Last updated: 16 February 2026.
Toodaloo is the data controller for everything you share with us. If you have a privacy question or data request, use our contact page and include your order number (if relevant) and the email you used at checkout.
What data we collect
We collect the details you provide at checkout, payment confirmations from our payment provider, the photos and text you upload for your book, customer support messages, and technical logs needed to keep the service secure and reliable.
If you accept optional cookies, we also collect analytics and marketing data (see our cookie policy).
How we use your data
We use your data to make and deliver your book, personalise the cover, answer support requests, meet legal and tax obligations, and send optional emails if you opt in.
Lawful bases: Contract (order production/delivery), Legitimate interests (service improvements, abuse prevention), Consent (marketing emails and non-essential cookies).
How we handle your photos
Photos go through our automated preview pipeline to create colouring pages.
Uploaded photos, generated previews, and related production assets are deleted within 30 days after shipping unless you ask us to remove them sooner.
Who we share data with
Service providers we rely on: Shopify (checkout and payment handling), Supabase (secure storage and metadata), UK print and delivery partners (to make and ship your book), and email/analytics tools (to send order updates and understand site performance).
Each provider only uses your data to deliver the service we hire them for and cannot sell or reuse it for their own purposes.
Cookies and tracking
We use essential cookies so the site works, plus optional analytics and marketing cookies if you accept them. You can change your settings in the banner or your browser.
How long we keep your data
Orders, invoices, and tax records: up to 7 years (legal requirement).
Uploaded photos, generated previews, and production assets: up to 30 days after your book ships (deleted sooner on request).
Support messages: 12 months.
Marketing preferences: until you unsubscribe.
Your rights
You can ask for a copy of your data, correct or delete it, withdraw consent, object to how we use it, or lodge a complaint with the ICO(opens in new window).
We aim to acknowledge privacy requests within two working days and complete them within one calendar month where legally required.
Use our contact page or raise a complaint with the ICO(opens in new window).
Updates to this policy
We update this page when we launch new features or change suppliers. If a change materially affects how we use your data, we will notify you on the site.