Privacy Policy

1. Who We Are

DoodleToyz (“DoodleToyz,” “we,” “us”) operates www.doodletoyz.com and the related custom-toy service. This Privacy Policy explains what information we collect, why, how we use it, with whom we share it, and your rights. It applies to anyone who visits, signs up, uploads content, or places an order on the Service.

2. The Service Is Operated by Adults on Behalf of Children

DoodleToyz is designed and intended for use by adults (parents, legal guardians, family members, gift-givers, age 18+). Children do not create accounts, do not upload content, and do not place orders.

The artwork we receive was typically drawn by a child, but the act of uploading it, the consent to processing it, and the order for a finished toy are taken by the adult account holder. By using the Service, the adult account holder represents that they are the parent, legal guardian, or otherwise authorized to upload the child’s artwork and consent to its processing on the child’s behalf.

We do not knowingly collect personal information directly from children under 13 (in the United States, under the Children’s Online Privacy Protection Act, “COPPA”) or under 16 (in many EU jurisdictions, under GDPR Article 8). The only “child” information we receive is artwork uploaded by the adult account holder along with whatever they choose to add (e.g., a first name on the order). We treat any such information as adult-supplied content provided with parental consent.

We do not direct marketing to children. We do not behaviorally profile children. We do not knowingly use any uploaded artwork to train any AI model beyond what is necessary to render that specific order’s 3D preview.

If you believe a child has provided us with personal information directly, please contact us immediately at office@doodletoyz.com. We will delete it as soon as we verify the report.

3. What We Collect

Information You Provide

• Account information: name, email address, password (hashed)
• Shipping information: recipient name, street address, city, state/region, postal code, country, phone number
• Payment information: handled by Stripe; we do not receive or store full card numbers, but we do receive last 4 digits, expiry, billing zip, and a Stripe customer/charge ID
• Communication content: emails to support, replies in our help threads, contact-form messages

Content You Upload

• Drawings/images: the artwork uploaded to be converted into a toy
• File metadata: file size, MIME type, dimensions, upload timestamp
• Generated 3D models: AI-derived 3D mesh and preview renders
• Order notes: any optional text you add at checkout

Information Collected Automatically

• Device/network: IP address, browser type, operating system, device model, language preference
• Usage: pages viewed, time on page, clicks, referrer URL, navigation paths
• Cookies and similar: see our Cookie Policy
• Error reports: stack traces and context when something breaks (no payment data, no full uploads)

Information We Do Not Collect

• We do not collect health, biometric, or precise GPS location data;
• We do not buy data about you from data brokers;
• We do not knowingly collect information about children except as described in Section 2.

4. How We Use Your Information (and Our Lawful Basis Under GDPR)

We process personal information for the following purposes. For users in the European Economic Area, the United Kingdom, and other jurisdictions with similar laws, the lawful basis we rely on for each purpose is indicated in brackets.

Service Delivery

• Create and authenticate your account; [contract performance]
• Accept your upload, generate the 3D model, present the preview; [contract performance]
• Process payment, manufacture the toy, coordinate shipping, send order updates; [contract performance]
• Provide support; [contract performance + legitimate interest in retaining records]

Service Improvement & Safety

• Analyze aggregate usage to improve features and performance; [legitimate interest]
• Detect and prevent fraud, abuse, and security incidents; [legitimate interest + legal obligation]
• Moderate uploaded content for prohibited material (Terms §5); [legitimate interest in user safety]
• Improve AI 3D-model quality; aggregated and de-identified data only; [legitimate interest]

Communications

• Transactional emails (order confirmation, shipping update, refund); [contract performance]
• Service announcements that materially affect you (Terms changes, security incidents); [legitimate interest + legal obligation]
• Marketing emails (drawing tips, new features, occasional offers); [consent — we ask for this separately and you can unsubscribe anytime]

Legal & Compliance

• Comply with applicable law, court orders, and regulatory requests; [legal obligation]
• Establish, exercise, or defend legal claims; [legitimate interest]
• Enforce our Terms; [legitimate interest]

5. Marketing Communications (Separate from Service Emails)

We treat marketing emails separately from transactional/service emails:

• Transactional emails (always sent): order confirmation, shipping updates, password reset, security notices, material changes to these policies. You cannot opt out of these while you have an active account or pending order.
• Marketing emails (only with your consent): newsletters, drawing tips, gift-guide announcements, occasional offers. You opt in when you sign up for the newsletter or check the marketing-consent box at signup or checkout. You can opt out anytime via the unsubscribe link in every marketing email or by emailing office@doodletoyz.com.

Opting out of marketing does not affect transactional emails or your other rights.

6. Who We Share Information With

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We share information only in the limited circumstances below.

Sub-Processors (Service Providers)

We use the following third parties to run the Service. Each is contractually bound to use the information only to provide services to us:

• Supabase (database, authentication, object storage) — data residency: regional; data shared: account, order, upload metadata, uploaded files
• Meshy AI (3D model generation) — data residency: vendor-managed; data shared: the uploaded image (base64-encoded) and resulting model
• Stripe (payment processing) — data residency: global; data shared: payment instrument data, billing address, charge amount
• Resend (transactional and marketing email delivery) — data residency: U.S.; data shared: email address, email content
• Vercel (hosting and edge network) — data residency: global edge; data shared: IP, request metadata
• Sentry (error monitoring) — data residency: U.S.; data shared: error stack traces, sanitized context, user/order IDs
• PostHog (product analytics, if enabled) — data residency: U.S./EU; data shared: pseudonymous event data
• Manufacturing & shipping partners — data shared: order details, recipient name, shipping address, phone

Legal Requirements

We may disclose information when we believe in good faith it is required to (a) comply with applicable law, court orders, subpoenas, or government requests; (b) protect our rights, property, or safety or the rights of others; (c) investigate fraud, security issues, or violations of our Terms.

Corporate Events

If DoodleToyz is acquired, merged, reorganized, or its assets sold, personal information may be transferred to the successor. We will notify you of any such transfer that materially changes how your information is used.

7. International Data Transfers

We operate from the United States. When we transfer personal information from the European Economic Area, the United Kingdom, Switzerland, Israel, or other jurisdictions with similar laws to the United States or other countries that may not provide an equivalent level of protection, we rely on appropriate safeguards, including:

• The European Commission’s Standard Contractual Clauses (SCCs);
• UK International Data Transfer Agreement / UK SCC Addendum;
• Israeli Privacy Protection Regulations regarding transfers, where applicable;
• Vendor adherence to recognized certifications (e.g., the EU–US Data Privacy Framework where applicable).

You can request a copy of the safeguards in place for a specific transfer by emailing office@doodletoyz.com.

8. How We Protect Information

• Transport encryption: all traffic is over TLS 1.2+
• At-rest encryption: database and object storage encrypted
• Access control: row-level security on user data; restricted admin access; principle of least privilege
• Payment isolation: all card data handled by Stripe (PCI-DSS Level 1)
• Logging & monitoring: server-side logging, error tracking, anomaly review
• Secrets management: credentials in environment variables, never committed to source code

No system is 100% secure. We do not guarantee absolute security. You are responsible for keeping your account credentials safe and for notifying us promptly of any suspected unauthorized access.

9. Data Breach Notification

If we become aware of a data breach affecting your personal information, we will notify the appropriate supervisory authority within 72 hours where required by GDPR or similar law, and we will notify affected users without undue delay where required by applicable law, by email and/or in-product notice. Notifications will describe the nature of the breach, categories and approximate number of affected records, likely consequences, and mitigation steps.

10. How Long We Keep Information

• Account information: for the life of the account, plus up to 24 months after the account is closed for fraud-prevention and dispute-resolution purposes;
• Order records: up to 7 years to comply with tax and accounting law;
• Uploaded drawings: until you delete them or close your account, except where we are required to retain a copy for an open dispute, investigation, or legal hold;
• Generated 3D models: for 90 days after the related order is delivered, then deleted unless retention is required;
• Support communications: up to 3 years;
• Error logs and analytics: typically 90 days, aggregated/anonymized data may be kept longer;
• Marketing list: until you unsubscribe.

After the retention period, we securely delete or de-identify the data.

11. Your Privacy Rights

Depending on where you live, you have some or all of the following rights:

• Access: request a copy of the personal information we hold about you;
• Rectification: request correction of inaccurate or incomplete information;
• Erasure: request deletion of your information (subject to our legal retention obligations);
• Restriction: request that we limit processing in certain circumstances;
• Objection: object to processing based on legitimate interest, or to marketing;
• Portability: receive your information in a structured, commonly used, machine-readable format (we provide JSON); transmit it to another controller where technically feasible;
• Withdraw consent: where we rely on consent, withdraw it at any time (withdrawal does not affect prior lawful processing);
• Lodge a complaint: with your local supervisory authority (e.g., your EU Data Protection Authority, the UK ICO, the Israeli Privacy Protection Authority, your U.S. state attorney general).

To exercise these rights, email office@doodletoyz.com from the email on your account, or with sufficient information to verify your identity. We respond within 30 days (extendable by up to 60 days for complex requests as permitted by law). We do not discriminate against you for exercising your rights.

California Residents (CCPA/CPRA)

You have the right to: (a) know what categories of personal information we collect and the purposes; (b) request access and deletion; (c) correct inaccurate information; (d) limit use of sensitive personal information; (e) opt out of “sale” or “sharing” (we do not sell or share for cross-context behavioral advertising); (f) non-discrimination. We do not knowingly sell or share personal information of any consumer under 16 without affirmative authorization.

Israeli Residents (Privacy Protection Law)

You have the right to inspect personal information we hold about you under § 13 of the Israeli Privacy Protection Law 5741-1981 and to request correction under § 14. Submit requests to office@doodletoyz.com. Our processing of personal information from Israel adheres to the Israeli Privacy Protection Regulations (Data Security), 2017, and the cross-border transfer regulations to the extent applicable.

EEA, UK, and Swiss Residents (GDPR / UK GDPR / FADP)

In addition to the rights above, you have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred.

12. Automated Decision-Making and AI

We use AI (currently Meshy AI) to convert your uploaded drawing into a 3D model. This is not a legal or significant automated decision about you within the meaning of GDPR Article 22; it is a creative transformation of content you provided. We do not use AI to make decisions about your eligibility, pricing, or any other consequential outcome about you. If you want to discuss any AI-related concern, email us.

13. Cookies & Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your locale, measure aggregate usage, and (when you opt in) personalize content. For a detailed breakdown by category and vendor, see our Cookie Policy. You can manage cookies in your browser settings; blocking essential cookies may disable parts of the Service.

14. Third-Party Links and Embeds

The Service may link to or embed content from third parties. Those parties have their own privacy practices, which we do not control. Review their policies before submitting information to them.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we’ll update the “Last updated” date and notify you by email or in-product notice at least 14 days before the change takes effect (longer where required by law). A change log is maintained in docs/legal/CHANGELOG.md.

16. Contact & Data Protection

Questions, complaints, or rights requests: office@doodletoyz.com. For EU data subjects, you may also contact your local Data Protection Authority. For UK data subjects, the Information Commissioner’s Office (ICO). For Israeli data subjects, the Privacy Protection Authority.