Privacy Policy

Effective date: 24 October 2026 · Last updated: 24 October 2026

TinyTots Digital ("we", "us") sells printable digital worksheets for children and publishes related content on social platforms. This policy explains what personal data we collect, why, how long we keep it, and the choices you have. Ringkasan Bahasa Melayu ada di bahagian akhir.

1. Who we are

TinyTots Digital is a small online business operated from Malaysia. For any privacy request, contact mohdmuhaimin90@gmail.com. We respond within 7 working days.

2. Data we collect

• Order data — name, email address, and (where provided) phone number, plus the product purchased, amount, currency and order reference.
• Payment data — handled by our payment gateway. We receive a transaction status and reference only. We never see or store your card number, banking login or FPX credentials.
• Delivery data — download links issued, delivery status, and email delivery events (sent, bounced, opened where the email provider reports it).
• Support messages — anything you send us by email or through a social platform direct message, kept so we can resolve your issue.
• Technical logs — IP address, browser user agent, requested URL and timestamp, recorded by our web server for security and troubleshooting.
• Social platform data — see section 5.

We do not knowingly collect data from children. Purchases must be made by an adult. We do not ask for a child's name, age, school or photograph.

3. Why we use it

• To process your order, confirm payment and deliver the file you bought.
• To answer support requests and handle refunds or replacements.
• To keep the service secure — detecting abuse, fraud and repeated failed payments.
• To send service messages about your order. Marketing email is only sent if you opt in, and every marketing email contains an unsubscribe link.
• To understand which products and posts are useful, using aggregated counts only.

4. Legal basis and your rights

We process personal data under Malaysia's Personal Data Protection Act 2010 (PDPA), on the basis of contract performance (delivering what you bought), consent (marketing), and legitimate interest (security and service improvement). You may request access to, correction of, or deletion of your personal data, and you may withdraw consent for marketing at any time by writing to us.

5. Facebook, Instagram and Threads

We operate our own Facebook Page, Instagram professional account and Threads account, and we use Meta's official APIs to publish our own content and to read engagement counts for our own posts. In that context:

• We access only data belonging to our own accounts, plus content you send to us directly (comments, mentions, direct messages) so we can reply.
• We do not scrape profiles, build profiles of other users, or sell or share platform data with advertisers or data brokers.
• We do not use platform data to make automated decisions about you.
• Access tokens are stored encrypted at rest, restricted to our own server, and revoked when no longer needed.
• If you message us on a Meta platform, that message is also handled under Meta's own privacy policy. Ask us to delete our copy at any time.

6. Who we share data with

We share the minimum necessary with service providers who process data on our behalf:

• Payment gateway — to collect payment and confirm the transaction.
• Email delivery provider — to send your download link and receipts.
• Hosting provider — servers located in a cloud region outside Malaysia where our site and order database run.
• Meta Platforms, TikTok and Google — only when you interact with us there, or when we publish our own content through their APIs.

We do not sell personal data. We disclose data to authorities only where legally required.

7. Retention

• Order and payment records: 7 years, to meet accounting and tax obligations.
• Support conversations: 24 months after the issue is closed.
• Server logs: 30 days.
• Marketing consent records: until you withdraw consent, plus 12 months as proof.

8. Security

Data travels over HTTPS. Access to the order database is limited to the operator, uses unique credentials, and is protected by key-based authentication. We do not store payment card data. No system is perfectly secure, but we review dependencies and server exposure regularly.

9. Cookies

This website sets no advertising or analytics cookies. Pages are static; your browser may cache them for a few minutes. If that changes, this section will be updated first.

10. Data deletion requests

Email mohdmuhaimin90@gmail.com with the subject "Delete my data" and the email address or order reference you used. We delete or anonymise your personal data within 30 days, except records we must keep by law (payment and tax records), which are retained for the statutory period and then deleted.

11. Changes

If this policy changes materially, we update the effective date above and, for significant changes, notify buyers by email.

Ringkasan Bahasa Melayu

Kami kumpul nama, emel dan maklumat pesanan untuk hantar fail yang anda beli. Bayaran diproses oleh gerbang pembayaran — kami tidak simpan nombor kad atau kata laluan bank. Data tidak dijual. Anda boleh minta salinan, pembetulan atau pemadaman data dengan emel ke mohdmuhaimin90@gmail.com. Kami simpan rekod pesanan dan bayaran selama 7 tahun untuk tujuan cukai dan perakaunan.