Privacy Policy

Last updated: 11 October 2026

This policy explains what personal information Pip Leaf collects when you use this website and buy from us, why, who we share it with, how long we keep it, and what your rights are. It applies to customers and visitors in the United States, the United Kingdom, Canada, Australia and New Zealand.

1. Who is responsible

Waka Digital Limited, trading as Pip Leaf
A limited company registered in New Zealand · Company number 1885497 · NZBN 9429033751610
Registered office and address for service: c/- Astute Accounting Services Limited, 73a Boundary Road, Claudelands, Hamilton 3214, New Zealand (this is our accountant’s office: please don’t send letters, orders or returns there — email us instead)
GST number: 095-481-728
Email: [email protected]

• Privacy Officer, Waka Digital Limited: [email protected]
• United Kingdom representative (UK GDPR Article 27): we will name our representative here before we take orders from the United Kingdom.

For customers in the United Kingdom, Waka Digital Limited is the “controller” of your personal data under the UK GDPR.

2. Visiting the website

• No cookies, no advertising trackers, no analytics companies. Our pages do not load anything from other companies: fonts, images and code all come from our own server. If you came from one of our ads, our server may tell that ad company about it, as explained below.
• Our own visit statistics. To learn which pages and ads help families find a book, our own server counts steps in the shop: the page you arrived on, the books you open, how far you get in designing one, whether you press the payment button and whether an order is paid. Each record holds only the time, the page, the book, the language pair, the delivery country and page language set on the page, the campaign name in the link you followed (its “utm” tags), the domain name of the website that linked you here (for example “google.com” — only the domain, not the page address), and a random number. Your browser keeps that number in its session storage and forgets it when you close the tab, so two visits cannot be linked. We do not record your IP address, browser type, your child’s name, your dedication or your email address with these statistics. If you order, the same random number is kept with your order, so we can count which page led to a sale. We use these records only for statistics, never to profile anyone. Within 30 days we combine them into totals (for example, “12 visits to this book from Canada on 3 October”), which no longer contain the random number, and delete the individual records and the number kept with an order; the totals are deleted after 13 months. We don’t share them with anyone, except the ad reports in the next point, which are made only for visits that came from a Meta or Google ad. You can switch these statistics off in this browser:
  Visit statistics on this device: onTurn onTurn off
• If you arrive from one of our ads. We advertise on Meta (Facebook and Instagram) and Google. When you click one of those ads, the link carries a click ID and campaign tags. Our page reads them once, sends them to our own server together with the random visit number and the page you arrived on, and then removes them from the address bar. Nothing is loaded from Meta or Google and no cookie is set: our server reports to them directly, and only about visits that came from that company’s ad.
  • Meta (Conversions API): when you open a book’s page, go on to choose a character, reach the order summary, press the payment button, and when an order is paid. Each report carries the click ID, the time, the page, the book code and your browser type. The report of a paid order also carries the order number, its value and currency, and your email address, phone number and country as hashed (one-way scrambled) codes.
  • Google (Data Manager API): only when an order is paid — the click ID, the time, the order number, its value and currency, and your email address and phone number as hashed codes.
  • We never report ordinary page views. We don’t store your IP address, and we don’t send it to Meta or Google.
  • If you didn’t come from one of their ads, nothing about your visit or order is sent to Meta or Google.
  • We keep the click record for up to 90 days. Hashed details wait on our server only until they are delivered (at most three tries), and those records are deleted after 30 days.
  • In the United Kingdom, and whenever we can’t tell where you are, we ask first and send nothing unless you choose “Allow”. Anywhere, choosing “No thanks” stops these reports, and so does a Global Privacy Control signal from your browser. Your choice is remembered in this browser (local storage, not a cookie), and you can change it here at any time:
  • We never send your child’s name, dedication, character, photo or any other detail of the book to Meta or Google.
  Your choice on this device: not asked yetAllowNo thanks
• The site no longer stores a page language. A language choice saved by an earlier version of the site may still sit in your browser’s local storage; the site only reads it to offer you the matching language page, it never leaves your device, and you can clear it in your browser settings.
• If you arrive through a link shared by a school or community group, this browser remembers that group’s short code (local storage, not a cookie) for up to 60 days. If you order, the code is saved with your order so we can pay the group its share for each printed book. The code names the group, not you, and we don’t share your details with the group. What a school or organisation gives us when it registers is in section 3.
• If a book can’t be ordered yet for your country, you can leave your email address to hear when it can. We keep it apart from the visit statistics, with only the book, language pair and delivery country you asked about. We use it once, to tell you the book can be ordered, and then delete it; if that hasn’t happened within 12 months, we delete it anyway. No newsletter, and it is never used for advertising.
• While you design a book, the details you type (such as your child’s name) stay in your browser tab. They are sent to us only when you go to checkout.
• Like any website, our network provider (Cloudflare) and our server process technical data needed to deliver the pages and keep them secure: IP address, time, page requested and browser type. Our own server does not write IP addresses to its logs, and we have not switched on any optional storage of request logs at Cloudflare; Cloudflare handles its own operational logs under its privacy policy.

3. What we collect when you order

• Contact and delivery: your name, email address, phone number and delivery address (billing address where needed for tax).
• Book details: your child’s first name, the character you chose, the age range, the languages, girl or boy (used for “he” or “she” in the text), in the newborn book the word for grandmother, and any dedication you write.
• Payment: Stripe processes your payment. We never see or store your full card number or your payment account details; Stripe tells us whether the payment succeeded and may show us limited details such as the payment method, card brand and last four digits. If you pay with Apple Pay or Google Pay, Apple or Google handle that step under their own terms. If you choose Afterpay (Clearpay in the United Kingdom) or Klarna, Stripe passes them your order amount and the contact and address details they need, and they use your information under their own privacy policies, as a separate business from us, for example to decide whether to offer you payment in instalments.
• Messages: anything you send us by email, such as corrections to or approval of a preview.
• Order statistics link: the random visit number described in section 2, if present.
• How you heard about us: if you answer the optional question after paying, we keep your answer (for example “Instagram” or “a friend”) with your order, to learn which of our efforts work.

We do not ask for your child’s date of birth or surname. We ask for a photo only for a book drawn from a photo, after you have paid (section 8).

If you message us on WhatsApp

• You are talking to an automated assistant first. Our WhatsApp line is answered by an AI assistant (Google Gemini). If you ask for a person, or the assistant can't answer, the conversation is passed to our team.
• We receive your WhatsApp number, your WhatsApp profile name and your messages. The text of your messages is sent to Google Gemini so the assistant can answer; your phone number is not.
• We tell you the status of an order only when the email address or phone number you give matches the one on the order. That check and the answer are made by our own system, not the AI: your order details, and those messages, are never sent to Google Gemini, and order numbers are removed from anything the assistant sees.
• Please don’t send photos on WhatsApp. We do not accept them there: we do not download or keep pictures or other files sent to our WhatsApp line.
• We keep the conversation for at most 90 days, then delete it, unless it is part of an open complaint or dispute. WhatsApp (Meta) and Twilio handle the messages under their own terms; we set Twilio to delete message content in line with our own period where its settings allow.

If you use our contact form

• We receive your name, your email address, the topic you choose, an order number if you give one, your message and the time you sent it. We use them only to answer you, by email.
• We store the message on our own server, apart from the visit statistics. We don’t record your IP address or browser type with it, and we don’t link it to your visit. Our statistics count only that a message was sent, never what it said.
• Please don’t send photos, or links to photos of your child, through the form. It has no upload, and we don’t need them to answer.
• We keep the message for at most 12 months, then delete it, unless it is part of an open order, complaint or dispute. If you ask, we delete it sooner. No newsletter, and it is never used for advertising.

If you register a school or organisation

• On our For schools page, and for organisations, we ask for the school’s or organisation’s name, type and country, the name and email address of the person registering, their role if they give it, and any note they add. We use them to set up your link, send you your link and flyer, and answer you about a book made for you if you ask.
• Schools only: we also ask for the school’s bank account, so we can pay the school its share. We store it encrypted. In our daily work we see only its last four digits; the full number is opened only to make a payment. Before the first payment we check the account is in the school’s name. We don’t ask organisations for bank details.
• We don’t give these details to the families who use your link, and we don’t use them for advertising or a newsletter.
• We keep them while your link is open and for 12 months after it closes (for the last payment and any questions), then delete them. We keep the school’s or organisation’s name, code, country and type, and the number of orders made through the link.

4. Why we use it, and our legal bases

The list below also gives the “lawful basis” that the UK GDPR requires us to name. In other countries the same uses apply.

We do not sell your personal information and we do not send marketing emails. Apart from the ad reports described in section 2 (only for visits that came from a Meta or Google ad), we do not use it for advertising and do not give it to advertising companies. We do not make decisions about you by automated means that have legal or similarly significant effects. You can stop the ad reports anywhere, at any time, with the choice in section 2.

5. Who we share it with

We share only what each provider needs to do its job, under contracts that require them to protect it:

We may also share information with our accountant and professional advisers where needed, with authorities where the law requires it, and with a buyer of our business if it is ever sold (who would have to keep these promises).

Google Gemini is the AI service we use to create our stories and pictures. For character books and ready-made books, no information from your order is sent to Google to make the book. If you message our WhatsApp line, the text of those messages is sent to Google Gemini so our assistant can answer (section 3).

Photo books: the photo you upload is sent to Google Gemini to paint your child’s character once (section 8).

Overseas transfers

Waka Digital Limited is based in New Zealand, and some providers above process information in other countries, including the United States and countries in Europe. We send personal information overseas only to providers bound to protect it:

• New Zealand and Australia: to providers subject to privacy laws or contract terms that, overall, give safeguards comparable to the New Zealand Privacy Act 2020 (IPP 12) and, where they apply to us, the Australian Privacy Principles (APP 8).
• United Kingdom: New Zealand is recognised by the UK as providing adequate protection for personal data. For transfers to other countries we rely on the UK–US Data Bridge where the provider is certified, or on the UK International Data Transfer Agreement or Addendum. Transfers within Europe (our server in Germany) rely on the UK’s adequacy regulations for the European Economic Area. The safeguard for each provider is given in the table above.
• Canada: information processed outside Canada may be accessible to courts and authorities of that country.

6. How long we keep it

• Order and contact details: 24 months after your order is fulfilled, unless we need them longer for an open issue.
• Book details and finished print files: 24 months after the order (or its last reprint), so we can reprint a lost or damaged book; then the personalised files are deleted. Ask us and we delete them sooner, unless an open order or the law needs them.
• The minimum record of each sale we must keep for tax, accounting and legal reasons (invoice, payment and transaction details): 7 years. This never includes photos or production files.
• Visit statistics (section 2): individual records combined into totals within 30 days; totals deleted after 13 months.
• Ad click records (section 2): 90 days. Hashed details for Meta or Google: deleted once delivered; the delivery record after 30 days.
• “Tell me when it opens” email addresses (section 2): until we have sent that one email, and at most 12 months.
• Emails you send us: 24 months, then deleted, unless they are part of an open order, complaint or dispute, or a record we must keep.
• Messages sent through our contact form (section 3): at most 12 months, then deleted automatically.
• School and organisation registrations (section 3): contact details and, for schools, bank details while the link is open and 12 months after it closes, then deleted.
• WhatsApp conversations: at most 90 days, then deleted from our systems, unless part of an open complaint or dispute.
• Photos for photo books: deleted once we have drawn your child’s character, at the latest when we send you the preview, and in any case within 30 days of upload.

7. Children’s information

Our books are for children, but our website and services are for adults. Orders must be placed by a parent, guardian or other adult, who gives us the child’s first name and any dedication. We use this only to make the book you ordered. We do not knowingly collect personal information directly from children, we do not contact children, and we do not use a child’s information for marketing or profiling. If you think a child has sent us information, email us and we will delete it. We never send a child’s information to advertising platforms.

For photo books, the adult who uploads the photo confirms they are the child’s parent or guardian, or have their permission.

8. Photos (books drawn from a photo)

Some of our books can be drawn from a photo of your child. This is how we handle that photo:

• When. We ask for the photo only after you have paid, through a private link in your order email. We never ask for it by email, chat or WhatsApp, and we don’t accept it there.
• Who. Only an adult — the child’s parent or guardian, or an adult with their permission — can upload it.
• Your consent. You give two separate consents on the upload page, neither of them bundled with our terms: one for us to use the photo to draw that one book, and one for it to be sent to Google (Gemini API, United States) for that purpose. You can withdraw consent before we draw the book by replying to your order email; we then delete the photo.
• What we do with it. We remove its location and other hidden data when you upload it. Google’s Gemini service paints your child once as the book’s character, in our illustration style, and the book’s pictures are drawn from that painting. The photo is never used for advertising and is not used to train AI, by us or, under Google’s paid API terms, by Google.
• No face recognition. We do not use face recognition. We do not create or keep a faceprint, face embedding, facial measurements or geometry, or anything else that could be used to identify or match a person.
• How long. Our copy of the photo is deleted once we have drawn your child’s character from it — at the latest when we send you the preview — and in any case within30 days of upload. You can ask us to delete it sooner. We keep a record that it was deleted and when, not the photo.
• Google’s copy. Google may keep a copy for a limited period to detect abuse of its service. Google does not say how long, and that copy is outside our control; our30-day deletion applies to our own copy.
• The finished pictures. The painted character and the book’s pictures are kept with your book’s print files (section 6), so we can reprint a lost or damaged book, and deleted with them.
• The photo itself is never sent to our print partner; only the finished print file is.

9. Security and breaches

We keep order records on a server with restricted access, do not write your name, email address or your child’s details to our technical logs, and never handle your full card or payment account details. No system is perfectly secure. If a privacy breach is likely to cause you serious harm, we will tell you and the relevant regulator as the law requires — in New Zealand the Privacy Commissioner, in Australia the OAIC, in the United Kingdom the ICO, and in Canada the Privacy Commissioner of Canada.

10. Your rights

Wherever you live, you can ask us to show you the personal information we hold about you, to correct it, or to delete it (except what we must keep by law). Email us; we may need to check it is really you. We will not charge you for a reasonable request, and we answer within the time the law of your country sets (for example, one month in the United Kingdom and 20 working days in New Zealand).

• New Zealand: you have rights to access and correct your information under the Privacy Act 2020. If you are not happy with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
• Australia: where Australian privacy law applies to us, we comply with it; we also apply privacy practices consistent with the Australian Privacy Principles where appropriate, including access and correction. You can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
• United Kingdom: under the UK GDPR you also have the right to restrict or object to our use of your data, to data portability, and to withdraw consent at any time where we rely on it. You can complain to the Information Commissioner’s Office (ico.org.uk), though we would like the chance to put things right first.
• United States: depending on your state, privacy laws such as the California Consumer Privacy Act may give you rights to know, correct and delete personal information. We give these rights to all customers. We do not sell or share personal information for cross-context behavioural advertising beyond the limited ad reports in section 2, which you can stop at any time (a Global Privacy Control signal also stops them), and we will not treat you differently for using your rights.
• Canada: under PIPEDA and provincial law you can access and correct your information and withdraw consent (which may mean we cannot complete an order). You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner.

11. Changes

If we change this policy, we will update the date at the top. We will not use information already collected in a new way without telling you first, and asking for your consent where the law requires it.

12. Contact

Questions or requests about privacy: [email protected] (our Privacy Officer).