Privacy Policy
Last updated: 6 August 2026
ToysAI is a chat-first toy shopping service for families in Singapore. This policy explains what personal data we collect, why we collect it, and the choices you have. We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA).
Who we are
ToysAI operates the website at www.toysai.org and the conversational shopping assistant known as Miko. In this policy, "we", "us", and "our" refer to ToysAI. If you need to reach our data protection contact, email [email protected].
A note about children
ToysAI is designed for adults shopping for children. It is not directed at children, and we do not knowingly collect personal data from anyone under 13. We ask that you describe a child in general terms, such as age, interests, and developmental goals. Please do not enter a child's full name, school, address, photograph, or medical information into the conversation. If you believe a child has provided us personal data, contact [email protected] and we will delete it.
What we collect
| Category | What it includes | Why we collect it |
|---|---|---|
| Account data | Your Google account identifier, email address, and display name, if you choose to sign in with Google | To sign you in, keep your session, and apply fair-use limits on Miko |
| Conversation data | Messages you send to Miko and the recommendations returned | To generate relevant toy recommendations and maintain context within a conversation |
| Basket and order data | Items in your basket, order contents, order value, customer email, and delivery address | To reserve stock, process your order, and arrange delivery |
| Payment data | Payment status and references returned by our payment provider | To confirm payment and handle refunds. We never receive or store your full card number |
| Technical data | IP address, browser type, device information, and security and error logs | To keep the service available, prevent abuse, and diagnose faults |
| Affiliate referral data | Clicks on affiliate links and resulting attribution signals | To credit ToysAI for referred purchases. See our Affiliate Disclosure |
How we use personal data
- To operate the conversation with Miko and produce toy recommendations.
- To manage your basket, reserve stock, take payment, and fulfil and deliver orders.
- To provide customer support and respond to your questions.
- To enforce fair-use limits and protect the service against fraud, abuse, and security threats.
- To measure whether a purchase was referred through an affiliate link.
- To meet legal, tax, and accounting obligations.
We do not sell your personal data. We do not use your conversations to build advertising profiles about you.
Who we share it with
We share personal data only with service providers who help us run ToysAI, and only as far as they need it:
- Payment processing — Stripe, to take payment and process refunds. Card details are entered directly with Stripe and are never held by us.
- Sign-in — Google, if you choose to sign in with a Google account.
- AI processing — Microsoft Azure AI Foundry, which generates Miko's responses from the messages you send.
- Hosting and infrastructure — Microsoft Azure and Cloudflare for hosting, content delivery, and protection against attacks, and Neon for our database.
- Affiliate networks — including Impact.com, Amazon.sg Associates, and Shopee Affiliate, for referral attribution.
We may also disclose personal data where we are required to by law, a court, or a regulator, or to establish or defend legal claims.
International transfers
Some of these providers process data outside Singapore. Where personal data is transferred overseas, we take reasonable steps to ensure it receives a standard of protection comparable to the PDPA, including through contractual commitments with our providers.
How long we keep it
- Order and payment records are kept for as long as needed to meet Singapore tax and accounting requirements.
- Conversation data is kept while it is useful for the shopping session and service quality, then deleted or de-identified.
- Account data is kept while your account is active. If you ask us to delete your account, we remove it except where we must retain records by law.
- Security and error logs are kept for a limited period for troubleshooting and abuse prevention.
How we protect it
We use encryption in transit, access controls, credential rotation, and separation between our public and internal services. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the sensitivity of the data.
Cookies and similar technologies
We use a small number of cookies and browser storage entries:
- Essential — to keep you signed in, hold your basket, and secure your session. The service cannot work without these.
- Preferences — to remember choices such as light or dark theme.
- Affiliate attribution — set by affiliate networks to credit a referred purchase.
You can block or delete cookies in your browser settings. Blocking essential cookies will stop sign-in and checkout from working.
Your rights under the PDPA
You may, at any time:
- Access the personal data we hold about you and ask how it has been used or disclosed in the past year.
- Correct personal data that is inaccurate or incomplete.
- Withdraw consent to our collection, use, or disclosure of your personal data.
- Request deletion of your account and associated data.
Send requests to [email protected]. We will respond within a reasonable time, and normally within 30 days. Withdrawing consent may mean we can no longer provide parts of the service, such as checkout, and we will tell you if that is the case.
Changes to this policy
We may update this policy as ToysAI develops. We will change the "last updated" date above, and for significant changes we will give notice in the service before the change takes effect.
Contact
For any privacy question or request, email [email protected]. If you are not satisfied with our response, you may contact Singapore's Personal Data Protection Commission at www.pdpc.gov.sg.