Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and protect personal information when families use the Chatty Cuddly Buddy AI toy and the Puffpals Toy mobile application.

Last updated: November 2025

1.Introduction

HongKong Mcgwin Trading Co., Limited (“we,” “us,” or “our”) respects the privacy of families who use the Chatty Cuddly Buddy AI toy and the Puffpals Toy mobile application (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect personal information from parents/guardians and from children under 13 years old.

We are committed to complying with:

• COPPA (Children’s Online Privacy Protection Act)
• CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act)
• FTC Children’s Privacy and AI Guidance
• App Store and Google Play Families Policies

By using the Services, you agree to this Privacy Policy. If you do not agree, please discontinue use.

2.What This Privacy Policy Covers

This Privacy Policy applies to your and your child’s use of:

• The Chatty Cuddly Buddy AI-enabled toy
• The Puffpals Toy mobile application
• Any websites or features that link to this Privacy Policy

This Policy describes how we handle information from:

• Parents and guardians
• Children under 13 who interact with the toy and child-facing sections of the app

This Policy does not apply to third-party websites or services that may be linked from the parent section.

3.COPPA Notice to Parents

We provide this COPPA Notice to explain how we handle personal information of children under 13. We collect only what is reasonably necessary for your child to use the Services.

We do not sell, do not share, and do not allow targeted advertising to children. We obtain verifiable parental consent before enabling features that collect children’s personal information.

Parents may at any time:

• Review their child’s personal information
• Request deletion
• Withdraw consent and prevent further collection

Contact: privacy@puffpalstoy.com

4.Information We Collect

4.1 Information About Parents / Guardians

We may collect:

• Email address
• Account login credentials
• Parent verification information (via small credit card authorization)
• Limited billing details (last four digits, card type, postal code)
• Customer support messages
• Preferences and settings you choose

We do not store full payment card numbers.

4.2 Information About Children (Under 13)

We may collect the following with parental consent:

Child profile

• Name or nickname
• Age
• Interests or preferences

Interactions with the toy/app

• Text transcripts of conversations with Chatty Cuddly Buddy
• Interaction history and usage patterns
• Learning activities, responses, or progress data

Audio Data Notice

If the toy uses on-device audio capture to convert speech to text, we process audio locally or transmit it securely only to generate text transcripts. We do not retain children’s audio recordings unless explicitly stated. We collect only the minimum data reasonably needed to provide safe and age-appropriate interactions.

4.3 Device and Usage Information

We automatically collect:

• Device model and operating system
• App usage metrics
• Crash logs and diagnostic data
• Connectivity status

We do not use cookies or tracking technologies for targeted advertising.

5.How We Use the Information

We use personal information to:

Provide and operate the Services

• Enable AI-powered conversations
• Sync toy and app data
• Provide parent dashboard features

Personalize your child’s experience

• Tailor stories and chat scenarios
• Adjust content to age and learning levels

Provide learning reports

• Provide insights and summaries for parents
• Track skill development and growth over time

Improve our Services

• Fix bugs
• Improve performance
• Add new features

Communicate with you

• Send service updates, connectivity notices, and account alerts

Maintain safety

• Detect fraud or misuse
• Comply with legal obligations

We do not use children’s information to profile or target them for advertising.

6.Use of AI and Gemini Services

We use Gemini to generate conversational responses. To do this, we may send your child’s text transcripts (not audio) to Gemini’s servers.

Important Gemini Privacy Guarantees

According to Gemini’s API policies:

• Data sent through the API is not used for training Gemini’s models
• Gemini stores data only for abuse monitoring and deletes it within a limited retention window
• Data is encrypted in transit and at rest

What We Send to Gemini

We may send:

• Text transcripts of child interactions
• Context necessary to generate appropriate replies

We do not send:

• Parent billing data
• Identifiable contact information
• Full profiles beyond what is necessary for personalization

We ensure all transmissions are encrypted.

7.Legal Basis for Processing (U.S. & International)

As a Hong Kong company serving U.S. customers, we rely on:

• Parental consent (for child data)
• Legitimate interest (safety, fraud prevention)
• Contract performance (providing the Services)

8.How We Share Information

We do NOT:

• Sell personal information
• Share information with advertisers
• Allow third-party behavioral tracking

We may share data only with:

8.1 Service Providers (Processors)

Examples include:

• Google Gemini – AI conversation generation
• Cloud providers (e.g., AWS or equivalent)
• Payment processors (e.g., Stripe)
• Analytics providers (child-safe, no ad identifiers)
• Email service providers

All service providers are contractually obligated to protect data, use it only to provide services, and never use it for their own purposes.

8.2 Parents / Guardians

You can view your child’s:

• Profile
• Interests
• Chat history (within retention limits)
• Progress reports

8.3 Legal and Safety Requirements

We may disclose information if required to:

• Comply with law
• Respond to government requests
• Protect safety
• Prevent fraud

8.4 Business Transfers

If our business is merged or acquired, data may transfer under confidentiality obligations.

9.Data Retention

We retain:

• Conversation transcripts: up to 90 days, then deleted or de-identified
• Growth/learning reports: as long as your account is active
• Parent account data: as required for legal, tax, or fraud purposes

Backup copies delete on rotation.

10.Data Storage & Cross-Border Transfer

We store data on secure servers located in:

• United States and/or
• Other regions as needed

As a Hong Kong company, we may transfer data from the U.S. to Hong Kong or other jurisdictions for processing. We use:

• Encryption
• Access controls
• Contractual safeguards

to ensure international transfer protection.

11.Your Rights as a Parent or Guardian

You may:

• Access your child’s personal information
• Delete your child’s information
• Correct inaccuracies
• Withdraw consent
• Stop further collection
• Request a description of collected data

We may verify your identity before fulfilling requests.

Contact: privacy@puffpalstoy.com

12.California Privacy Rights (CCPA / CPRA)

If you reside in California, you have additional rights:

Children Under 13

• We do not sell or share children's personal information
• Parents must provide opt-in consent before any data is disclosed
• Parents can request deletion at any time

Parents Have the Right To:

• Know what data is collected
• Request corrections
• Request deletion
• Opt out of data sharing (not applicable since we do not share for advertising)

We do not use precise geolocation, biometric identifiers, or sensitive identifiers for children.

13.Security

We use administrative, technical, and physical measures such as:

• TLS 1.2+ encryption
• Encryption at rest
• Access control and authorization
• Regular security audits
• Secure development practices

No system is perfectly secure, but we continuously improve our safeguards.

14.Children’s Privacy Commitment

We:

• Collect only the minimum information needed
• Do not condition use on providing unnecessary data
• Do not allow targeted advertising
• Do not allow children to create independent accounts
• Provide parents full control over their child’s data

If you believe we collected data without proper consent, contact us immediately.

15.Changes to This Privacy Policy

We may update this Policy periodically. When we make significant changes, we will notify you via:

• Email
• In-app notification
• “Last updated” date

Continued use means acceptance of the updated Policy.

16.Contact Information

HongKong Mcgwin Trading Co., Limited
Attn: Privacy – Chatty Cuddly Buddy & Puffpals Toy
Email: privacy@puffpalstoy.com