This Privacy Policy explains how Shah Corporation Limited ("we", "us", or "our") collects, uses, and protects your personal information when you use Kidopoly and its related services.
Information We Collect
Information You Provide
- Contact information (email address, name) when you subscribe to our newsletter or contact us
- Information submitted through interactive features (such as quiz creation), including your name, email address, and content of your submissions
- Photographs uploaded for AI portrait generation
- Email address, shipping address, and order details provided during checkout
- Payment information (processed by our third-party payment provider — we do not store your card details)
- Feedback and correspondence when you communicate with us
- Any other information you choose to provide
Information Collected Automatically
- Usage data such as pages visited, time spent on pages, and navigation patterns
- Device information including browser type, operating system, and device type
- IP address and approximate location (country/region level)
- Referral source (how you found our website)
- IP address associated with submissions to interactive features, used for rate limiting and abuse prevention
How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Process uploaded photographs through third-party AI services to generate personalised portraits
- Screen uploaded content for safety and appropriateness
- Process payments via our third-party payment provider and fulfil orders
- Send order confirmations, delivery notifications, and other transactional communications
- Process your submissions through automated tools, including third-party artificial intelligence services, to generate content
- Send you newsletters, updates, and transactional notifications related to your submissions (such as quiz creation confirmations)
- Respond to your enquiries and feedback
- Enforce rate limits, moderation, and abuse-prevention measures to protect the integrity of our services
- Analyse usage patterns to improve user experience
- Protect against fraud and abuse
- Comply with legal obligations
Portrait Photo Processing
How We Handle Your Photos
When you upload a photograph for portrait generation, we process it as follows:
- Your photograph is stored temporarily for the duration of processing and deleted promptly thereafter
- Photographs are not stored permanently on our systems — only the generated portrait is retained
- Your photograph is sent to third-party AI service providers for portrait generation and content safety screening
- We take reasonable steps to ensure our AI service providers do not retain your uploaded photograph beyond the processing window
- We take reasonable steps to ensure uploaded photographs are not used to train AI models by us or our service providers
- Automated cleanup processes regularly remove any residual temporary files
Generated Portraits
Generated portraits (including watermarked previews and purchased full-resolution versions) are stored on our systems for order fulfilment and customer support purposes. Unpurchased preview portraits are deleted periodically.
Legal Basis for Processing
Under UK GDPR, we rely on the following legal bases for processing your personal information:
- Contract performance: Processing portrait photographs and delivering purchased products, processing quiz submissions, delivering digital products, and sending transactional notifications
- Legitimate interests: Website analytics, improving our services, content safety screening, rate limiting, abuse prevention, and fraud protection. We balance these interests against your rights and only process data that is proportionate and expected
- Consent: Sending marketing newsletters and non-essential communications. You can withdraw consent at any time by unsubscribing
- Legal obligation: Where we are required to retain or disclose information to comply with applicable law
How We Share Your Information
We do not sell your personal information. We may share your information with:
- Service Providers: Third parties who help us operate our website and services, including hosting, analytics, email services, AI portrait generation, and content safety screening providers
- Payment Providers: Third-party payment processors that handle transactions on our behalf
- Image Processing Providers: Third-party services used for image enhancement and order fulfilment
- Legal Requirements: When required by law, court order, or governmental authority
- Business Transfers: In connection with a merger, acquisition, or sale of assets
Data Retention
We retain your personal information for as long as reasonably necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law.
- Uploaded photographs: Deleted promptly after portrait generation. Residual temporary files cleaned up automatically
- Unpurchased portrait previews: Deleted periodically
- Purchased portrait files: Retained as reasonably necessary for order fulfilment and customer support
- Order records: Retained as required for legal, accounting, and business purposes
- Payment data: Processed and stored by our payment provider per their own retention policy. We retain order identifiers, email addresses, and transaction amounts only
- Newsletter subscriptions: Until you unsubscribe
- Contact form submissions: Up to 2 years
- Analytics data: 14 months (Google Analytics default)
- Interactive feature submissions (e.g. quizzes): Published content is retained indefinitely. Associated personal information (name, email, IP address) is retained for as long as the content remains published and as necessary for rate-limiting and abuse-prevention purposes
Your Rights
Under UK data protection laws (UK GDPR), you have the right to:
- Access: Request a copy of the personal information we hold about you
- Rectification: Request correction of inaccurate personal information
- Erasure: Request deletion of your personal information
- Restriction: Request restriction of processing your personal information
- Portability: Request transfer of your data to another service
- Object: Object to processing of your personal information
- Withdraw Consent: Withdraw consent at any time where processing is based on consent
Children's Privacy
Kidopoly is designed for families with children. We do not knowingly collect personal information directly from children under 13. Our content is designed to be accessed by children under parental supervision.
- Interactive features that collect personal information (such as quiz creation) are intended to be used by parents or guardians on behalf of children
- Photographs of children uploaded for portrait generation must be submitted by a parent or legal guardian. We process these photographs temporarily and delete them promptly after generation — see our Portrait Photo Processing section for full details
- We take reasonable steps to ensure photographs of children are not used by us or our service providers to train AI models
- Children may enter a display name when using interactive features such as quizzes, which is used for display purposes (such as attribution and scores) and is not linked to any other personal information. We reserve the right to truncate, modify, or remove display names at any time to protect user privacy
International Data Transfers
Your information may be transferred to and processed in countries outside the UK, including the United States (for services like analytics, hosting, AI processing, payment processing, and image processing providers). We ensure appropriate safeguards are in place to protect your information in accordance with this policy and applicable law.
Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Email: [email protected]
Shah Corporation Limited
Irish Square, Upper Denbigh Road, St Asaph, Denbighshire, LL17 0RN, United Kingdom