Privacy Policy

Dearling Co. ("we", "us", "our") operates the website at dearlingco.com and provides personalised gifts for children. Our contact email is hello@dearlingco.com.

We ship primarily to the United States. UK availability is planned for a later phase.

We collect the following categories of personal data:

• Account data — your email address, used as your login credential. We do not store passwords.
• Child personalisation data — your child's first name, age, and photo, provided by you when creating a personalised product. This data is entered by the parent or guardian only (see Section 4 — COPPA).
• Order and delivery data — shipping address, billing address, phone number, and order history.
• Payment data — payment is processed by Stripe. We never see or store raw card numbers, CVV codes, or full card details on our servers. Stripe's privacy policy governs card data handling.
• Usage and technical data — IP address, browser type, pages visited, session identifiers, and referral source. Collected automatically via standard server logs.
• Marketing and messaging preferences — your opt-in or opt-out status for marketing emails, and for WhatsApp order updates and offers (stored against your phone number).

• To generate and deliver your personalised product.
• To process payments and fulfil orders.
• To send transactional emails — order confirmation, shipping updates, OTP codes. These are not marketing emails and are required for your order.
• To send marketing emails (newsletters, promotions) only if you have opted in.
• To send WhatsApp messages only if you have opted in — order updates and offers are separate choices. Reply STOP to any WhatsApp message to stop them.
• To operate and improve our website and AI personalisation pipeline.
• To comply with legal obligations, including tax records and fraud prevention.

Dearling Co. complies with the Children's Online Privacy Protection Act (COPPA). Our service is directed to adults (parents and gift-givers), not to children.

We collect a child's first name, age, and photo solely to personalise a product for that child. This data is submitted by a parent or guardian on the child's behalf. Children do not create accounts, do not interact directly with our website, and are never addressed in our marketing.

We do not knowingly collect personal data directly from children under 13. If you believe we have inadvertently collected such data, contact us at hello@dearlingco.com and we will delete it promptly.

Child photos uploaded for personalisation are stored only for as long as needed to generate and deliver the product, and are never used for training AI models or shared with third parties other than our fulfilment partners.

For customers in the United Kingdom and European Union, we process your data on the following lawful bases:

• Contract performance — processing your order, delivering your product, and sending transactional order communications.
• Legitimate interests — fraud prevention, website security, and improving our service, where your interests do not override ours.
• Consent — marketing emails (newsletters, promotions) and WhatsApp messages. You may withdraw consent at any time by clicking "Unsubscribe" in any marketing email, replying STOP to any WhatsApp message, or emailing us.
• Legal obligation — tax record keeping and responding to lawful requests from authorities.

We use the following types of cookies:

• Authentication cookies — HttpOnly, Secure cookies used to keep you logged in. These are essential and cannot be disabled while using an account.
• Cart cookies — store your cart session ID so your cart persists between visits. Essential for shopping functionality.
• Analytics — we may use privacy-friendly analytics tools. We do not use third-party advertising cookies.

We do not use tracking pixels or cookies for cross-site advertising. If you disable non-essential cookies in your browser settings, core functionality will still work.

We share personal data only with the service providers necessary to operate our business:

• Stripe — payment processing. Stripe stores and processes card data under their own PCI DSS-compliant infrastructure.
• Amazon Web Services (S3) — secure storage for product images and uploaded photos, hosted in the US West (Oregon) region.
• Razorpay — payment processing for orders paid in Indian rupees. Razorpay handles card and UPI details; we never see or store them.
• Amazon Simple Email Service (SES) — transactional email delivery (order confirmations, OTP codes, shipping updates).
• Brevo — marketing email platform, used only if you have opted in to marketing. Your email address, first name (if given) and marketing preferences are shared with Brevo.
• WhatsApp messaging provider — delivers WhatsApp messages through Meta's WhatsApp Business Platform, used only if you have opted in. Your phone number and the message content are shared with the provider and Meta.

We never sell your personal data. We do not share your data with data brokers, advertisers, or social media platforms for advertising purposes.

• Order records — retained for 7 years for accounting and tax purposes.
• Account data — retained while your account is active. Deleted within 30 days of an account deletion request, except where retention is required by law.
• Child photos — deleted from our servers within 90 days of the order being marked delivered, or immediately upon request.
• Marketing opt-in records — retained until you withdraw consent.
• Cart data — anonymous carts expire after 30 days.

Depending on your location, you have some or all of the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your data ("right to be forgotten"), subject to our legal retention obligations.
• Portability — receive your data in a machine-readable format (UK/EU GDPR).
• Objection / restriction — object to or restrict certain types of processing.
• Withdraw consent — withdraw marketing consent at any time without affecting prior processing.

To exercise any of these rights, email hello@dearlingco.com. We will respond within 30 days. UK customers may also lodge a complaint with the ICO at ico.org.uk.

We use HTTPS throughout, HttpOnly Secure cookies for authentication, and industry-standard encryption for data at rest and in transit. Card data never touches our servers — all payments are processed directly by Stripe.

Despite these measures, no system is 100% secure. If you believe your account has been compromised, contact us immediately at hello@dearlingco.com.

We may update this policy as our service evolves or regulations change. When we make material changes, we will update the "Last updated" date at the top of this page and, where required, notify you by email.

For any privacy questions, data requests, or concerns, contact us at hello@dearlingco.com.