Last updated: 24 October 2026.
What changed on 24 October 2026: if you accept analytics, we now record how visitors use our site with PostHog, so we can improve it. We mask personal data.
Toodaloo is the data controller for everything you share with us. If you have a privacy question or data request, use our contact page and include your order number (if relevant) and the email you used at checkout.
What data we collect
We collect the details you provide at checkout, payment confirmations from our payment provider, the photos and text you upload for your book, customer support messages, and technical logs needed to keep the service secure and reliable.
When you start a book, we note how you found us (for example, the website, campaign link or ad click that sent you) and keep it with your book and any order you place.
If you accept optional cookies, we also collect analytics and marketing data through them (see our cookie policy). Noting how you found us does not use cookies.
If you accept analytics cookies, Google Analytics also records basic details of any order you place, such as its value and what you bought. It never receives your name, contact details or anything you wrote in your book.
If you accept analytics, we also use PostHog to record how visitors use our site, so we can improve it. We mask personal data in these recordings.
How we use your data
We use your data to make and deliver your book, personalise the cover, answer support requests, meet legal and tax obligations, and send optional emails if you opt in.
Lawful bases: Contract (order production/delivery), Legitimate interests (service improvements, abuse prevention, understanding how customers find us, asking for an honest review of your order), Consent (marketing emails, non-essential cookies and advertising).
After your order has been posted, we may ask you for an honest review of it. The email contains no offers.
How we handle your photos
Photos go through our automated preview pipeline to create colouring pages.
If you do not complete an order, your uploaded photos and previews are kept for 14 days so you can come back and finish, then deleted. If you do order, we keep your uploaded photos and the print-ready master files for 12 months from when you upload them, so we can reprint or correct your book, and then delete them. We keep the finished book file itself (the exact pages we printed) permanently, so you can reorder an identical copy in future. You can ask us to delete any of these sooner at any time.
Photographs of children
Most books are made from photographs of children, uploaded by a parent or guardian. If you upload a photo of a child, you are confirming that you are their parent or guardian, or that you have that person's permission.
We use the photos only to make your book and for nothing else: we do not use them to train our software, we do not use them in our own marketing, and only the providers described below handle them. Our service is for adults; you must be 18 or over to place an order.
Who we share data with
We share your data only with the providers we need to run the service: our checkout and payment provider, cloud storage and hosting providers, an image-processing provider that turns your photos into colouring pages, our website delivery providers, UK print and delivery partners, email and analytics providers, and a review service. If you accept marketing cookies, we also share data with advertising partners (see "Advertising").
Each provider only uses your data to deliver the service we hire them for and cannot sell or reuse it for their own purposes. Our advertising partners may be the exception: some also use it for their own advertising (see "Advertising").
To ask for a review, we pass your name, email address and order number to Trustpilot, an independent review service, which emails you on our behalf. You do not have to leave a review. To stop these emails, use the unsubscribe link in the email or contact us. If you choose to write a review, Trustpilot's own privacy policy covers what you post there.
Advertising
If you accept marketing cookies, our advertising partners (listed in our cookie policy) receive information about how you use our shopping pages, such as the pages and products you view, and technical details such as your IP address and browser. They may also receive details of your order and identifiers that help them measure our ads, such as the ad you clicked or a scrambled (hashed) copy of your email address, for example when you buy or sign up to our newsletter. We keep identifiers linked to your order for as long as we keep the order, except the ad click details we note when you start a book, which we delete within 90 days. If you also accept analytics cookies, Google may use Google Analytics data for advertising.
We do this only with your consent. Depending on the partner and the data, a partner acts either jointly with us (we are responsible for telling you about it and asking your consent, the partner for what it does with the data afterwards, and you can exercise your rights with either of us), independently, or on our behalf to measure our ads. Our partners may process data outside the UK, including in the United States, under safeguards recognised under UK data-protection law.
You can withdraw consent at any time with the "Manage cookie preferences" button on our cookie policy page. This stops future sharing but cannot recall data already sent.
Where your data is processed
We are based in the UK. PostHog data is processed in its EU cloud region. Some of our other providers process data outside the UK, including in the United States. Where that happens we use safeguards recognised under UK data-protection law so your data stays protected to UK standards. Details are available through the contact route in the “Your rights” section.
Cookies and tracking
We use essential cookies so the site works, plus optional analytics and marketing cookies if you accept them. You can change your choices at any time with the "Manage cookie preferences" button on our cookie policy page, or in your browser.
How long we keep your data
Orders, invoices, and tax records: up to 7 years (legal requirement).
Uploaded photos and print-ready master files for a completed order: 12 months from upload (deleted sooner on request).
The finished book file for a completed order (the exact pages we printed): kept permanently so you can reorder an identical copy (deleted on request).
Photos and details you upload before completing an order: 14 days, then deleted (deleted sooner on request).
Support messages: 12 months.
Recordings of how you use our site (PostHog): 30 days.
How you found us: kept for as long as we keep the book or order it belongs to, except ad click identifiers, which we delete within 90 days.
Marketing preferences: until you unsubscribe.
Your rights
You can ask for a copy of your data, correct or delete it, withdraw consent, object to how we use it, or lodge a complaint with the ICO(opens in new window).
We aim to acknowledge privacy requests within two working days and complete them within one calendar month where legally required.
Use our contact page or raise a complaint with the ICO(opens in new window).
Updates to this policy
We update this page when we launch new features or change suppliers. If a change materially affects how we use your data, we will notify you on the site.