Privacy Policy

Data Controller: PeppyTiger Inc.

Registered in the State of Delaware, USA
Primary business activity within the European Union

Contact: info@peppytiger.com

We collect and process the following categories of personal data:

• Account Information: Name, email address, password (encrypted), account preferences
• Order & Delivery Data: Address, phone number (optional), payment confirmation (via third-party processors)
• Personalization Content: Child's first name, uploaded drawings, photos, and any text submitted for the book
• Technical Data: IP address, browser type, device and OS, site usage data, cookies (see our Cookie Policy)
• Marketing & Communication Preferences
• Consent Records: Timestamp, consent type, version, and method

This list is representative but not exhaustive.

PeppyTiger processes personal data in accordance with applicable data protection laws, including the European Union's General Data Protection Regulation (GDPR) and the Delaware Personal Data Privacy Act (DPDPA). Our data processing activities are grounded in one or more of the following legal bases:

Consent

We process personal data when we have obtained clear and affirmative consent from the individual. This applies to activities such as sending marketing communications, using personal data for personalization features, or processing sensitive information.

Contractual Necessity

Processing is necessary for the performance of a contract to which the individual is a party, or to take steps at the request of the individual prior to entering into a contract. For example, we process personal data to fulfill orders, provide customer support, and deliver our services.

Legal Obligation

We process personal data to comply with legal obligations to which we are subject. This includes obligations related to tax laws, accounting requirements, and other regulatory compliance measures.

Legitimate Interests

Processing is necessary for our legitimate interests or those of a third party, provided these interests are not overridden by the individual's rights and interests. This may include activities such as improving our services, preventing fraud, and ensuring the security of our systems.

Under the DPDPA, we also adhere to principles such as data minimization, purpose limitation, and the requirement to obtain consent before processing sensitive data, including data concerning children. We ensure that all data processing activities are conducted transparently and in accordance with the rights afforded to individuals under applicable laws.

At PeppyTiger, we are committed to using your personal data responsibly and transparently. We collect and process personal information solely for purposes that are clearly communicated to you, such as fulfilling orders, providing customer support, enhancing our services, and, where applicable, sending marketing communications with your explicit consent.

In alignment with the principles of data minimization and purpose limitation under GDPR and DPDPA, we ensure that the personal data we collect is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. We do not sell your personal data to third parties.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. The specific retention period depends on the nature of the data and the context in which it was collected. Once the data is no longer needed for these purposes, we will securely delete or anonymize it, unless we are required by law to retain it for a longer period.

For instance, transaction records may be retained for a period mandated by tax laws, while other data related to your interactions with our services will be kept only as long as necessary to provide you with those services. We regularly review our data retention practices to ensure compliance with applicable laws and regulations.

If you have any questions about our data retention policies or wish to request the deletion of your personal data, please contact us at info@peppytiger.com.

We use your personal data to:

• Process and fulfill your orders
• Provide customer support
• Improve our platform and services
• Train personalization models (only with consent)
• Send marketing communications (only with consent)
• Comply with legal obligations

This list is representative, but not exhaustive.

If you upload a child's name, image, or drawing, you confirm you are the child's parent or legal guardian or have verifiable authorization to do so.

We do not knowingly collect data directly from children under 13. All data must be submitted by a parent or legal guardian. For users in jurisdictions with higher age thresholds, we rely on verifiable parental consent.

You accept full legal responsibility for the legality and accuracy of child-related content uploaded to our service.

PeppyTiger retains personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Privacy Policy. This includes providing our services, complying with legal obligations, resolving disputes, and enforcing our agreements.

In accordance with the GDPR's principle of storage limitation (Article 5(1)(e)) and the DPDPA's data minimization requirements, we regularly review the personal data we hold to ensure that it is accurate, up-to-date, and still required. When personal data is no longer necessary for these purposes, we securely delete or anonymize it.

We do not retain personal data indefinitely. The specific retention period depends on the nature of the data and the context in which it was collected. For example, transaction records may be retained for a period mandated by tax laws, while other data related to your interactions with our services will be kept only as long as necessary to provide you with those services, as well as for improvement of our future performance.

PeppyTiger does not sell personal data to third parties. We may share personal data with service providers who perform services on our behalf, such as payment processing and order fulfillment, but only as necessary to perform these services and in accordance with our instructions and applicable data protection laws.

If you have any questions about our data retention practices or wish to request the deletion of your personal data, please contact us at info@peppytiger.com.

We share your data only as necessary with:

• Payment processors (e.g., Stripe, PayPal)
• Printing and logistics partners (to produce and deliver your order)
• Cloud service providers (e.g., AWS, Google Cloud)
• Marketing tools (only with consent)
• Legal authorities, if required
• MoreTrees (moretrees.eco): we provide your name, surname, and email address so they can send you a personalized tree-planting certificate as proof of your contribution
• Printing and logistics partners such as Lulu (lulu.com) to produce, print, and deliver your order. Please note that Lulu may in turn share certain information with their own third-party service providers (e.g., couriers, logistics partners) in order to fulfill your order. We are not responsible or liable for the processing practices of such third parties once your data has been lawfully transferred to Lulu.

All partners are bound by strict data protection agreements and, where applicable, standard contractual clauses.

PeppyTiger may use anonymized or pseudonymized user content (e.g., names, photos, drawings) to improve its personalization tools and train AI models.

You may withdraw this consent at any time by contacting us. Past training already completed cannot be reversed.

Under GDPR and DPDPA, you have the right to:

• Access your data
• Correct inaccuracies
• Delete your data (“right to be forgotten”)
• Withdraw consent at any time
• Object to certain types of processing
• Port your data
• Lodge a complaint with your local data protection authority

In Belgium, contact: Gegevensbeschermingsautoriteit / Autorité de protection des données — gegevensbeschermingsautoriteit.be

In Delaware, contact: Delaware Department of Justice — attorneygeneral.delaware.gov

If you have any questions about our data retention practices or wish to request the deletion of your personal data, please contact us at info@peppytiger.com.

With your consent, we may send you updates, promotions, or new product info. You can opt out:

• At any time via unsubscribe links
• By updating your preferences in your account (if applicable)
• By emailing us at info@peppytiger.com

We may update this Privacy Policy at any time. Changes become effective upon posting. Continued use of our service means you accept the new version.

If you have any questions or wish to exercise your rights, contact us at info@peppytiger.com.