Privacy policy

Information you give us

• Account details — your name, email address, phone number and WhatsApp number.
• Delivery details — your address, the area you live in, any delivery or parking instructions, a safe place if you set one, and an alternate contact number.
• Your children’s details — first name, date of birth, gender and play preferences. See § 03.
• Messages — anything you send us on WhatsApp, by email, or through the website.

Information we generate

• Your rental history — which toys you reserved, kept, returned or bought, and when.
• Delivery records — scheduled slots, driver notes, and photographs taken at delivery, collection or inspection (see § 09).
• Approximate coordinates — we convert your address into map coordinates so we can plan efficient driver routes. We do not track your device location.
• Billing records — invoices, payment outcomes and any charges for missing or damaged parts.

Information collected automatically

When you visit our website we record standard technical data such as your IP address, browser and pages viewed, and we note how you found us (for example a referral code or the advertising campaign you clicked). This helps us understand what works and keep the site secure.

Our service is bought by adults, for children. We ask for a child’s first name, date of birth, gender and play preferences for one reason: to send age-appropriate toys and to make sensible recommendations. A toy suitable for a five-year-old can be a choking hazard for a one-year-old, so the date of birth is a safety control, not a marketing field.

We do not build advertising profiles of children, we do not share children’s details with advertisers, and children do not have accounts with us. The account belongs to the parent or guardian, who can view, correct or remove a child’s details at any time from the portal, or by emailing us.

• To run your subscription — reserving toys, scheduling deliveries and collections, and processing payments.
• To talk to you — delivery notifications, exchange reminders, billing notices and answers to your questions.
• To keep children safe — matching toys to the right age group and checking returned toys for missing or broken parts.
• To improve the service — understanding which toys are popular and where our operation falls short.
• To meet our legal and accounting obligations, and to detect fraud or abuse of the service.

We rely on the contract between us for most of this. Where we send optional marketing, we rely on your consent, and you can withdraw it at any time.

We use artificial intelligence to help handle customer messages. When you write to us on WhatsApp, your message and the recent history of your conversation may be processed by a third-party AI model to draft a reply and to look up the relevant details of your account. We will always tell you honestly that you are talking to an AI assistant if you ask.

A human reviews and approves replies before they are sent in the situations that matter — anything involving money, account changes or a complaint. Decisions with a financial effect on you, such as a charge for a missing part, are not made by AI alone.

We also use automated systems to plan delivery routes and to decide when to send reminders. You can ask us to review any automated outcome by emailing [email protected].

WhatsApp is our main channel for delivery updates and support. Messages between you and KIDDOS are delivered through the WhatsApp Business Platform, operated by Meta, and are subject to Meta’s own privacy terms as well as this policy. We store the content of those conversations so that our team can see the history when helping you.

Service messages relate to your subscription — deliveries, payments, returns. If we also send you promotional messages, you can opt out of those at any time by replying to tell us, without affecting the operational messages you need to receive.

Payments are processed by Stripe. Your full card number never reaches our systems and we cannot see it — we hold only a reference to your customer record at Stripe, the last four digits, the card brand and the outcome of each payment. Stripe processes your payment details as a separate controller under its own privacy policy.

If you have opted in, we send occasional emails about new toys and offers. Every marketing email has an unsubscribe link, and unsubscribing does not stop the operational messages about your deliveries and billing.

We advertise on Facebook and Instagram. To measure whether those ads work, we may share a securely hashed version of your email address or phone number with Meta so it can tell us that a signup came from an ad. The hashing means Meta receives a scrambled value rather than your actual contact details. We never share your children’s information for advertising.

Our drivers and warehouse team photograph toys — at delivery to confirm what was handed over, at collection, and during inspection to record a missing or damaged part. These photos are of toys and packaging, not of people, and we ask our team not to capture children, faces or the inside of your home.

If you send us a photograph of a toy to report a problem, we store it with that report so we can resolve it fairly. You can ask us to delete a photo you have sent us.

We do not sell your personal information. We share it only with the service providers we need to run KIDDOS, and only as far as each one needs:

• Supabase — hosts our database and stored files.
• Stripe — payments and invoicing.
• Meta Platforms — WhatsApp message delivery, and advertising measurement as described in § 08.
• Amazon Web Services — sends our transactional email.
• AI model providers — process message content to draft support replies, as described in § 05.
• Our hosting providers — run the website and member portal.
• Our delivery team — sees the name, address, contact number and delivery instructions needed to complete your delivery, and nothing more.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

KIDDOS operates from the United Arab Emirates, but several of the providers above store or process data outside the UAE, including in the European Union and the United States. Where that happens we rely on the provider’s contractual data protection commitments to keep your information protected to a comparable standard.

We keep your account and rental history for as long as you are a member. If you cancel, we keep the records needed to meet our accounting and tax obligations, and to resolve any outstanding question about a return or a charge, and then delete or anonymise the rest.

Message history and delivery photographs are kept while they are useful for supporting you and settling disputes. You can ask us to delete your account sooner — see § 13.

You can ask us to:

• give you a copy of the personal information we hold about you and your children;
• correct anything that is wrong or out of date;
• delete your information, where we are not required to keep it;
• stop sending you marketing, or stop processing your information for a particular purpose;
• have a human review an outcome that was reached automatically.

Most of this you can do yourself from the portal. For anything else, email [email protected] and we will respond within 30 days. We may need to confirm your identity first — that protects you, not us.

Access to customer data is restricted to the people who need it, protected by individual accounts, and encrypted in transit. Payment card details are handled entirely by Stripe and never stored on our systems.

No system is perfectly secure. If a breach ever affects your personal information in a way that puts you at risk, we will tell you and the relevant authority promptly rather than quietly.

We use cookies and similar technologies to keep you signed in, to remember your preferences, to understand how the site is used, and to measure our advertising. You can block or delete cookies in your browser settings, though signing in will not work properly without the essential ones.

We may update this policy from time to time. If a change materially affects how we handle your information, we will tell active members by email rather than relying on you to notice.

Creative Generation Trading LLC, Dubai, United Arab Emirates. Privacy questions and requests: [email protected].