is provided by a parent, legal guardian or another adult with the guardian's permission, never by the child. For this information:
- We use it only to create and deliver the book that was ordered, including previews and printing.
- We don't use it to train our own AI models, and we don't use it for advertising or any other purpose.
- To create the paintings, the photo is processed by third-party AI image providers (listed under Sub-processors below). Their handling of data is governed by their own terms. We share it only with providers who need it to produce your book, including our print partners.
- We automatically delete the original photo 90 days after your order is delivered, shipped or canceled. Once deleted, it can no longer be used to reprint or modify the book.
- Finished book pages aren't deleted automatically, so you can reorder. Ask us and we'll delete them.
- A parent or guardian can ask us to delete the photo sooner, or to review or delete any of this information, at any time by emailing legal@cedarlightlabs.com.
If you believe a child has given us personal information directly, contact us and we'll delete it.
How we share information
We don't sell personal information, and we don't "share" it for cross-context behavioral advertising. We share information only:
- With service providers (sub-processors) that help us run the Services, under contracts that limit their use of the data.
- With shipping carriers and print partners as needed to fulfill physical orders.
- If required by law, or to protect rights, safety and the security of the Services.
- In connection with a merger, acquisition or sale of assets, in which case we'll notify you and this policy will continue to apply.
Sub-processors
We currently use these sub-processors. We'll update this list when it changes.
| Provider | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing and billing | United States |
| Cloudflare, Inc. | Website hosting, security and cookie-free analytics | Global |
| Resend, Inc. | Transactional and support email delivery | United States |
| fal.ai | AI image generation for Museme books | See provider's terms |
| Segmind | AI image generation for Museme books | See provider's terms |
| Google LLC (Gemini API) | AI image processing for Museme books | United States |
| Print and fulfillment partners | Printing and shipping Museme books | United States, Germany, China |
Data retention
We keep personal information only as long as needed for the purposes above:
- Account data: while your account is active, and deleted within 30 days after you close it (except as noted below).
- Museme original photos: deleted automatically 90 days after delivery, shipment or cancellation, or sooner on request. Finished book pages are kept until you ask us to delete them.
- Order and billing records: kept as long as required for tax and accounting purposes (generally up to 7 years).
- Support emails: up to 24 months after the conversation ends.
- Security logs: generally up to 90 days.
Your privacy rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, email legal@cedarlightlabs.com from the email address linked to your account. We'll verify your request and respond within 30 days, or sooner where the law requires. You can also complain to your local data protection authority.
California privacy rights
If you're a California resident, the CCPA as amended by the CPRA gives you the right to:
- Know what personal information we collect, use and disclose.
- Delete personal information we've collected from you, subject to legal exceptions.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of personal information. We don't sell or share personal information as those terms are defined under California law.
- Limit the use of sensitive personal information. We use it only as permitted to provide the Services.
- Not be discriminated against for exercising these rights.
Categories collected in the last 12 months: identifiers (name, email, address), commercial information (orders), internet activity (limited usage data) and content you provide. You or an authorized agent can submit a request to legal@cedarlightlabs.com.
International transfers
We're based in the United States, and our service providers may process data in the US and other countries. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses, for transfers of personal information from the EEA, UK or Switzerland.
Security
We use reasonable technical and organizational measures to protect personal information, including encryption in transit (HTTPS), access controls and payment processing through Stripe, which is PCI DSS compliant. No system is perfectly secure. If we become aware of a breach affecting your personal information, we'll notify you as required by law.
Changes to this policy
We may update this policy from time to time. If we make material changes, we'll notify you by email or in the product before they take effect. The "Last updated" date shows the latest version.
Contact
For privacy questions or requests:
- Email: legal@cedarlightlabs.com
- Mail: CEDARLIGHT LABS LLC, 5830 E 2nd St, Ste 7000 #39581, Casper, WY 82609, USA