Privacy Policy

Effective date: 1 October 2026 · Last updated: 1 October 2026

The short version

Your sightings file never leaves your browser while you explore. No account, no upload, no tracking.
When you order, we receive only what we need to print and ship your book: the book data, your name, shipping address, phone number and email, plus any photos you choose to add.
We print place names, never map coordinates. We remove location data from your photos.
We delete your book files and photos 30 days after delivery, except a photo you choose to share with other birders (section 5). We keep basic order records for 7 years because Estonian accounting law requires it.
We don't sell your data, we don't use ad trackers, and we don't set cookies beyond what's strictly needed to run the site.
If you buy a book, we may email you now and then about new editions. Tick "No thanks" at checkout, or unsubscribe in one click any time (section 10).
If you ask us to email you when orders open, we keep only your email address for that, and delete it 60 days after orders open, or sooner if you ask (section 10).
You can ask to see, correct or delete your data at any time: hello@mybirdfolio.com.

1. Who is responsible for your data

Birdfolio ("we") is the controller of your personal data.

Email: hello@mybirdfolio.com

We're a small business based in Estonia, so the EU General Data Protection Regulation (GDPR) applies to everything we do, wherever our customers live. We haven't appointed a data protection officer; write to the email above.

2. The free preview: nothing leaves your browser

When you drop in your eBird file (or another export) or paste a list, it's read on your own computer or phone. Nothing is uploaded to us while you explore, and no account is needed.
Your eBird file includes map coordinates for each checklist. They're dropped in your browser. We never receive or print coordinates.
So you can pick up where you left off, your browser keeps your list, your choices and the photos you picked on this device only (the photos as resized copies, with the location data removed). We never receive them. They're deleted 7 days after your last change, when you order, or when you choose "Start over" or "Clear my saved data" on the "Make your Birdfolio" page.
The only thing this page can send us before you order is your email address, and only if you fill in "Email me when orders open", tick the box and press the button (section 10). Nothing about your list goes with it.
Your photos too. If you add your own photos, they're read and matched to your checklists in your browser (from the time each photo was taken and your own checklists; we never analyse what's in the picture), and the preview is made there too. Nothing is uploaded before you order.
When you go to payment with photos chosen, your browser makes resized copies of them (the location data and all other camera data are removed in the process) and keeps them in its own storage, so they can be sent to us after payment. They're deleted from your browser once they're sent, if you cancel the payment, or after 30 days at the latest. Your original files are never uploaded.

3. What we collect, and why

What	Why	Legal basis (GDPR Art. 6(1))	How long (details in section 7)
Book data prepared in your browser: species, first-seen dates, place names, counts and stats, plus the title, cover name and any dedication. Not your original file, and no coordinates.	To make and print your book	Contract (b)	30 days after delivery
Name, shipping address and phone number	To print, ship and deliver the book. The printer and carrier require a phone number for delivery.	Contract (b)	Order records: 7 years
Email address	Order confirmation, shipping updates, questions about your order	Contract (b)	Order records: 7 years
Payment details (handled by Stripe; we see only the card brand, last 4 digits, amount and status)	To take payment and handle refunds	Contract (b)	Order records: 7 years
Your photos (optional): resized copies for print, with location (GPS) and all other camera data removed; the photographer's name for the credit line, if you enter one.	To print them in your book	Contract (b)	30 days after delivery, unless you tick "Keep my photos for a reprint (up to 1 year)"
Photos you choose to share with other birders (optional, only photos you took yourself): a resized copy, the name to print with it, the species, when you agreed and which version of our terms applied, and a scrambled code made from your order number (not the order itself), so we can find it if you ask	To print it, credited to you, in other people's Birdfolio books	Consent (a), and the license in our Terms of Sale (b). You can withdraw at any time	Until you withdraw, or until we stop using it
Print files (PDFs) we make from the above	To print and, if needed, reprint your book	Contract (b)	30 days after delivery
Messages you send us	To answer you and handle reprint claims	Contract (b) and legitimate interests (f)	24 months after your last message
Invoice and order records (name, address, items, amounts, dates)	Bookkeeping and tax	Legal obligation (c)	7 years (section 7)
A gift card recipient's name and email address, the giver's name and a message (only if the buyer asks us to email the gift straight to them)	To email the gift on the day the buyer chose and print it on the card	Contract with the buyer (b); for the recipient, legitimate interests (f): delivering a gift someone sent them	90 days after the card is used, or 2 years after purchase, whichever comes first
Your email address, for news about new editions (only if you bought a book and didn't tick "No thanks" at checkout; never a gift card recipient's)	Now and then, an email about new Birdfolio editions	Legitimate interests (f), under the rule for existing customers (section 10). You can object at any time	Until you unsubscribe
Your email address, if you ask us to email you when orders open ("Email me when orders open", before you order), with the wording of the box you ticked, the page and the time	One email when orders open, plus occasional news about Birdfolio until then	Consent (a). You can withdraw it at any time	60 days after orders open, then deleted; sooner if you unsubscribe or ask
Technical data: IP address and browser details in short-lived server logs	Keeping the site secure and working	Legitimate interests (f)	Up to 7 days

Do you have to give us this data? Only what's needed to fulfill your order: without a shipping address and email, we can't make and send your book. Photos and marketing emails are optional.

Check your place names. Places are printed as they appear in your file. If you named a spot after your home address (some eBird users do), change it before you order.

4. Gift cards

If you buy a gift card, we collect your name, email and payment details, to send you the card and your receipt and to keep track of its balance.
If you ask us to email it straight to someone, you give us their name and email address, and if you like, your name for the card and a message. We use them only to send that gift and to print it on the card: never for marketing, and they never go to Stripe. Our email service sends the gift email for us (section 6).
If someone gave you a gift card, we may have received your name and email address from them, only to send you the gift. We don't add you to any mailing list, and we won't email you again unless you order a book. When you redeem the card, the rest of this policy applies to your order.
We delete the recipient's name and email address, the giver's name and the message 90 days after the card is used, or 2 years after it was bought, whichever comes first (within 2 days if the purchase isn't completed). The card itself never expires.

5. Your photos

You choose which photos to add and which bird each one shows. We suggest a species only from the time you took the photo and your own checklists, in your browser; we never identify birds from the picture itself.
Before you order, nothing is uploaded. After payment, your browser sends us only resized copies made for print (at most 3,000 pixels on the long side). Making them removes the location (GPS) data and all other camera data (time, camera model). We check this when they arrive, and never receive your original files.
We use your photos only to print the book in this order (and any reprint of it), unless you choose to share one (below). We never use them in marketing, and never publish your book, your photos or your locations.
They're deleted 30 days after delivery, with your other book files. If you tick "Keep my photos for a reprint (up to 1 year)", we keep them until one year after delivery (or after shipping, if the carrier doesn't confirm delivery), or until you ask us to delete them, whichever comes first. If your order is canceled or refunded, or can't be printed, they're deleted 30 days after that, with your other book files.

Photos you choose to share with other birders

When you add a photo, you can tick "Share this photo with other birders?". It's optional, it starts unticked, and it's only for photos you took yourself. Like everything else, your choice stays in your browser until you've paid.
If you share a photo, we keep a separate copy of it (the resized print copy, with no location or camera data), the name you gave for the credit, the species, when you agreed and which version of our Terms of Sale applied, and a scrambled code made from your order number. Nothing else: not your email, address or book.
That copy is not deleted with your book files 30 days after delivery. Everything else from your order (your book data, print files and your other photos, including the copy made for your own book) is deleted on the normal schedule.
We look at each shared photo first and may decide not to use it. If we do use it, it's printed in other customers' Birdfolio books, credited with your name, and it goes to our printer (Lulu) inside those books' print files, like every picture.
We never use a shared photo in marketing unless we ask you separately and you agree.
To withdraw, email hello@mybirdfolio.com. We delete our copy and your name, and stop using the photo in new books. Books already printed stay as they are.

We share data only with the companies that help us run Birdfolio, and only what each one needs. They act on our instructions under data processing terms (GDPR Art. 28), except where noted.

Company	What they do for us	What they get	Where
Cloudflare, Inc.	Website hosting, file storage, order database, security, and passing on the emails you send us	Everything needed to run your order	Files stored in the EU; Cloudflare's network is global
Stripe (Stripe Payments Europe, Limited, Ireland)	Payments	Your payment details, name, email and billing address	US and EU. Stripe also acts as an independent controller for fraud prevention and legal compliance, under its own privacy policy
Lulu Press, Inc.	Printing and shipping	Your name, shipping address, phone number and the print files	US company; US orders normally print at a US facility. If that facility can't take the job, Lulu may print at another of its facilities (Canada, UK, France, Australia or India)
Delivery carriers (USPS, UPS or FedEx, chosen by Lulu)	Delivering your parcel	Name, address, phone number	US
Resend, Inc.	Sending our emails: order and shipping emails, gift cards, and emails about new editions and when orders open	Your email address and the email content. For emails about new editions (only if you didn't tick "No thanks"), it also keeps our mailing list: your email address, your name, and whether you unsubscribed. If you asked us to email you when orders open, your email address goes to Resend when we send that email.	US
Etsy (only if you buy on Etsy)	Marketplace	Your Etsy order details	Etsy acts as an independent controller under its own privacy policy

We also share data with the authorities when the law requires it.

We don't sell your personal information, and we don't share it for advertising. We don't use ad networks, social media pixels or tracking scripts.

7. How long we keep it

Data	How long	Why
Your sightings file or list	We never receive it. Your browser keeps it on your device for up to 7 days after your last change, so you can pick up where you left off.	Read in your browser only
Book data, print files, your photos	30 days after delivery (or 45 days after shipping if the carrier doesn't confirm delivery). If your order is canceled or refunded, or can't be printed, 30 days after that instead. Longer only while a reprint request you made is open.	Our promise to you; it also covers the 7-day reprint window
Photos you asked us to keep ("Keep my photos for a reprint (up to 1 year)")	Until one year after delivery (or after shipping, without a delivery confirmation), or until you ask us to delete them	Your choice
Photos you chose to share with other birders	Until you withdraw (email us), or until we stop using the photo. Not deleted 30 days after delivery. We then delete the photo and the name, and keep only a note that you agreed and withdrew	Your consent
Invoice and order records	7 years from the end of the financial year of your order	Estonian Accounting Act § 12 requires us to keep accounting source documents for 7 years
Gift card records (code, amount, balance, buyer email)	Until the card is used up or refunded, then as order records (7 years)	Gift cards never expire
A gift recipient's name and email address, the giver's name and the message	90 days after the card is used, or 2 years after it was bought, whichever comes first; within 2 days if the purchase isn't completed	Only needed to deliver the gift
Messages you send us	24 months after your last message, unless we need them for a claim	To handle follow-up questions and reprints
Emails about new editions	Until you unsubscribe. We then keep only a scrambled code made from your address (not the address itself) on a do-not-email list, so we never email you about them again. Our email service (Resend) keeps your address on our mailing list marked "unsubscribed", so no later mailing reaches you.	Legitimate interests; your right to object
Your email address on the "Email me when orders open" list	60 days after orders open (31 December 2026 if they open on 1 November), or sooner if you unsubscribe or ask. If you order a book, your order is covered by the rows above instead.	Consent; we only need it until orders open and shortly after
Server logs	Up to 7 days	Security

Stripe, Lulu and Etsy may keep some data longer under their own legal duties; see their privacy policies.

8. International transfers

We're based in the EU and our customers are in the US, so your data travels between the two. When it leaves the EU, it's protected by:

the EU-US Data Privacy Framework, for companies certified under it (Cloudflare, Stripe and Resend say they are);
the EU Standard Contractual Clauses in our providers' data processing terms; and
for sending your order to be printed and delivered to you in the US, the fact that the transfer is necessary to fulfill our contract with you (GDPR Art. 49(1)(b)).

9. Cookies and analytics

We don't set cookies for tracking or advertising. Our hosting provider (Cloudflare) may set a small security cookie to tell people from bots; that's strictly necessary to run the site, so it doesn't need consent.
Analytics: we use Cloudflare Web Analytics, which counts visits without cookies or local storage and without fingerprinting you. We see totals (such as page views and countries), not individuals.
Payment: when you pay, you're on Stripe's secure checkout page. Stripe may use its own cookies there for security and fraud prevention, under its own policy.
Do Not Track: we don't track you across other websites, and we don't let anyone else do so through our site. So there's nothing for a Do Not Track or Global Privacy Control signal to switch off.

10. Emails about new editions, and when orders open

If you buy a book, we may email you now and then about new Birdfolio editions. That's the only kind of marketing email we send, and only to the email address of the person who bought the book.
Don't want them? Tick "No thanks" at checkout, or press Unsubscribe in any of these emails (one click). It's free, and it works right away.
You can object at any time to us using your email address for these emails, and we'll stop.
We never send them to someone who received a Birdfolio gift card, and we never share your address for anyone else's marketing.
Every one of these emails says who it's from and has an Unsubscribe link.
Order and shipping emails aren't marketing; you'll get them while your order is open.

Email me when orders open.

Before orders open, you can leave your email address on the order step or the gift card page. The box starts unticked: "Email me once when orders open, plus occasional news. Unsubscribe anytime."
What we keep: your email address, the wording of the box you ticked, the page you were on and the time. Nothing about your bird list, and no name. Your address stays in our database at Cloudflare (stored in the EU).
What we send: one email when orders open, and now and then some news about Birdfolio until then. Every one of these emails has an Unsubscribe link that deletes your address from the list at once, and says who it's from.
Legal basis: your consent. You can withdraw it at any time, free: the Unsubscribe link, or an email to hello@mybirdfolio.com.
When we send, your email address goes to Resend (section 6), our email service, to deliver it.
We delete the whole list 60 days after orders open, or your address sooner if you unsubscribe or ask. If you order a book, the rest of this policy covers your order.

11. Your rights

Wherever you live, you can ask us to:

see the personal data we hold about you and get a copy;
correct it;
delete it (we still have to keep order records for 7 years by law);
restrict or object to how we use it;
move it: get it in a common file format;
object at any time to emails about new editions (section 10); and
withdraw consent at any time, where we rely on it, without affecting what we did before.

How: email hello@mybirdfolio.com from the address you ordered with. We may ask you to confirm who you are. We reply within one month, free of charge.

Complaints: you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia · info@aki.ee · www.aki.ee/en. We'd appreciate the chance to fix things first.

California residents: you can review and ask us to change the personal information we hold about you as described above. We don't share personal information with third parties for their own direct marketing.

12. Security

The site runs over HTTPS only.
Print files are shared with the printer through short-lived private links.
Only we can reach order data, behind login protection.
We delete what we don't need, on the schedule above.

13. Children

Birdfolio is for adults: you must be 18 or older to order. We don't knowingly collect personal information from children under 13. Making a book for a young birder? Please order it yourself as their parent or guardian.

14. Automated decisions

We don't make decisions about you by automated means that have legal or similarly significant effects.

15. Changes to this policy

If we change this policy, we'll post the new version here with a new "Last updated" date. If a change materially affects how we use data we already hold, we'll also email customers with open orders.

16. Contact

Birdfolio · Estonia · hello@mybirdfolio.com