Privacy policy
Last updated: 1 November 2026
1. Who is responsible
Pure Synergy OÜ (registry code 14132722, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia) is responsible for your personal data. Questions and requests: hello@woops.ee.
2. What we collect
- Your email — to confirm the order and send the cartoon.
- Your child's first name (or the name you use at home) and age — so the toy can speak to your child.
- What you tell us about the toy and the cartoon: the toy's name, how it moves, its personality, what the cartoon should help with, what to leave out, the party date.
- Photos of the toy and, if you add one, a style picture.
- Order details: theme, style, language, voice, the pictures we drew, price, currency, payment status and time.
- To stop abuse of the free pictures: a code made from your IP address and the date. We don't store the IP address itself, and the code changes every day.
We remove the metadata from every photo and picture (location, device, date) as soon as it reaches us, before we store it or send it anywhere.
Your card details go straight to Stripe. We never see or store them.
Please upload photos and style pictures without people, and don't write about your child's health in the notes.
3. Why, and on what legal basis
- To make and deliver the cartoon you ordered — to perform our contract with you (Art. 6(1)(b) GDPR).
- To keep accounting records — a legal obligation (Art. 6(1)(c) GDPR).
- To protect the site from abuse: the IP code and the “not a robot” check — our legitimate interest (Art. 6(1)(f) GDPR).
- To see how the site is used and make it better: visit statistics without cookies — our legitimate interest (Art. 6(1)(f) GDPR).
We don't use your data for advertising and don't sell it.
4. How long we keep it
- Toy photos and the style picture: deleted 30 days after the order.
- The three pictures of the hero: the two you didn't pick are deleted with the photos; the one you picked is shown with the cartoon and deleted with it.
- Unpaid orders: deleted 7 days after the last change, with their photos and pictures.
- The cartoon: the link works for 90 days after we send it, then the file is deleted.
- Your child's name and age, your notes, the toy's name and personality: anonymised 90 days after we send the cartoon.
- For the accounts we keep the amount, the date and your email for as long as accounting law requires (7 years in Estonia).
5. Who processes data for us
These companies help us run the service. They work on our instructions and get only what their job needs.
| Service | Company | Country | What they get |
|---|---|---|---|
| Website hosting | Vercel Inc. | USA | Everything you send through the site, while it passes; IP address |
| Visit statistics | Vercel Inc. (Web Analytics) | USA | Pages visited, steps of the order form, country, browser and device type — no cookies, the IP address is not stored |
| Database and files | Supabase, Inc. | USA; data stored in Frankfurt, Germany | Order details, toy photos, pictures, the cartoon |
| Payment | Stripe Payments Europe, Limited | Ireland | Email, amount, card details |
| Emails | Resend (Plus Five Five, Inc.) | USA | Your email, the text of our emails |
| “Not a robot” check | Cloudflare, Inc. (Turnstile) | USA | IP address, browser data |
| Pictures from the toy photo | kie.ai (NexusAI Services LLC) | USA | Toy photos, style picture, picture descriptions |
| Pictures from the toy photo (backup) | Google LLC (Gemini API) | USA | Toy photos, style picture, picture descriptions |
| Video | Higgsfield Inc. | USA | Pictures of the hero, frames, scene descriptions |
| Video | kie.ai (NexusAI Services LLC) | USA | Pictures of the hero, frames, scene descriptions |
| Voice | Eleven Labs Inc. (ElevenLabs) | USA | The cartoon's lines, including your child's name |
Vercel, Supabase, Stripe, Resend, Cloudflare, Google and ElevenLabs process data under the data processing terms each of them includes in its terms of service, with Standard Contractual Clauses (SCC) for transfers outside the EEA.
kie.ai and Higgsfield get only photos of the toy without people (with the style picture and the pictures made from them) and scene descriptions — this data does not identify you or your child.
6. The AI models behind the pictures and video
The picture and video services above run models made by other companies. Through these services the model developers may receive the data the models work on:
- Kling — Kuaishou Technology (China)
- Seedance — ByteDance (China, Singapore)
- Nano Banana and Veo — Google (USA)
They get only photos of the toy without people and scene descriptions — this data does not identify you or your child. Never your child's name or age, never your email. Your child's name goes only to the voice service, as part of the lines.
7. Transfers outside the EEA
Some of these companies are outside the European Economic Area. Personal data goes to them under the Standard Contractual Clauses (SCC) in their data processing terms. kie.ai, Higgsfield and the model developers get no data that identifies you or your child (points 5 and 6).
8. Your rights
You can ask us to show you your data, correct it, delete it, limit its use, or give it to you in a common format. You can also object to its use for our legitimate interest.
Write to hello@woops.ee. We reply within one month.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the data protection authority where you live.
9. Children
The service is for parents. Children don't use the site, and we ask only for the child's first name and age.
Upload photos of the toy only, with no people.
11. Changes
If we change this policy, we update the date at the top.