Privacy Policy

This Privacy Policy explains how ToonCustoms ("we", "us", or "our") collects, uses, stores, and shares personal data when you use www.tooncustoms.com and related services (the "Service").

For privacy requests, contact us at orders@tooncustoms.com.

2.1 Information You Provide

• Account information: name, email address, and password (stored hashed).
• Photos: images you upload to generate Cartoon Portraits, stored temporarily in Cloudflare R2.
• Order & shipping details: product selection, shipping address for physical goods, and payment confirmation. Card details are processed by Stripe and are never stored on our servers.
• Support messages: content you send via support tickets or email.

2.2 Information Collected Automatically

• Usage data: pages visited, features used, referral source, and approximate location derived from IP (when analytics is enabled with your consent).
• Device & technical data: IP address, browser type, operating system, and device type for security, rate limiting, and diagnostics.
• Cookies & similar technologies: see Section 8.

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under these legal bases:

• Contract: to create your account, generate portraits, process orders, and provide downloads or shipping.
• Legitimate interests: to secure the Service, prevent fraud/abuse, and improve reliability (balanced against your rights).
• Consent: for non-essential cookies and analytics (e.g. Google Analytics). You may withdraw consent at any time via Cookie Settings.
• Legal obligation: where we must retain records for tax, accounting, or regulatory requirements.

• Provide, maintain, and improve the Service
• Generate AI Cartoon Portraits from your uploaded photos
• Process payments and fulfill digital or physical orders
• Send transactional emails (order confirmation, shipping updates, password resets)
• Respond to customer support inquiries
• Detect, prevent, and address fraud, abuse, or security incidents
• Measure site performance and usage with analytics only if you consent

We do not sell your personal information. We share data with processors only as needed to run the Service:

• Stripe — payment processing
• Cloudflare R2 — image storage
• Print / fulfillment partners — physical merchandise (shipping address and artwork)
• Resend — transactional email
• Neon (Postgres) — database hosting
• Fal.ai / AI providers — temporary image processing to generate portraits
• Vercel — hosting and edge delivery
• Google Analytics — usage analytics only with your cookie consent

We may disclose information if required by law, valid legal process, or to protect our rights and the safety of others.

Some providers may process data outside your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) offered by those providers.

Uploaded photos: Original photos are typically deleted from our servers 30 days after the order is created. Generated Cartoon Portraits may be retained as part of your order record so you can re-download or fulfill prints.

Account data: Kept while your account is active. You may request deletion at any time; we aim to delete account data within 30 days, subject to legal retention for payment records (often up to 7 years).

Cookie consent records: Stored in your browser (local storage) so we remember your choices.

Analytics data: Retained according to Google Analytics settings when you have consented to analytics cookies.

We use industry-standard measures including TLS for data in transit, access controls, and hashed passwords. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We use cookies and similar technologies in line with the EU ePrivacy Directive and GDPR. Non-essential cookies (including analytics) are set only after you give consent via our Cookie Banner.

8.1 Essential cookies

Required for the Service to work — for example authentication (session tokens), security, and remembering cookie preferences. These do not require consent.

8.2 Analytics cookies

If you opt in, we use Google Analytics (Measurement ID G-EBG3R3BP3F) to understand traffic and improve the product. Analytics cookies are disabled by default until you Accept or enable Analytics in Cookie Settings.

8.3 Advertising cookies

We do not currently use advertising or marketing cookies. If that changes, we will update this policy and request fresh consent where required.

8.4 Managing your choices

You can Accept all, Reject non-essential, or customize preferences in the Cookie Banner. You can change or withdraw consent anytime using Cookie Settings in the website footer. You may also block cookies in your browser; blocking essential cookies may prevent sign-in.

Depending on your location (including GDPR and CCPA/CPRA), you may have rights to:

• Access a copy of personal data we hold about you
• Rectify inaccurate data
• Erase data (subject to legal retention)
• Restrict or object to certain processing
• Portability — receive data in a structured, machine-readable format
• Withdraw consent for cookies/analytics at any time
• Opt out of sale/sharing — we do not sell personal information
• Lodge a complaint with your local data protection authority

To exercise these rights, email orders@tooncustoms.com. We will respond within 30 days where required by law.

If you are signed in, you may also use our self-service tools: GET /api/account/export to download a JSON copy of your account data, and POST /api/account/delete with { "confirmation": "DELETE" } to request account deletion. Payment-related order records may be retained in anonymized form as described in Section 6.

We and our processors may store or process data in the United States and other countries. Where GDPR applies to transfers outside the EEA/UK, we rely on appropriate transfer mechanisms provided by our vendors (including Standard Contractual Clauses where applicable).

The Service is not directed at children under 13 (or under 16 where a higher age of digital consent applies). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it promptly.

The Service may link to third-party sites (payment, shipping, social platforms). Their privacy practices are governed by their own policies. Review those policies before sharing personal information.

We may update this Privacy Policy from time to time. Material changes may be notified by email (if you have an account) or a notice on the website. The "Last updated" date at the top reflects the latest revision. Continued use after changes means you acknowledge the updated policy. For cookie category changes, we may ask for consent again.

Questions about this Privacy Policy or your data: orders@tooncustoms.com.