Last updated: 19 September 2026
This notice explains how Heartoid Ltd, trading as ToyPal, uses cookies, pixels, local storage and similar technologies on toypal.ai.
For questions, email support@toypal.ai.
1. What these technologies do
Cookies and similar technologies can remember a browser, keep a cart working, protect a form, record a privacy choice, measure website use or connect a visit with an advertising campaign.
Some are strictly necessary for a service you request. Others are optional. In the United Kingdom, ToyPal asks for consent before activating optional analytics or advertising technologies.
2. Your choices
You can:
- accept all optional categories;
- reject all optional categories;
- choose individual categories; and
- change or withdraw your choice later using the permanent Cookie preferences link in the website footer.
Rejecting optional technologies does not prevent ordinary access to the website, story sample, cart or checkout. Strictly necessary technologies remain active because the requested service cannot operate securely without them.
3. Categories
Strictly necessary
These technologies support security, fraud prevention, privacy choices, the shopping cart, checkout, load balancing and the personalised-story form. They do not require consent where they are used only for those purposes.
Providers may include Shopify for the store and consent state, and Cloudflare for Turnstile and form security.
Analytics and performance
If you consent, these technologies help us understand aggregate visits, page performance, errors and how people move through the website.
Our current analytics provider is Google Analytics. Private story fields and child information are excluded from analytics.
Advertising and attribution
If you consent, these technologies help measure campaigns and permitted product, cart, checkout and purchase events. They may help an advertising platform understand that an ad led to a visit or purchase.
Providers may include Google & YouTube, Meta and TikTok. ToyPal does not send child profile, story, voice or listening information to advertising platforms.
Email communications
Shopify Email and Klaviyo may be used to send requested service messages or marketing emails to people who have subscribed. Our Klaviyo onsite tracking and forms are currently disabled. A marketing signup is optional and separate from the personalised-story sample.
4. Current provider register
The live website configuration is reviewed whenever a provider changes. The intended register is:
| Provider | Intended purpose | Category | Active before optional consent? |
|---|---|---|---|
| Shopify | Store, cart, checkout, security and consent state | Strictly necessary; optional Shopify analytics only with consent | Necessary functions only |
| Cloudflare Turnstile | Protect the story form from automated abuse | Strictly necessary security | Yes |
| Google Analytics / Google & YouTube | Analytics and advertising measurement | Analytics or advertising | No |
| Meta | Advertising measurement and attribution | Advertising | No |
| TikTok | Advertising measurement and attribution | Advertising | No |
| Trustpilot | Review/trust features | Functional or analytics according to use | Only where necessary; otherwise consent |
| BixGrow Affiliate | Affiliate attribution through Shopify Customer Events | Advertising or attribution | Shopify currently lists this app pixel as Optimized; access is limited according to Shopify signals and campaign context |
| Klaviyo | Consented email marketing measurement through Shopify Customer Events | Marketing | No; the installed web pixel is controlled through Shopify Customer Privacy choices |
Microsoft Clarity, Hotjar, GemX and GemPages are not active in the current native theme. Klaviyo’s onsite forms and theme tracking remain disabled, but its Shopify Customer Events web pixel is installed for consented email-marketing measurement. BixGrow Affiliate also remains installed in Shopify Customer Events and is currently marked Optimized; Shopify limits its access according to signals and campaign context. Neither provider is permitted to receive child profiles, story text, voice or listening data. If ToyPal introduces another optional provider, this notice and the preference tool will be updated before that provider is enabled.
A provider is not treated as compliant merely because its script is installed: ToyPal tests the page before consent, after rejection, after category acceptance and after withdrawal.
5. How long technologies last
Some technologies last only for the browser session. Others remain for a set period so a cart, consent choice or permitted campaign attribution can be recognised. The precise name, provider, purpose and expiry shown by the live preference tool takes precedence over a general description here.
ToyPal configures each optional provider for the shortest period reasonably needed and reviews whether it is still necessary.
6. Browser controls
You can also block or delete cookies using your browser settings. Blocking all cookies may prevent the cart, checkout, privacy preferences or story-form security from working correctly.
7. Changes
We update this notice and the live provider register when technologies or purposes change. We will ask again if a change requires fresh consent.
8. Contact
Heartoid Ltd, trading as ToyPal
Company number: 14102802
Email: support@toypal.ai
Email support@toypal.ai.