Privacy Policy

Last updated: 26 September 2026

This policy explains what personal information Pip Leaf collects when you use this website and buy from us, why, who we share it with, how long we keep it, and what your rights are. It applies to customers and visitors in the United States, the United Kingdom, Canada, Australia and New Zealand.

1. Who is responsible

Waka Digital Limited, trading as Pip Leaf
A limited company registered in New Zealand · Company number 1885497 · NZBN 9429033751610
Registered office and address for service: c/- Astute Accounting Services Limited, 73a Boundary Road, Claudelands, Hamilton 3214, New Zealand [KARAR: T2 — bu adres müşteri yazışması için kullanılabilir mi; iade adresi değildir]
GST number: 095-481-728
Email: [DOLDURULACAK: iletişim e-postası (pipleaf.com alınınca; T4)]

• Privacy officer: [DOLDURULACAK: T4 — gizlilik sorumlusu (NZ Privacy Act 2020 s 201; Québec Law 25)]
• United Kingdom representative (UK GDPR Article 27): [DOLDURULACAK: A2 — UK temsilcisi adı ve adresi]

For customers in the United Kingdom, Waka Digital Limited is the “controller” of your personal data under the UK GDPR.

2. Visiting the website

• No cookies, no advertising trackers, no analytics companies. Our pages do not load anything from other companies: fonts, images and code all come from our own server. If you came from one of our ads, our server may tell that ad company about it, as explained below.
• Our own visit statistics. To learn which pages and ads help families find a book, our own server counts steps in the shop: the page you arrived on, the books you open, how far you get in designing one, whether you press the payment button and whether an order is paid. Each record holds only the time, the page, the book, the language pair, the delivery country and page language set on the page, the campaign name in the link you followed (its “utm” tags), the domain name of the website that linked you here (for example “google.com” — only the domain, not the page address), and a random number. Your browser keeps that number in its session storage and forgets it when you close the tab, so two visits cannot be linked. We do not record your IP address, browser type, your child’s name, your dedication or your email address with these statistics. If you order, the same random number is kept with your order, so we can count which page led to a sale. We use the statistics as counts and delete them after 13 months. We don’t share them with anyone, except the ad reports in the next point, which are made only for visits that came from a Meta or Google ad. [KARAR: A6 — UK PECR: session storage için rıza ya da itiraz yolu gerekir mi]
• If you arrive from one of our ads. We advertise on Meta (Facebook and Instagram) and Google. When you click one of those ads, the link carries a click ID and campaign tags. Our page reads them once, sends them to our own server together with the random visit number and the page you arrived on, and then removes them from the address bar. Nothing is loaded from Meta or Google and no cookie is set: our server reports to them directly, and only about visits that came from that company’s ad.
  • Meta (Conversions API): when you open a book’s page, go on to choose a character, reach the order summary, press the payment button, and when an order is paid. Each report carries the click ID, the time, the page, the book code and your browser type. The report of a paid order also carries the order number, its value and currency, and your email address, phone number and country as hashed (one-way scrambled) codes.
  • Google (Data Manager API): only when an order is paid — the click ID, the time, the order number, its value and currency, and your email address and phone number as hashed codes.
  • We never report ordinary page views. We don’t store your IP address, and we don’t send it to Meta or Google.
  • If you didn’t come from one of their ads, nothing about your visit or order is sent to Meta or Google.
  • We keep the click record for up to 90 days. Hashed details wait on our server only until they are delivered (at most three tries), and those records are deleted after 30 days.
  • In the United Kingdom, and whenever we can’t tell where you are, we ask first and send nothing unless you choose “Allow”. Anywhere, choosing “No thanks” stops these reports. Your choice is remembered in this browser (local storage, not a cookie), and you can change it here at any time:
  Your choice on this device: not asked yetAllowNo thanks
  [KARAR: Q14 — UK PECR/UK GDPR: rıza metni ve 'bilinmeyen ülke' kuralı; ABD eyalet yasaları (CCPA 'sharing', opt-out bağlantısı) ve NZ/AU/CA için ek bildirim gerekir mi]
• The site no longer stores a page language. A language choice saved by an earlier version of the site may still sit in your browser’s local storage; the site only reads it to offer you the matching language page, it never leaves your device, and you can clear it in your browser settings.
• If a book can’t be ordered yet for your country, you can leave your email address to hear when it can. We keep it apart from the visit statistics, with only the book, language pair and delivery country you asked about. We use it once, to tell you the book can be ordered, and then delete it; if that hasn’t happened within 12 months, we delete it anyway. No newsletter, and it is never used for advertising.
• While you design a book, the details you type (such as your child’s name) stay in your browser tab. They are sent to us only when you go to checkout.
• Like any website, our network provider (Cloudflare) and our server process technical data needed to deliver the pages and keep them secure: IP address, time, page requested and browser type. Our own server does not write IP addresses to its logs. [DOLDURULACAK: Cloudflare günlüklerinin saklama süresi]

3. What we collect when you order

• Contact and delivery: your name, email address, phone number and delivery address (billing address where needed for tax).
• Book details: your child’s first name, the character you chose, the age range, the languages, girl or boy (used for “he” or “she” in the text), in the newborn book the word for grandmother, and any dedication you write.
• Payment: Stripe processes your payment. We never see or store your full card number; Stripe tells us whether the payment succeeded and may show us limited details such as the card brand and last four digits.
• Messages: anything you send us by email, such as corrections to a preview.
• Order statistics link: the random visit number described in section 2, if present.

We do not ask for your child’s date of birth, surname or photo.

If you message us on WhatsApp

• You are talking to an automated assistant first. Our WhatsApp line is answered by an AI assistant (Google Gemini). If you ask for a person, or the assistant can't answer, the conversation is passed to our team.
• We receive your WhatsApp number, your WhatsApp profile name and your messages. The text of your messages is sent to Google Gemini so the assistant can answer; your phone number is not.
• We tell you the status of an order only when the email address or phone number you give matches the one on the order. [KARAR: sipariş durumu LLM'e gidiyor mu — uygulamayla teyit]
• Please don’t send photos on WhatsApp. We do not accept them there: we do not download or keep pictures or other files sent to our WhatsApp line.
• We keep the conversation for at most 90 days, then delete it. WhatsApp (Meta) and Twilio handle the messages under their own terms and may keep copies under their own retention rules.

If you use our contact form

• We receive your name, your email address, the topic you choose, an order number if you give one, your message and the time you sent it. We use them only to answer you, by email.
• We store the message on our own server, apart from the visit statistics. We don’t record your IP address or browser type with it, and we don’t link it to your visit. Our statistics count only that a message was sent, never what it said.
• Please don’t send photos, or links to photos of your child, through the form. It has no upload, and we don’t need them to answer.
• We keep the message for at most 12 months, then delete it. If you ask, we delete it sooner. No newsletter, and it is never used for advertising.

4. Why we use it, and our legal bases

The list below also gives the “lawful basis” that the UK GDPR requires us to name. In other countries the same uses apply.

We do not sell your personal information and we do not send marketing emails. Apart from the ad reports described in section 2 (only for visits that came from a Meta or Google ad), we do not use it for advertising and do not give it to advertising companies. We do not make decisions about you by automated means that have legal or similarly significant effects. [KARAR: CCPA/US eyalet yasaları: reklam raporu 'sharing' sayılır mı, 'Do not share' bağlantısı gerekir mi]

5. Who we share it with

We share only what each provider needs to do its job, under contracts that require them to protect it:

We may also share information with our accountant and professional advisers where needed, with authorities where the law requires it, and with a buyer of our business if it is ever sold (who would have to keep these promises).

Google Gemini is the AI service we use to create our stories and pictures. For character books and ready-made books, no information from your order is sent to Google to make the book. If you message our WhatsApp line, the text of those messages is sent to Google Gemini so our assistant can answer (section 3).

Overseas transfers

Waka Digital Limited is based in New Zealand, and some providers above process information in other countries, including the United States and countries in Europe. We send personal information overseas only to providers bound to protect it:

• New Zealand and Australia: to providers subject to privacy laws or contract terms that, overall, give safeguards comparable to the New Zealand Privacy Act 2020 (IPP 12) and the Australian Privacy Principles (APP 8).
• United Kingdom: New Zealand is recognised by the UK as providing adequate protection for personal data. For transfers to other countries we rely on the UK–US Data Bridge where the provider is certified, or on the UK International Data Transfer Agreement or Addendum. [DOLDURULACAK: sağlayıcı başına dayanak]
• Canada: information processed outside Canada may be accessible to courts and authorities of that country.

6. How long we keep it

• Order and contact details: [DOLDURULACAK: saklama süresi — karar yok (arka/OKU.md Açık kalanlar 4)]
• Book details and print files: [DOLDURULACAK: saklama süresi — yeniden basım için ne kadar tutuluyor, karar yok]
• Records we must keep for tax and accounting (such as invoices and payment records): for as long as the law requires — in New Zealand, generally seven years [KARAR: A12 — UK kayıtları için süre].
• Visit statistics (section 2): 13 months, then deleted automatically.
• Ad click records (section 2): 90 days. Hashed details for Meta or Google: deleted once delivered; the delivery record after 30 days.
• “Tell me when it opens” email addresses (section 2): until we have sent that one email, and at most 12 months.
• Emails you send us: [DOLDURULACAK: saklama süresi]
• Messages sent through our contact form (section 3): at most 12 months, then deleted automatically.
• WhatsApp conversations: at most 90 days, then deleted from our systems.

7. Children’s information

Our books are for children, but our website and services are for adults. Orders must be placed by a parent, guardian or other adult, who gives us the child’s first name and any dedication. We use this only to make the book you ordered. We do not knowingly collect personal information directly from children, we do not contact children, and we do not use a child’s information for marketing or profiling. If you think a child has sent us information, email us and we will delete it. [KARAR: A5/A8 — COPPA ve OAIC Children's Online Privacy Code kapsamı]

8. Photos (not offered yet)

Books drawn from a child’s photo are not on sale yet, and we do not accept photos. Before we offer them, we will update this policy. These are the rules that will apply:

• You give two separate consents, neither of them bundled with these terms: one for the photo to be used to draw that one book, and one for it to be sent to Google (Gemini API, United States) for that purpose.
• The photo is used only to draw that one book. It is not used to train AI, by us or, under Google’s paid API terms, by Google.
• We do not use face recognition and do not create a faceprint or other biometric template. An AI model writes a short description of the child’s appearance (such as hair and eye colour) from the photo, and our illustrations follow that description [KARAR: A5 — bu yazılı tarif BIPA/CUBI/MHMDA'da biyometrik sayılır mı].
• Our copy of the photo is deleted 30 days after you upload it at the latest, and you can delete it at any time before that.
• Google may keep a copy for a limited period to detect abuse of its service. Google does not say how long, and that copy is outside our control; our 30-day deletion applies to our own copy.
• The photo itself is never sent to our print partner; only the finished print file is.

9. Security and breaches

We keep order records on a server with restricted access, do not write your name, email address or your child’s details to our technical logs, and never handle your full card details. No system is perfectly secure. If a privacy breach is likely to cause you serious harm, we will tell you and the relevant regulator as the law requires — in New Zealand the Privacy Commissioner, in Australia the OAIC, in the United Kingdom the ICO, and in Canada the Privacy Commissioner of Canada.

10. Your rights

Wherever you live, you can ask us to show you the personal information we hold about you, to correct it, or to delete it (except what we must keep by law). Email us; we may need to check it is really you. We will not charge you for a reasonable request, and we answer within the time the law of your country sets (for example, one month in the United Kingdom and 20 working days in New Zealand).

• New Zealand: you have rights to access and correct your information under the Privacy Act 2020. If you are not happy with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
• Australia: we handle personal information in line with the Australian Privacy Principles, including access and correction [KARAR: A8 — küçük işletme istisnası; bu cümle bağlayıcı söz mü]. You can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
• United Kingdom: under the UK GDPR you also have the right to restrict or object to our use of your data, to data portability, and to withdraw consent at any time where we rely on it. You can complain to the Information Commissioner’s Office (ico.org.uk), though we would like the chance to put things right first.
• United States: depending on your state, privacy laws such as the California Consumer Privacy Act may give you rights to know, correct and delete personal information. We give these rights to all customers. We do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for using your rights.
• Canada: under PIPEDA and provincial law you can access and correct your information and withdraw consent (which may mean we cannot complete an order). You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner.

11. Changes

If we change this policy, we will update the date at the top. We will not use information already collected in a new way without telling you first, and asking for your consent where the law requires it.

12. Contact

Questions or requests about privacy: [DOLDURULACAK: iletişim e-postası (pipleaf.com alınınca; T4)], or write to us at the address in section 1.