Privacy Policy

Last updated: April 4, 2026 · ToyTalk AI

ToyTalk AI ("we," "us," or "our") operates the website toytalkai.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read it carefully. If you disagree with anything in this policy, please discontinue use of the Service.

1. Information We Collect

1a. Information You Provide

• Photos & images — Photos you capture or upload are sent to our AI providers to generate animations and cartoon art. These are processed in real time and are not permanently stored on our servers. Our server-side proxy may temporarily cache images in memory (typically cleared within minutes) to facilitate processing.
• Child's name & toy name — Stored exclusively in your browser's local storage. Never transmitted to our servers.
• Voice audio — Processed entirely on-device via the browser's Web Speech API. We do not record, transmit, or store audio.
• Payment information — Handled entirely by our payment processor, Stripe, Inc. We never receive, process, or store your credit card number, bank account number, or other financial account details. See Section 5.
• Contact information — If you email us, we collect your email address and message content to respond to your inquiry.

1b. Information Collected Automatically

• Analytics data — We use Google Analytics 4 (GA4) to collect anonymized usage data including pages viewed, session duration, traffic source, device type, browser type, approximate geographic location (city/country level), and interactions with features. GA4 uses cookies and similar technologies. See Section 3.
• Advertising data — Google AdSense may collect information and use cookies to serve personalized or contextual ads. See Section 3.
• Custom event data — We track anonymized feature usage events (e.g., "cartoon generated," "animation started") to improve our Service. These events contain no personally identifiable information and are stored using Netlify Blobs.
• Log data — Our hosting provider (Netlify) automatically collects server logs including IP addresses, browser type, referring pages, and timestamps. These are used for security and performance monitoring.

2. How We Use Your Information

Purpose	Legal Basis (GDPR)
Animate your toy photo (D-ID)	Contract performance
Generate AI video (Kling AI / fal.ai)	Contract performance
Create cartoon art	Contract performance
Generate personalized AI messages (OpenAI)	Contract performance
Process payments (Stripe)	Contract performance
Display advertisements (Google AdSense)	Consent / Legitimate interest
Analyze usage to improve the Service (GA4)	Legitimate interest
Respond to support inquiries	Legitimate interest
Prevent fraud and abuse	Legitimate interest

We do not sell, rent, or trade your personal information to third parties.

3. Cookies & Tracking Technologies

Our Service uses the following cookies and tracking technologies:

Technology	Provider	Purpose	Duration
_ga, _ga_*	Google Analytics 4	Distinguish users, measure sessions and traffic sources	Up to 2 years
Advertising cookies	Google AdSense	Serve relevant advertisements and measure ad performance	Varies
__stripe_mid, __stripe_sid	Stripe	Fraud prevention during checkout	Session / 1 year
Local storage	ToyTalk AI	Store child name, toy name, Pro subscription status, and user preferences	Until cleared by user

You can manage cookies through your browser settings. Disabling cookies may affect the functionality of certain features. For Google's advertising cookies specifically, you can opt out at Google Ads Settings or NAI Opt-Out.

To opt out of Google Analytics tracking, install the Google Analytics Opt-out Browser Add-on.

4. Third-Party Services & International Data Transfers

We share data with the following third-party service providers to operate the Service. Your photos and data may be transferred to and processed in countries other than your own, including the United States and Israel:

Service	Purpose	Data Shared	Privacy Policy
D-ID (Israel)	Lip-sync animation	Photos	d-id.com/privacy-policy
Kling AI / fal.ai (US)	AI video generation	Photos	fal.ai/privacy
OpenAI (US)	AI message generation	Text prompts (child & toy name if provided)	openai.com/privacy
Stripe, Inc. (US)	Payment processing	Payment & billing info (direct to Stripe)	stripe.com/privacy
Google (US)	Analytics & advertising	Anonymized usage data, cookies	policies.google.com/privacy
Netlify (US)	Hosting & serverless functions	Server logs, request data	netlify.com/privacy

By using the Service, you consent to the transfer of your data to these providers. Where required by law (e.g., GDPR), these transfers are protected by Standard Contractual Clauses or equivalent safeguards maintained by each provider.

5. Payment Processing & Stripe

All payment transactions are handled by Stripe, Inc. When you subscribe to ToyTalk AI Pro, your payment details are submitted directly to Stripe's secure servers. We receive only a confirmation of payment status and a Stripe session ID — we never see or store your card details. Stripe's handling of your payment information is governed by Stripe's Privacy Policy. Stripe is PCI DSS Level 1 certified, the highest level of payment security certification.

6. Children's Privacy (COPPA Compliance)

ToyTalk AI is intended for use by adults on behalf of children. We do not knowingly collect personal information directly from children under 13 years of age. Parents and caregivers control the experience at all times.

• Photos are taken and submitted by the adult user, not the child.
• Child names are stored only in the adult's browser local storage — never on our servers.
• We do not require children to create accounts or provide personal information.
• We do not use behavioral advertising targeted at children.

If you believe we have inadvertently collected personal information from a child under 13, please contact us immediately at teddy@toytalkai.com and we will promptly delete it.

7. Your Privacy Rights

All Users

• Access — Request a copy of the personal data we hold about you.
• Deletion — Request deletion of your personal data. You can also clear all local data by clearing your browser's local storage for toytalkai.com.
• Correction — Request correction of inaccurate personal data.
• Opt-out of analytics — Use the Google Analytics Opt-out Add-on or disable cookies in your browser.

European Economic Area (GDPR)

If you are in the EEA, you have additional rights including the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority. Our legal bases for processing are set out in Section 2 above.

California Residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used.
• Request deletion of your personal information.
• Opt out of the "sale" or "sharing" of personal information. We do not sell personal information. Google AdSense may constitute "sharing" for cross-context behavioral advertising purposes. You may opt out via Google Ads Settings.
• Non-discrimination for exercising your privacy rights.

To exercise any of these rights, email teddy@toytalkai.com. We will respond within 30 days (45 days for CCPA requests as permitted by law).

8. Data Retention

• Photos and videos — Processed in real time. Server-side memory cache is cleared automatically (typically within minutes). No permanent server storage.
• Local storage data — Persists in your browser until you clear it. You can clear it at any time via your browser settings.
• Analytics data — Retained by Google Analytics for up to 14 months, per our GA4 configuration.
• Custom event data — Retained in Netlify Blobs for operational analytics. Does not contain personally identifiable information.
• Payment records — Retained by Stripe per their data retention policies and applicable financial regulations.
• Support emails — Retained as long as necessary to resolve your inquiry and for our records.

9. Data Security

We implement appropriate technical and organizational measures to protect your information:

• All data is transmitted over HTTPS/TLS encryption.
• API keys and secrets are stored server-side and proxied through Netlify Functions — never exposed to the browser.
• Payment processing is handled by PCI DSS Level 1 certified Stripe.
• We conduct regular reviews of our data practices.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

10. Do Not Track

Some browsers transmit a "Do Not Track" (DNT) signal. We currently do not respond to DNT signals. However, you can opt out of tracking using the methods described in Section 3.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Your continued use of the Service after changes constitutes acceptance of the revised policy. We encourage you to review this page periodically.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us:

Email: teddy@toytalkai.com
Website: toytalkai.com

← Back to ToyTalk AI