Privacy Policy

Last updated: 19 September 2026

This notice explains how Heartoid Ltd, trading as ToyPal, uses personal information through toypal.ai, the ToyPal Shopify store, customer support, marketing, the website personalised-story demo and the parent-managed ToyPal app.

Short parent summary

• ToyPal's store, app account, purchases and personalisation controls are managed by an adult.
• Please use only a child's first name or nickname in a personalised-story field and do not add unnecessary sensitive information.
• ToyPal does not sell child-profile, story or voice information or use it for behavioural advertising.
• The ToyPal One device has no microphone or camera. Public community and voice-cloning features are not active.
• An authorised adult can ask to access, correct or delete applicable family information by emailing support@toypal.ai.

1. Who is responsible for your information

Heartoid Ltd is the controller of the personal information described in this notice.

Heartoid Ltd is registered in England and Wales under company number 14102802. Our registered office is 338A Regents Park Road, Office 3 and 4, London, England, N3 2LN.

For privacy questions or requests, email support@toypal.ai.

Direct website checkout is currently available only for delivery in the United Kingdom.

2. ToyPal and children

ToyPal is made for families, but the store, account, app setup, purchases and personalised-story choices are controlled by an adult. Children should not create an account, place an order or submit information directly.

An adult may provide limited details about a child to personalise a story. Please use a first name or nickname only. Do not enter a surname, address, school, telephone number, email address, photograph, precise location, health information or other sensitive information in an ordinary story field.

We do not use child profiles, names, stories, voices or listening activity for targeted advertising, and we do not sell them. Child and story information must not be added to Shopify, Klaviyo, Google, Meta, TikTok or affiliate-marketing profiles.

The ToyPal One device has no microphone or camera. The app is parent-managed. The public community feature is not live: there are no public child profiles, public feed or child-to-stranger chat. Voice cloning is not an active supported production feature.

We design child-facing services with high privacy settings by default and treat the child's best interests as a primary consideration.

3. Information we use

Website operation and security

We may process an IP address, device and browser information, request time, security events and privacy choice to operate and secure the website, prevent fraud and remember consent preferences.

Our lawful bases are our legitimate interests in operating a secure service, compliance with legal duties and, for storage that is strictly necessary, the applicable communications rules.

Optional analytics and advertising

If you consent, analytics providers may receive limited information about page visits, interactions, device or browser details and campaign source. If you separately consent to advertising technologies, advertising platforms may receive permitted product, cart, checkout and campaign events.

Our lawful basis for non-essential cookies, pixels and similar technologies is consent. Declining them does not prevent ordinary access to the website or store. Child names, story choices, story text, audio and demo identifiers must not be included in these events.

Orders and customer service

When you buy from us or contact us, we may use your name, email, telephone number if supplied, billing and delivery address, order details, payment status, delivery records, support messages and returns or refund information.

We use this information to take payment, fulfil the order, provide support, handle returns, prevent fraud and meet accounting, tax, safety and consumer-law duties. Our lawful bases are performance of the contract, legal obligation and our legitimate interests in fraud prevention and legal claims.

ToyPal does not receive your complete payment-card details. Shopify and the payment method selected at checkout process the payment.

Marketing

If you sign up for news or lawfully agree to marketing during checkout, we use your email address, consent record, campaign engagement and suppression status to send and manage ToyPal marketing. We rely on consent or the limited UK soft opt-in only when all legal conditions are met.

You can unsubscribe using a link in a marketing message or by emailing support@toypal.ai. Order, security, safety and service messages are not marketing.

Website personalised-story demo

The free website demo asks an authorised adult for a child's first name or nickname, age band, pronoun and selected story world. It does not require an account or email address.

ToyPal uses these details through its AWS-hosted service and approved generation and narration providers to create the requested temporary story and audio. Cloudflare Turnstile protects the form from automated abuse.

The demo service is configured to schedule story text and audio for expiry within 24 hours. A playback link expires after approximately 10 minutes. Separate pseudonymous security and service-control records are configured for limited periods: approximately two days for daily rate controls, approximately 62 days for service-budget controls and up to 90 days for deletion evidence. Those control records do not contain the finished story or audio. These are scheduled maximum lifecycles rather than a promise that deletion occurs at an exact second.

We derive a short-lived network control from a keyed hash of an IP network prefix. The raw address is not stored in the demo job record, but the pseudonymous control may still be personal information.

The demo is not saved to the ToyPal app. It remains separate from Shopify customer records, email marketing and advertising payloads. The adult confirmation does not enrol the child or adult into marketing.

Parent-managed ToyPal app

The app may process adult account information, limited child-profile information supplied by the adult, requested stories and narration, app-store entitlement data, device or app diagnostics and support or privacy-request records. The exact information depends on the released features the adult chooses to use.

The separate ToyPal App and Child Privacy Notice explains the current app providers, permissions, purchases, attribution, retention and deletion controls in more detail. The ToyPal App Terms explain the service rules.

4. Cookies, pixels and similar technologies

Strictly necessary technologies operate security, privacy choices, the cart and checkout. Analytics and advertising technologies are optional and remain off until the required consent is given.

The Cookie Notice identifies the current purposes and providers. A permanent Cookie preferences control lets you change or withdraw your choice. Withdrawing consent does not affect earlier processing that was lawful.

5. Who receives information

We share only what is necessary with service providers and recipients such as:

• Shopify, for the website, store, checkout, customer privacy controls and Shopify Email;
• the payment method selected at checkout;
• delivery, returns, support and professional-service providers;
• Amazon Web Services, for application and personalised-story infrastructure;
• Cloudflare, for service security and Turnstile;
• approved text, image or narration providers when an adult requests the related feature;
• Apple and Google, for app distribution, sign-in, store billing or notifications where those functions are used;
• Klaviyo, for consented email marketing and suppression management;
• Google Analytics, Google and YouTube, Meta and TikTok, only for permitted analytics or advertising events after the required consent; and
• advisers, insurers, auditors, courts, law-enforcement bodies and regulators when required.

We do not disclose child profiles, story content, audio or private family information to advertising or email-marketing platforms. We do not sell personal information.

6. International transfers

Some providers may process information outside the United Kingdom. Where UK adequacy regulations do not apply, we use an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum, and assess the transfer where required.

Contact support@toypal.ai for information about safeguards relevant to your information.

7. How long we keep information

We keep information only for as long as needed for the purpose, legal obligations, product safety, fraud prevention or legal claims. We review the periods and delete or anonymise information when there is no continuing need.

• Website demo story text and audio: configured for scheduled expiry within 24 hours.
• Demo playback link: approximately 10 minutes.
• Demo rate control: approximately two days.
• Demo budget or service control: approximately 62 days.
• Demo deletion evidence: up to 90 days without the story or audio.
• Company tax and accounting records connected with an order: normally six years from the end of the relevant accounting period, or longer where law requires.
• Routine support records: normally three years after the matter closes; longer only where needed for product safety, an active dispute or a legal claim.
• Marketing consent: while relied on. We keep a minimal suppression record as necessary to honour an opt-out.
• Website analytics and advertising identifiers: according to the consented provider setting and the period stated in the Cookie Notice.
• Adult and child app information: while the account or requested content remains active, followed by deletion, anonymisation or restricted retention according to the verified request and any legal need.
• Security logs and backups: for a limited documented cycle appropriate to the risk. Deleted information is not restored into active use from a backup.

Where a deletion request cannot lawfully or technically be completed immediately, we restrict ordinary use and explain what has been deleted, what remains, the reason and the expected expiry.

8. Your rights

Depending on the circumstances, UK data-protection law may give you rights to:

• receive information about processing;
• access personal information;
• correct inaccurate or incomplete information;
• request deletion;
• restrict or object to processing;
• receive certain information in a portable format;
• withdraw consent at any time; and
• object to direct marketing.

These rights are not absolute. We may need to verify identity and parental authority before disclosing or changing information about a child.

Email support@toypal.ai to exercise a right. We respond within the period required by law.

9. Security

We use proportionate safeguards including encrypted transmission and storage where appropriate, access controls, separate environments, secrets management, short-lived private links, rate limits and supplier review. No internet service is completely secure. We assess incidents and notify affected people or regulators where the law requires.

10. Complaints

Please email support@toypal.ai first so we can investigate.

You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

11. Changes to this notice

We may update this notice when the service, providers or legal duties change. We show the new date and give prominent notice of material changes. We do not treat silence or continued use as consent where a fresh choice is required.

12. Contact

Heartoid Ltd, trading as ToyPal

Company number: 14102802

338A Regents Park Road, Office 3 and 4

London, England, N3 2LN

Email: support@toypal.ai