Tiny Tales Club – Privacy Policy
Last updated: 7 May 2025

This Privacy Policy explains how Pinjatic LTD (trading as “Tiny Tales Club,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you visit tinytales.club, purchase a fully personalised children’s book, or otherwise interact with us.
It is written to comply with:

• COPPA (Children’s Online Privacy Protection Act, U.S. Federal Trade Commission)
• UK & EU GDPR (including Article 13 transparency requirements)
• CCPA/CPRA (California Consumer Privacy Act as amended by the California Privacy Rights Act)

For a parent-friendly summary of how we handle children’s information, see ourKids’ Privacy Notice.

1. Who We Are

Pinjatic LTD
71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Company No. 13405158 (England & Wales)
E-mail: support@tinytales.club

We are the “controller” under UK/EU GDPR and the “business” under CCPA/CPRA.

2. What Personal Information We Collect

2.1 Information You Provide to Us

• Parent contact & order details – name, e-mail, postal address, phone (optional), payment information.
• Child personalisation details – first name, age, chosen pronouns (optional), interests, photo(s).
• Sidekicks (optional) – name/nickname, short description, photo(s).
• Story ideas (optional) – prompts or themes you type in a free-text box.

2.2 Automatically Collected Data

• Device identifiers, browser type, IP address, cookies and analytics events (via Shopify and our analytics provider).

2.3 Categories for CCPA/CPRA

Identifiers; customer records; commercial information; Internet or other electronic-network activity; audio/visual information (photos you upload); and inferences created solely to fulfil your order. We do not collect precise geolocation, health, or biometric data.

3. How & Why We Use Personal Information

• To create your personalised book – generating artwork and story text with AI tools, laying out pages, printing, and shipping.
• Payment processing & fraud prevention – via Shopify Payments/Stripe or PayPal.
• Customer service – order confirmations, shipping updates, support e-mails.
• Analytics & site security – to improve our store and protect it from abuse.
• Legal & compliance – accounting, tax, and to meet regulatory obligations.

Legal Bases (UK/EU GDPR)

• Consent – processing a child’s personal data (verifiable parental consent), marketing e-mails.
• Contract – to fulfil your purchase and ship the book.
• Legitimate interests – site security, fraud prevention, business analytics.
• Legal obligation – tax and bookkeeping laws.

4. Who We Share Information With

We never sell or rent personal information. We disclose it only to the service providers (“operators” under COPPA) needed to run our service:

• Shopify Inc. – storefront hosting & checkout.
• OpenAI LLC – AI image & text generation.
• Lulu Press, Inc. (“Lulu”) – print-on-demand production & global distribution.
• Gelato ASA – print-on-demand production & global distribution.
• Payment processors – Shopify Payments (Stripe), PayPal.
• Shipping carriers – Royal Mail, USPS, DHL, or local partners.
• Professional advisers & authorities – where required by law.

All operators are bound by contracts limiting their use of the data to our instructions and prohibiting further disclosure.

5. International Transfers

We are located in the UK. When we transfer personal information to the United States (e.g., to OpenAI or Lulu), we rely on the UK/EU Standard Contractual Clauses and other legally recognised safeguards.

6. Data Retention

• Order records – 7 years (legal/accounting).
• Child’s original photo – deleted 30 days after your book ships.
• Generated cartoon images & story files – kept for 1 years so you can reorder, then deleted.
• Customer-service correspondence – 2 years.
• Analytics data – 26 months (Google Analytics standard).

7. Security

We use HTTPS, encryption at rest and in transit, strict access controls, and regular security audits. No Internet transmission is 100 % secure, so please contact us immediately if you believe your data or account has been compromised.

8. Your Rights & Choices

8.1 Parents & Children (COPPA)

See our Kids’ Privacy Notice for how parents can review, delete, or refuse further use of their child’s data.

8.2 UK/EU Residents

You have the right to access, rectify, erase, restrict, or object to our processing, and to data portability. You may withdraw consent at any time. To exercise these rights, e-mail support@tinytales.club. You may also complain to your local data-protection authority; in the UK this is the Information Commissioner’s Office (ico.org.uk).

8.3 California Residents

Under CCPA/CPRA you may:

• Request to know, access, or receive a copy of your personal information.
• Request deletion (subject to exemptions).
• Request correction.
• Opt-out of the “sale” or “sharing” of personal information for cross-context behavioural advertising (we do not currently sell or share in this way).
• Limit the use of “sensitive” personal information (we use it only to fulfil your order).

Submit requests via support@tinytales.club. You will not be discriminated against for exercising any CCPA rights.

9. Cookies & Similar Technologies

We use essential cookies for site functionality and analytics cookies to understand how visitors use our store. You can control cookies through your browser settings and opt-out of Google Analytics via its browser add-on.

10. Kids’ Privacy Notice (COPPA-Friendly)

10.1 Why We Need Your Child’s Information

Dear parents and guardians: to turn your child into the hero of their very own storybook, we ask for a few details (name, age, interests) and, if you like, a photo – so we can draw a fun cartoon version of them. Providing a photo is optional but makes the book extra special.

10.2 What We Collect

• First name (and optional nickname)
• Age or birthday month/year
• Likes and interests (e.g., dinosaurs, ballet)
• Photo(s) you upload
• Optional “sidekick” details (pet, sibling, friend)

10.3 Who Helps Us (Create & Deliver the Book)

Our trusted helpers (“operators” under COPPA) are:

• OpenAI LLC – transforms photos into cartoons & helps write the story.
• Lulu Press, Inc. – prints and ships the physical book.
• Gelato ASA – print-on-demand production & global distribution.
• Shopify Inc. – runs our online store and checkout.
• Payment processors – handle your payment securely.
• Shipping companies – deliver the book to your door.

10.4 Your Privacy Choices & Parental Controls

• Review or delete – E-mail us anytime to see what we have or ask us to delete it.
• Stop further use – You can tell us not to use your child’s info for new books.
• No accounts for kids – Only adults can place orders; children cannot create accounts.
• Photo deletion – Original photos are deleted 30 days after shipping.

10.5 How to Reach Us

Questions? Write to support@tinytales.club or by post to the address above. Attn: Privacy Team.

11. Changes to This Policy

We will post any future updates here and, if they are material, notify you by e-mail (if we have it) or through a notice on our website. The “Last updated” date at the top tells you when it was last revised.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please e-mail support@tinytales.club or write to:
Privacy Team, Pinjatic LTD, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, UK

Do Not Sell or Share My Personal Information (CA residents)