Toydacity Inc. operates an online platform enabling users to buy, sell, trade, and gift pre-owned toys through our website (www.toydacity.com), mobile applications, and related services (collectively, the Toydacity Service). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you interact with our Service.
By accessing or using Toydacity, you consent to the practices described herein. We may modify this policy periodically; material changes will be communicated via email, in-app notifications, or by updating the Last Updated date. Your continued use constitutes acceptance.
For residents of California, Florida, Virginia, Colorado, Connecticut, and other jurisdictions with specific privacy laws, refer to Section 9 (State-Specific Disclosures).
2. Information We Collect
2.1 Information You Provide Directly
We collect data you voluntarily submit when:
Creating an account: Full name, email address, encrypted password, phone number, postal address (for local transactions), and profile photo.
Listing toys: Photographs, descriptions (e.g., brand, age range, condition), pricing, and location tags.
Communicating: Messages with other users, customer support tickets, and public reviews/ratings.
Verifying identity: For enhanced trust programs (e.g., Toydacity Verified Seller), we may request government-issued IDs (e.g., driver's license) or utility bills, processed securely via third-party services like Jumio.
Payment processing: While Toydacity does not directly handle payment details, we facilitate transactions through Stripe, Inc., which collects banking information, Social Security numbers (for sellers), and tax forms per their Privacy Policy.
2.2 Information Collected Automatically
Device/Log Data: IP address, browser type, operating system, hardware model, unique device identifiers (e.g., IMEI), mobile network data, and timestamps.
Usage Analytics: Pages visited, clickstream patterns, search queries, time spent on listings, and interaction metrics (e.g., favorites, shares).
Location Information: Precise GPS coordinates (if enabled via device permissions) or approximate location derived from IP addresses to facilitate local transactions.
Cookies and Tracking Technologies:
Essential cookies: Session management and security (e.g., CSRF tokens).
Performance cookies: Google Analytics to monitor traffic patterns.
Advertising cookies: Facebook Pixel and Google Ads for retargeting (opt-out instructions in Section 6.3).
Web beacons: Embedded in emails to track open rates.
2.3 Information from Third Parties
Social media: If you register via Facebook/Google, we receive profile data (name, email, friend lists) as permitted by their platforms.
Background checks: For fraud prevention, we may cross-reference data with public databases (e.g., OFAC sanctions lists) via services like Socure.
Mobile devices: Limit ad tracking in iOS/Android settings.
7. Children’s Privacy
Toydacity is committed to protecting the privacy of children and complying with all applicable laws, including the U.S. Children’s Online Privacy Protection Act (COPPA).
7.1 Age Restrictions
Under 13: The Toydacity Service is not intended for children under 13 years of age. We do not knowingly collect, use, or disclose personal information from children under 13 without verifiable parental consent.
Ages 13–17: Minors aged 13–17 may only use Toydacity under the supervision of a parent or legal guardian, who assumes responsibility for their compliance with our Terms of Service.
7.2 Parental Controls & Responsibilities
Guardian Oversight: Parents/guardians must review and approve their child’s account creation and monitor activity.
Parental Consent: If we discover that a child under 13 has provided personal information (e.g., via falsified age verification), we will:
Immediately suspend the account.
Notify the parent/guardian (if contact details are available).
Delete all collected data unless retention is required by law (e.g., fraud investigations).
Verification Process: For accounts suspected of belonging to underage users, we may request:
Proof of parental consent (e.g., signed consent form).
Government-issued ID to confirm guardian identity.
8. International Data Transfers
Data is processed in the U.S. Non-U.S. users consent to this transfer.
9. State-Specific Disclosures
9.1 California Residents (CCPA/CPRA)
Under the California Consumer Privacy Act (as amended by the CPRA):
Request Access/Portability: Receive a detailed report (covering the past 12 months) of:
Categories of personal data collected (e.g., identifiers, commercial information, geolocation).
Specific pieces of data (e.g., message transcripts, transaction amounts).
Third parties with whom data was shared/sold.
Delete Data: Request erasure of personal data, except where retention is required (e.g., fraud investigations, tax compliance).
Correct Inaccuracies: Update outdated or incorrect profile/transaction details.
Opt-Out of Sales/Sharing: Disable ad-targeting via Settings > Privacy > Limit Data Sharing.
Limit Sensitive Data Use: Restrict processing of government IDs or precise location.
Non-Discrimination: No denial of services for exercising rights.
Verification: Requires matching account email/phone and government-issued ID (for sensitive requests).
9.2 Florida Residents (Florida Digital Bill of Rights, Effective July 2024)
As Toydacity’s headquarters is in Miami, FL, we adhere to the Florida Digital Bill of Rights (FDBR):
Parental Consent: Strictly prohibit data collection from users under 18 without verifiable parental consent (aligned with our general under-13 prohibition).
Targeted Advertising Opt-Out: Florida minors are automatically excluded from ad targeting. Adults may opt out via Settings > Ads > Disable Personalized Ads.
Data Broker Prohibition: Toydacity does not sell data to third-party brokers.
Right to Appeal: Contest denied requests within 30 days via our Privacy Portal.
9.3 Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA)
Residents may:
Confirm Processing: Request disclosure of data categories (e.g., payment records, device identifiers).
Obtain Portable Data: Receive machine-readable copies (JSON/CSV) of provided data.
Correct Errors: Rectify inaccuracies in listings or account details.
Opt-Out of:
Targeted advertising.
Profiling for automated decisions (e.g., fraud risk scoring).
Data sales (though Toydacity only shares data for service operations, not monetary gain).
Response Timeline: 45 days (extendable to 90 with notice).
9.4 Texas Residents (Texas Data Privacy and Security Act, Effective July 2024)
Universal Opt-Out Mechanism: Honor browser-based signals (e.g., Global Privacy Control) for data sales/targeted ads.
Biometric Data Notice: Toydacity does not collect facial recognition or fingerprint data.
