Privacy policy

TOVI SMART TOYS INC. PRIVACY POLICY

Last Updated: January 12, 2026

Tovi Smart Toys Inc. (“Tovi,” “we,” “us,” or “our”) operates our website and online store, the Tovi parent companion mobile application (the “Parent App”), which is delivered through a third-party platform (currently, the Tuya Smart app), and the Tovi AI learning companion toy (the “Toy”) (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit or use our website, purchase a Toy, use the Parent App, or otherwise interact with the Services in the United States.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use the Services.

1) Key Definitions

Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked (directly or indirectly) with a particular individual or household. Personal information does not include information that is de-identified or aggregated so it can no longer reasonably be used to identify you.

Child / child user means a child under 13.

Conversation History means the text transcripts of interactions between the Toy and a child user (or other user) that are displayed in the Parent App.

Third-Party Platform means a third-party mobile or cloud platform used to support device pairing, connectivity, and operation of the Toy. The Parent App is currently delivered through the Tuya platform (“Tuya”).

2) Personal Information We Collect

Depending on how you interact with us (browsing our site, purchasing, using the Parent App/Toy), we may collect the following categories of personal information:

A. Information you provide (primarily parent/guardian)

Contact Information: name, email address, phone number, billing address, shipping address.

Account Information: username, password, and account settings/preferences used to access the Parent App. Parent App accounts are created and managed through the third-party platform used to deliver the app (currently, Tuya) and are used exclusively for Tovi Services.

Payment and Transaction Information: purchase details such as items ordered, order number, date, amount, return/refund history.
Important: Payments are processed through Shopify and/or its payment processors. We do not store full payment card numbers on our own servers.

Communications: information you provide when contacting customer support or otherwise communicating with us (e.g., email content and support records).

B. Website and online store information (collected automatically)

Device and Usage Information (Website): IP address, browser type, device type, unique identifiers, pages/products viewed, browsing actions on our site, and timestamps.

Cookies and Similar Technologies: cookies, pixels, SDKs, local storage, and similar tools used for site functionality, analytics, and (where enabled) advertising (see Section 9).

C. Parent App and Toy information

Device and Usage Information (Toy & App): device identifiers for the Toy and/or the mobile device running the Parent App, software/firmware version, settings, connectivity status, feature usage, and error/crash logs. This information is processed through the Parent App and supporting cloud infrastructure provided by our service providers, including the third-party platform.

Geolocation (limited and with permission): we may request access to device location during Toy setup because certain mobile operating systems require location permission for Bluetooth scanning and/or Wi-Fi discovery. We use this only to help pair the Toy and connect it to Wi-Fi and maintain connectivity. You can revoke permission in your device settings (see Section 11).
Note: Because the Parent App is delivered through a third-party platform, permission requests may be labeled under that platform’s name (e.g., Tuya).

D. Child-related information (parents control inputs + supervised use)

Child Profile & Preferences (Parent-provided): through the Parent App, a parent/guardian may choose to provide limited information to personalize the experience (e.g., child’s first name, age/birth month/year, interests, favorite characters, names of family members or pets). This information is optional and provided by the parent/guardian.

Voice & Interaction Data (Toy Conversations):
The Toy uses a microphone to enable voice-based interaction.
We do not permanently save or store raw audio recordings of a child’s voice as part of normal operation.
The Toy’s speech recognition converts voice input to text in real time to enable the interaction.

Conversation History (Visible in Parent App):
Parents/guardians can view the child’s conversation history (text transcripts) in the Parent App.
Parents/guardians can delete conversation history in the Parent App.
Retention and deletion controls are described in Sections 8 and 10.

3) Sensitive Personal Information

Some data we process may be considered Sensitive Personal Information under certain laws, including:

  • Children’s personal information

  • Precise geolocation (only for setup/connectivity, when enabled)

  • Account credentials (username/password)

  • Voice data (processed for speech recognition; raw audio not retained as described above)

How we limit sensitive information use

We use Sensitive Personal Information only as necessary to:

  • provide and secure the Services (including pairing/connectivity),

  • enable the Toy’s core conversational features,

  • provide parent controls (like viewing/deleting conversation history),

  • comply with law, and

  • prevent fraud and maintain safety/security.

You can limit collection and use by:

  • not providing optional child profile details,

  • managing permissions (e.g., location) in device settings,

  • deleting conversation history in the Parent App,

  • deleting your account (Section 8).

We do not use children’s personal information for advertising.

4) Sources of Personal Information

We collect personal information from:

  • Directly from you (e.g., purchases, account creation, customer support, parent-provided child profile info).

  • Automatically (e.g., cookies and web analytics; app/device logs).

  • Third-party platforms and service providers (such as Tuya) that support the Parent App, device pairing, connectivity, and cloud infrastructure.

  • Service providers that help run the Services (e.g., Shopify, payment processors, hosting, analytics).

  • App stores (e.g., Apple App Store / Google Play) for download and transaction confirmations where applicable.

5) How We Use Personal Information

We use personal information for the following purposes:

A. Provide and improve the Services

Operate our website/store and fulfill orders, deliver Parent App and Toy functionality, personalize the child experience based on parent-provided preferences, and perform troubleshooting, quality assurance, and product development.

B. Account management and customer support

Create and maintain accounts, authenticate users, respond to requests, and send service-related notifications (order/shipping, security alerts, updates, policy changes).

C. Payments and transactions

Process purchases (via Shopify/payment processors), manage returns/refunds, and maintain business records.

D. Safety, security, fraud prevention

Secure accounts and systems, detect suspicious activity, and prevent misuse.

E. Marketing (adults only)

Send marketing communications to parents/guardians (you can opt out), run advertising campaigns directed to adults (parents/guardians), not children, and measure marketing effectiveness (see Section 9).

F. Legal compliance

Comply with legal obligations and enforce agreements and protect rights, safety, and property.

6) AI Processing and Model Providers (OpenAI and others)

The Toy’s conversational features rely on AI processing. Currently, we use OpenAI as an AI model provider, but we may use other AI providers or models in the future.

When a child speaks:

  • speech-to-text converts voice input to text (real time),

  • text is processed by AI services to generate a response,

  • text-to-speech converts the response to audio for playback.

Key privacy commitments for AI processing

  • We do not send payment information to AI providers.

  • We do not intentionally send direct identifiers (such as parent account credentials) to AI providers.

  • AI providers typically receive only the text needed to generate a response (which may include whatever a user says during conversation).

  • We configure and contract with AI providers so that conversation data is not used to train their models and is not stored for their independent purposes, to the extent supported by the provider and our contractual controls.

Note: If a child (or anyone) says personal information out loud during a conversation, that information may appear in the conversation text because it is part of what was said. Parents can help by guiding children not to share sensitive details (last name, address, school, phone number, etc.).

7) How We Share Personal Information

We do not sell personal information for money. We do not share children’s personal information for targeted advertising.

We may share personal information in the following circumstances:

A. Service providers (processors)

We share information with vendors that provide services on our behalf, under confidentiality and data protection obligations, including:

  • E-commerce platform: Shopify

  • Payment processing: Shopify Payments and/or other processors

  • Shipping and fulfillment: carriers and logistics partners

  • Cloud hosting & databases: providers supporting the Parent App and Services

  • Analytics & performance: website/app analytics and crash reporting

  • Communications: email/SMS providers

  • Push notifications: app notification services

  • Speech and AI providers: speech-to-text, AI model providers (currently OpenAI), and text-to-speech providers

B. Legal, safety, and compliance

To comply with law or legal process, respond to lawful requests, protect rights, safety, and security, and prevent fraud or security incidents.

C. Business transfers

In connection with a merger, acquisition, financing, bankruptcy, or sale of assets.

D. Aggregated/de-identified data

Information that cannot reasonably identify you.

E. Third-Party App Platform (Tuya)

The Parent App is delivered through the Tuya Smart platform, a third-party Internet-of-Things (IoT) service provider that enables device pairing, connectivity, and cloud communication between the Toy and the Parent App.

In connection with providing these services, Tuya may process information such as account credentials, device identifiers, network and connectivity data, and app usage metadata. Tuya processes this information as a service provider acting on our behalf and under our instructions to support the operation of the Services.

Tuya does not receive payment information, and we do not authorize Tuya to use personal information for independent advertising or marketing purposes.

Tuya operates under its own privacy policy and terms. Your use of the Parent App through the Tuya platform is also subject to Tuya’s privacy policy. We encourage parents to review Tuya’s privacy policy to understand how Tuya processes information within its platform.

8) Data Retention, Conversation History, and Account Deletion

We retain personal information for as long as reasonably necessary to provide the Services and for legitimate business purposes, unless a longer retention period is required by law.

Conversation History:

  • Visible to parents in the Parent App

  • Parents can delete conversation history

  • Deletion removes it from active systems associated with your account, subject to limited exceptions (security, legal compliance, short-lived backups)

Orders and transaction records: retained as required for accounting, tax, and legal purposes.

Account deletion:
You may request deletion via in-app controls (if offered) or by contacting hi@heytovi.com. We will delete or de-identify personal information from active systems and instruct service providers (including the third-party platform) to do the same, subject to lawful exceptions.

9) Cookies, Tracking Technologies, Analytics, and Advertising

We use cookies and similar technologies on our website for:

  • Essential functions (cart, checkout, account login, site security),

  • Preferences (remembering settings),

  • Analytics (understanding site performance),

  • Advertising (where enabled) to measure and improve our marketing to adults.

Behavioral advertising (adults only)

We may use tools such as Meta/Facebook Pixel, Google Ads tags, and similar services to measure ad performance, build adult audiences, and show Tovi ads to adults on third-party platforms. We do not knowingly enable targeted advertising directed at children, and we do not use children’s conversation history for advertising.

Your choices

You can manage cookies through your browser settings, any cookie banner/preferences tool we provide (where applicable), or opt-outs offered by advertising platforms.

Global Privacy Control (GPC): If our website detects a GPC signal, we will treat it as a request to opt out of “sale”/“sharing” of personal information for targeted advertising to the extent required by applicable law and technically feasible.

Do Not Track (DNT): There is no uniform standard, and we do not respond to DNT signals at this time.

10) Your Privacy Rights and How to Exercise Them

Depending on your state of residence, you may have rights such as access, deletion, correction, data portability, opt-out of targeted advertising, and limitation of sensitive personal information use. We will not discriminate against you for exercising these rights.

How to submit a request:
Email hi@heytovi.com with your name, the email used for your account/order, and the specific request.

We may verify your identity. We aim to respond within legally required timeframes. Appeals may be submitted by email with “Privacy Appeal” in the subject line.

11) Permissions and Controls (Parent App / Device)

The Parent App may request permissions such as Bluetooth/location (for setup and connectivity) and notifications (for important updates). You can revoke permissions in device settings. You can also control privacy by choosing not to provide optional child profile information, reviewing and deleting conversation history, and deleting your account.

12) Children’s Privacy (COPPA)

Tovi is designed for children’s use only with parent/guardian involvement and consent. We comply with COPPA and limit collection of children’s personal information to what is reasonably necessary.

Parents can request access, deletion, or revocation of consent by contacting hi@heytovi.com. We verify parent/guardian status before fulfilling requests.

13) Data Security

We use reasonable safeguards to protect personal information. No method of transmission or storage is 100% secure.

14) Where We Store Information

We primarily store and process information in the United States.

15) Third-Party Links

Our Services may include links to third-party websites or services. Use of the Tuya platform is subject to Tuya’s own privacy policy and terms.

16) Changes to This Privacy Policy

We may update this Privacy Policy from time to time and will post updates on our website.

17) Contact Us

Email: hi@heytovi.com
Mail: Tovi Smart Toys Inc., 1111B S Governors Ave, STE 26230, Dover, Delaware 19904, United States