Privacy Policy - TOY R&D

Privacy Policy

Last updated: 30 August 2026.

This Privacy Policy describes how TOY R&D (“we”, “us”, “our”) collects, uses and protects information when you visit toyrd.com, purchase a Quick Review or submit project materials.

1. Information we collect

Server logs: IP address, browser type, referring page and timestamps, retained on a short rolling basis for security and abuse prevention.
Analytics: aggregated page-view and usage information from TOY R&D’s self-hosted analytics. We do not use advertising networks to profile visitors.
Contact information: information you provide through email, comments, contact forms or checkout, including name, email address, billing country and payment/order identifiers.
Quick Review materials: the project stage, issue category, question, context, requested decision and any files you choose to submit.
Cookies: functional WordPress and WooCommerce cookies used for sessions, cart state, checkout, security and administration. PayPal may set its own cookies when its payment interface is loaded or used.

2. Payments

Payments are processed by PayPal through the official WooCommerce PayPal Payments integration. TOY R&D receives transaction status, payer and order details needed to provide the service and handle refunds. TOY R&D does not store full payment-card numbers or PayPal passwords. PayPal processes payment information under its own privacy terms.

3. How we use information

To operate, secure and improve the site.
To process orders, payments, refunds and customer emails.
To perform and deliver the Quick Review requested by the customer.
To respond to legitimate inquiries and exercise data rights.
To prevent fraud, abuse and unauthorized access.
To maintain payment and accounting records where required.

4. Quick Review file security

Quick Review attachments are stored in a restricted directory outside the public WordPress document root. They are not added to the Media Library and do not receive public URLs. Access is limited to the authorized TOY R&D administrator through a logged and permission-checked order screen.

Customers must not submit files belonging to an employer, client, supplier or other third party unless they have permission to share them. TOY R&D does not use submitted project material in articles, training data, publicity or case studies without separate written permission.

5. Data retention

Quick Review attachments are deleted 90 days after delivery. For an order that is not completed, attachments are deleted no later than 180 days after submission.
The submitted consultation text is deleted 12 months after delivery.
Payment and order metadata may be retained for up to seven years for accounting, dispute and record-keeping purposes.
Server logs are rotated on a short rolling schedule. Contact messages are retained only as long as reasonably needed for the inquiry.
Deleted information may remain in limited, access-controlled infrastructure backups until the applicable backup rotation completes.

6. What we do not do

We do not sell, rent or trade personal data.
We do not run advertising networks that profile individual visitors.
We do not import employer, client, supplier or third-party contact lists into TOY R&D.
We do not publish identifiable project material submitted for a Quick Review without separate written permission.

7. Service providers and international processing

Information may be processed by service providers needed to run the site, including the web host, email infrastructure and PayPal. Because TOY R&D serves international customers, transaction and communication data may be processed outside your country. Each provider handles data under its own terms and legal obligations.

8. Your choices and rights

You may request access to, correction of or deletion of personal information you submitted by emailing hello@toyrd.com. Some payment and order records may need to be retained for accounting, fraud prevention, legal claims or regulatory obligations. We will explain any applicable limitation.

9. External links

TOY R&D may link to external sites and resources. We are not responsible for their content or privacy practices.

10. Changes and contact

We may update this policy as the site develops. Material changes will be reflected by the date above. Privacy questions can be sent to hello@toyrd.com.

Article feedback

You can tell us whether an article was helpful without creating an account. You may also choose a reason or leave up to 500 characters of optional text. Feedback and counts are visible only to site administrators; feedback is not published as comments. Please leave out advertising, links and contact details.

When you interact with article feedback, this browser stores a random feedback identifier and your article choices. We keep a separate keyed identifier for each article to prevent duplicate votes and let you change your choice. Clearing browser storage or using another browser creates a new identity. If local storage is unavailable, the identity lasts only for the current page.

Feedback works when you decline visit analytics. Only when visit analytics is currently allowed may a new feedback record be linked to the existing anonymous analytics identifier, so we can compare helpful feedback with measured visits. We do not later link feedback originally submitted without analytics permission. Feedback reasons and text are never sent to visit analytics or an external spam-checking service.

Local safeguards check submission credentials, request frequency and potential advertising. Short-lived keyed IP summaries are used for rate limits and are removed within 24 hours; this feature does not permanently store raw IP addresses. Existing server security logs are separate. Suspected spam is kept outside normal feedback and statistics for review, with at most 1,000 records retained for up to 30 days. Administrators can restore mistakes or delete spam. Minimal article-specific identifier records remain after deletion to prevent resubmission; deleted text and analytics links are removed.

Analytics links in feedback are removed after 90 days. Normal written feedback is removed after 365 days from its last text update. Article choices and reason categories remain to support content improvement. Rate limits may temporarily pause written feedback while choices and reason selection remain available. Contact us using the address in this policy if you need help with your data.

Contact form submissions

The Contact form collects your name or nickname, email address and message, plus your company or organization and inquiry type if you choose to provide them. When you follow an article’s feedback link, we also include that article’s title and URL. Accepted messages are stored privately in our WordPress database and sent to our contact mailbox so we can review and respond to them. Contacting us does not subscribe you to a newsletter, and we do not publish your message without separate permission.

We use Cloudflare Turnstile to check for automated submissions and record the submitting IP address to limit repeated messages. Each entry also records the submission page and time, browser and device or operating-system information, and an approximate country when provided by network headers. If you are already signed into this site, the entry is associated with your site account. Turnstile processes browser and network signals under Cloudflare’s Privacy Policy. The form does not ask for a phone number, request browser location access or accept attachments. Messages and their associated records are kept only as long as reasonably needed to handle the inquiry and prevent abuse. You can request access, correction or deletion by emailing hello@toyrd.com; copies in the mailbox and protected backups follow their respective retention processes.