Is it safe to upload my kid's photo to an AI?
Short answer: yes, if the service meets four concrete conditions — no training on your data, deletion by architecture, GDPR-safeguarded transfers (SCCs + DPF), upstream moderation. This page covers how cuentoconlaIA meets each one, with no marketing.
1. No training on your data
There are two ways to use OpenAI's models: consumer ChatGPT (where, unless you opt out explicitly, your conversations can train the model) and the API (where the base contract prohibits training). cuentoconlaIA uses the API. The distinction matters: the API has a DPA — Data Processing Agreement — that is contractual and verifiable, not a toggle in a menu. Amazon Rekognition doesn't train on inference data either. If OpenAI ever changes the policy, we'd have to re-negotiate the DPA and notify you before any change applies.
2. Deletion after 30 days by architecture
The S3 bucket that stores photos has a lifecycle rule that deletes any object after 30 days. It's not a policy — it's IaC code (Terraform) anyone can read in infra/core/s3.tf. Bypassing it would require changing the code, running terraform apply, and the CloudTrail audit would record the change. In practice nobody does it and nobody should.
3. Where the data is processed (and under which safeguards)
AWS region us-east-1 (Virginia, USA). The entire pipeline runs inside that region: S3 bucket, Lambdas, Step Functions, Rekognition. That is an international data transfer, covered by Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework, declared in our privacy policy. Calls to OpenAI carry base64-encoded photos and prompts; OpenAI receives them, processes them, discards them after the model run — and never trains on them.
4. Upstream image moderation
Before the pipeline even reads the photo content, Amazon Rekognition runs it through child-safety and violence filters. Anything inappropriate is rejected, the transaction is reversed, and we notify you. Every generated illustration also passes moderation before being accepted into the final book — defence in depth, not a single point of failure.
The DPIA (Data Protection Impact Assessment)
GDPR requires this document for services processing sensitive data at scale. Ours is public in docs/dpia-children-biometric-ai.md in the repo. It identifies the risks (re-identification, bucket leak, model drift, operational misuse), describes the mitigations (deletion by architecture, dual moderation, IAM role segregation, contractual no-training), and sets a review schedule. If your school or PTA asks for a privacy analysis before gifting an AI book to a child, that DPIA is the answer.
A concrete note for parents of very young kids
If your kid is under 3, the photo you upload is necessarily a baby photo — more sensitive than a school photo at 7. The pipeline works the same at that age and the same contracts apply. Worth knowing: the photo doesn't need to be perfect. A frontal face shot with good light, no sunglasses, is enough. If in doubt, upload the most anodyne version you have — it always works.
Frequently asked questions
Does my photo train the model?
No — your photo is used to generate your book, and for nothing else. cuentoconlaIA calls OpenAI via API (not consumer ChatGPT), and OpenAI's contractual DPA for API calls prohibits training on inference data; that no-training clause has been signed and in force since day one. Amazon Rekognition, which moderates every uploaded photo before generation starts, doesn't train on inference data either. If OpenAI ever changed this policy, we would have to accept the change explicitly, and we would notify you before it took effect. On top of the contract, the photo's lifecycle is short by design: it's processed during generation (5-10 minutes) and auto-deleted after 30 days by an S3 lifecycle rule on the bucket, so there is no stored material left that could train anything in the first place.
How long do you keep the photo?
30 days, then it's gone automatically. Not our policy — an S3 lifecycle rule painted on the bucket. Even an internal operator with permissions can't extend it; AWS deletes objects when the window expires. Intermediate renders (pages generated before PDF composition) follow the same rule.
Who can see the photo during those 30 days?
Two systems only, and no human by default. The first is the book-generation pipeline: Step Functions and the Lambdas that call OpenAI and Rekognition process the photo for around 5 minutes in total and don't keep it. The second is the laIA-content-mod operator, who only steps in when Rekognition's automatic moderation flags an uploaded image as borderline and a human check is needed. No employee has default access to the bucket where the photos live: human access requires assuming an ephemeral IAM role, and every assumption is logged in CloudTrail, so there's an auditable trail of any access. The support team (hola@) never has access to the photos under any circumstances — they only see order metadata. And after 30 days, the S3 lifecycle rule deletes the photo automatically, with no human involved.
Can I delete the photo before 30 days?
Email privacy@cuentoconlaIA.com with the order email and we delete it in under 72 hours. GDPR Art. 17 — right to erasure. The composed PDF book itself we keep for the 30-day download link; after that everything is gone automatically.
Are the generated images safe to show?
Yes, with the honesty that AI can be wrong. Every illustration passes Rekognition moderation before being accepted, but the system isn't perfect — if you receive the book and a page doesn't fit your values, write to us and we re-generate that page for free. The 'laIA can be wrong · approximate results' disclaimer is everywhere for a reason.
What if I'm stricter than average — what guarantees do I get?
For privacy-sensitive parents, the guarantees are concrete and checkable. (a) Data is hosted in AWS us-east-1 (USA) under Standard Contractual Clauses and the EU-US Data Privacy Framework, encrypted and auto-deleted after 30 days by an S3 lifecycle rule — deletion doesn't depend on anyone remembering to do it. (b) We publish a full DPIA (Data Protection Impact Assessment) you can read in its entirety at docs/dpia-children-biometric-ai.md in the public repo. (c) The pipeline code is proprietary, but the boundary points — upload, Rekognition moderation, generation and deletion — are audited independently. (d) No photo is ever used to train models: the no-training clause is written into our OpenAI API contract, and Rekognition doesn't train on inference data either. (e) And if all of that still isn't enough, email privacy@cuentoconlaIA.com and I'll reply to you personally — David, founder.
Read also
If you're comfortable after reading this, the wizard is waiting. For any question not covered above, email privacy@cuentoconlaIA.com — David, founder, replies personally.
Create my kid's book →