Privacy Policy

Last updated: 10 October 2026

This notice explains how Heartoid Ltd, trading as ToyPal, uses personal information through toypal.ai, the ToyPal Shopify store, the website personalised-story sample, customer support and the parent-managed ToyPal app.

Short parent summary

• ToyPal's store, app account, purchases and personalisation controls are managed by an adult.
• Please use only a child's first name or nickname in a personalised-story field and do not add unnecessary sensitive information.
• ToyPal does not sell child-profile, story or voice information or use it for behavioural advertising.
• The ToyPal One device has no microphone or camera. Public community and voice-cloning features are not active.
• An authorised adult can ask to access, correct or delete applicable family information by emailing support@toypal.ai.

1. Who is responsible for your information

Heartoid Ltd is the controller of the personal information described in this notice.

Heartoid Ltd is registered in England and Wales under company number 14102802. Our registered office is 338A Regents Park Road, Office 3 and 4, London, England, N3 2LN.

For privacy questions or requests, email support@toypal.ai.

Direct website checkout is currently available only for delivery in the United Kingdom.

2. ToyPal and children

ToyPal is made for families, but the store, account, app setup, purchases and personalised-story choices are controlled by an adult. Children should not create an account, place an order or submit information directly.

An adult may provide limited details about a child to personalise a story. Please use a first name or nickname only. Do not enter a surname, address, school, telephone number, email address, photograph, precise location, health information or other sensitive information in ordinary story fields.

We do not use child profiles, names, stories, voices or listening activity for targeted advertising, and we do not sell them. Child and story information must not be added to Shopify, Klaviyo, Google, Meta, TikTok or affiliate-marketing profiles.

The ToyPal One device has no microphone or camera. The app is parent-managed. The public community feature is not live: there are no public child profiles, public feed or child-to-stranger chat. Voice cloning is not an active supported production feature.

We design child-facing services with high privacy settings by default and treat the child's best interests as a primary consideration.

3. Information we use

Website and security

We may process an IP address, device and browser information, request time, security events and privacy choice to operate and secure the website, prevent fraud and remember consent preferences.

Our lawful basis is our legitimate interest in operating a secure service, compliance with legal duties and, for storage that is strictly necessary, the applicable communications rules.

Optional analytics and advertising

If you consent, analytics providers may receive limited information about page visits, interactions, device/browser details and campaign source. If you separately consent to advertising technologies, advertising platforms may receive permitted product, cart, checkout and campaign events.

Microsoft Clarity is used for consented session replay, heatmaps and website-usability analysis. The website does not load Clarity until analytics consent is granted, passes the current consent state through Clarity Consent V2, and masks the story-demo, newsletter and contact regions. Child names, story choices, story text and audio are not intended to be included in recordings or analytics events.

Our lawful basis for non-essential cookies, pixels and similar technologies is consent. Declining them does not prevent ordinary access to the website or store. Child names, story choices, story text, audio and demo identifiers must not be included in these events.

Orders and customer service

When you buy from us or contact us, we may use your name, email, telephone number if supplied, billing and delivery address, order details, payment status, delivery records, support messages and returns or refund information.

We use this information to take payment, fulfil the order, provide support, handle returns, prevent fraud and meet accounting, tax, safety and consumer-law duties. Our lawful bases are performance of the contract, legal obligation and our legitimate interests in fraud prevention and legal claims.

ToyPal does not receive your complete payment-card details. Shopify and the payment method selected at checkout process the payment.

Marketing

If you sign up for news or lawfully agree to marketing during checkout, we use your email address, consent record, campaign engagement and suppression status to send and manage ToyPal marketing. We rely on consent or the limited UK soft opt-in only when all legal conditions are met.

You can unsubscribe using a link in a marketing message or by emailing support@toypal.ai. Order, security, safety and service messages are not marketing.

Website personalised-story sample

The free website sample asks an authorised adult for a child's first name or nickname, age band, pronoun and a selected story world. It does not require an account or email address.

ToyPal uses these details through its AWS-hosted service and OpenAI generation and narration services to create the requested temporary story and audio. Cloudflare Turnstile protects the form from automated abuse.

The demo service is configured to schedule story text and audio for expiry within 24 hours. A playback link expires after approximately 10 minutes. Separate pseudonymous security and service-control records are configured for limited periods: approximately two days for daily rate controls, approximately 62 days for service-budget controls and up to 90 days for deletion evidence. Those control records do not contain the finished story or audio. These are scheduled maximum lifecycles rather than a promise that deletion occurs at an exact second.

We derive a short-lived network control from a keyed hash of an IP network prefix. The raw address is not stored in the demo job record, but the pseudonymous control may still be personal information.

The story sample is not saved to the ToyPal app. It must remain excluded from advertising, email marketing and session-replay payloads.

We rely on the adult's request to provide the sample and our legitimate interests in safely operating and protecting the service. The adult confirmation does not enrol the child or adult into marketing.

Parent-managed ToyPal app

Depending on the released features an adult chooses to use, the app may process:

• the adult's name, email, login and account-recovery information;
• family roles, invitations and parent permissions;
• a child first name or nickname, age or age band, pronouns, language and parent-selected story preferences;
• selected or generated story text, narration and private playback status;
• app entitlement, store transaction and refund status without complete card details;
• app/device version, request identifiers, security events and push token where notifications are enabled; and
• support, consent and privacy-request records.

We use this information to provide and protect the adult-managed family service, deliver requested stories, enforce parent permissions, validate purchases, troubleshoot and comply with legal duties. Our lawful bases are contract with the adult, legitimate interests balanced against children's rights, legal obligation and consent where a feature requires it.

The base app and non-personalised story library are included without an app subscription. Voice cloning and public community features are not active. If either is introduced, we will provide specific information and obtain any additional permission required before activation.

The separate ToyPal App and Child Privacy Notice explains the current app providers, permissions, purchases, attribution, retention and deletion controls in more detail. The ToyPal App Terms explain the service rules.

4. Cookies, pixels and similar technologies

Strictly necessary technologies operate security, privacy choices, the cart and checkout. Analytics and advertising technologies are optional and remain off until the required consent is given.

The Cookie Notice identifies the current purposes and providers. A permanent Cookie preferences control lets you change or withdraw your choice. Withdrawing consent does not affect earlier processing that was lawful.

5. Who receives information

We share only what is necessary with service providers and recipients such as:

• Shopify, for the website, store, checkout, customer privacy controls and Shopify Email;
• payment providers selected at checkout;
• delivery, returns, support and professional-service providers;
• Amazon Web Services, for application and personalised-story infrastructure;
• Cloudflare, for Turnstile and service security;
• approved text, image or narration providers when an adult requests the related feature;
• Apple and Google, for app distribution, sign-in, store billing or notifications where those functions are used;
• Klaviyo, for consented email marketing and related forms;
• Google Analytics and Microsoft Clarity, only for consented website analytics, performance measurement, masked session replay and heatmaps;
• Google & YouTube, Meta and TikTok, only for permitted advertising and attribution events after the required consent;
• advisers, insurers, auditors, courts, law-enforcement bodies and regulators when required.

We do not disclose child profiles, story content, audio or private family information to advertising or email-marketing platforms. We do not sell personal information.

6. International transfers

Some providers may process information outside the United Kingdom. Where UK adequacy regulations do not apply, we use an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum, and assess the transfer where required.

Contact support@toypal.ai for information about safeguards relevant to your information.

7. How long we keep information

We keep information only for as long as needed for the purpose, legal obligations, product safety, fraud prevention or legal claims. We review the periods and delete or anonymise information when there is no continuing need.

• Website demo story text and audio: configured for scheduled expiry within 24 hours.
• Demo playback link: approximately 10 minutes.
• Demo rate control: approximately two days.
• Demo budget/service control: approximately 62 days.
• Demo deletion evidence: up to 90 days without the story or audio.
• Company tax and accounting records connected with an order: normally six years from the end of the relevant accounting period, or longer where law requires.
• Routine support records: normally three years after the matter closes; longer only where needed for product safety, an active dispute or a legal claim.
• Marketing consent: while relied on. A minimal suppression record is kept as necessary to honour an opt-out.
• Website analytics and advertising identifiers: according to the consented provider setting and the period stated in the Cookie Notice.
• Microsoft Clarity: ordinary playback data is normally retained for 30 days; aggregate click and heatmap data and labelled or favourited sessions may be retained for up to nine months under Microsoft’s current retention schedule.
• Adult and child app information: while the account or requested content remains active, followed by deletion, anonymisation or restricted retention according to the verified request and any legal need.
• Security logs and backups: for a limited documented cycle appropriate to the risk; deleted information is not restored into active use from a backup.

Where a deletion request cannot lawfully or technically be completed immediately, we will restrict ordinary use and explain what has been deleted, what remains, the reason and the expected expiry.

8. Your rights

Depending on the circumstances, UK data-protection law may give you rights to:

• receive information about processing;
• access personal information;
• correct inaccurate or incomplete information;
• request deletion;
• restrict or object to processing;
• receive certain information in a portable format;
• withdraw consent at any time; and
• object to direct marketing.

These rights are not absolute. We may need to verify identity and parental authority before disclosing or changing information about a child.

Email support@toypal.ai to exercise a right. We will respond within the period required by law.

9. Security

We use proportionate safeguards including encrypted transmission and storage where appropriate, access controls, separate environments, secrets management, short-lived private links, rate limits and supplier review. No internet service is completely secure. We assess incidents and notify affected people or regulators where the law requires.

10. Complaints

Please email support@toypal.ai first so we can investigate.

You can also complain to the UK Information Commissioner's Office. Current details are available at ico.org.uk/make-a-complaint.

11. Changes to this notice

We may update this notice when the service, providers or legal duties change. We will show the new date and give prominent notice of material changes. We will not treat silence or continued use as consent where a fresh choice is required.

12. Contact

Heartoid Ltd, trading as ToyPal
Company number: 14102802
338A Regents Park Road, Office 3 and 4
London, England, N3 2LN
Email: support@toypal.ai