Privacy notice
Last updated: 2026-10-16
This notice explains what happens to the personal data you give us on this website: your email address if you join the Playnitive waitlist or reserve a plush for free, your name, email address and message if you use the contact form, your name, email address, shipping address and billing address (and, if you buy as a business, its name and tax number) if you pre-order a Playnitive, and the email address of your app account if you ask us here to delete it. If you arrive from one of our ads on Facebook or Instagram, it also covers what we may tell Meta about that visit. It covers the website only. The toy and the parent app have their own privacy notice.
Who is responsible
The data controller is Playnitive Kft. (company registration number 01-09-456341, tax number 33048116-2-43, registered by Fővárosi Törvényszék Cégbírósága). Full company details, including the registered seat, are on the contact page. You can reach us at info@playnitive.com for anything relating to your data.
What we collect
For the waitlist and a free reservation: only your email address, the language version of the site you signed up on, the date and time you gave consent, and for a reservation how many plushes you reserved. For the contact form: your name, your email address, the topic you picked and the message you wrote. For an account deletion request: the email address of the account you created in the Playnitive app, your name if you give it, whether you want the toys' data deleted along with the account, and the reason if you write one. For a pre-order: your name, your email address, the shipping address and the billing address you enter at checkout, the business name and tax number if you buy as a business, the amount, the currency and a payment reference. We also issue an invoice for the deposit (an advance invoice) from the same details: your name, your email address and your billing address, or your shipping address on an order placed before the payment page asked for a billing address. If you buy as a business, or ask us to afterwards, the invoice is made out to the company, with its name, address and tax number. Your card details never reach us, which is explained under Paying for a pre-order below. Shortly before a pre-order ships we also ask you, by email, for your child's first name, so that it can be printed on the adoption certificate that comes in the box. That one is optional: say no, or ignore the email, and the certificate is printed without a name. We do not ask for an address unless you are buying something we deliver, and that first name is the only thing we ever ask about a child. For the "try it" demo: the sentence you type, which has its own section below. Your IP address is used momentarily to limit abuse of the forms and of the demo and, in the cases described under Measuring our Meta ads, passed on to Meta with an event; it is never stored. If you arrive from one of our ads on Facebook or Instagram: the click identifier Meta adds to the link, the pages you open, and whether you read the pre-order offer, reserve a plush, start a payment and pre-order, all described under Measuring our Meta ads below. Separately from all of this, we count anonymous usage of the site itself, which is described under Website analytics below.
Why we use it
To email you about the Playnitive launch and product news if you asked for that, and, if you reserved a plush for free, to tell you before the first production run is made, to answer the message you sent us, and to find, confirm and delete the app account you asked us to delete and tell you when it is done. If you pre-order: to reserve your Playnitive, to issue the invoice for your deposit and email it to you, to invoice the remainder and deliver it, to refund you if you change your mind, to print the adoption certificate that goes in the box if you gave us a name for it, and to keep the accounting record the law requires of us. If you use the demo: to write the answer you asked for, to speak it, and to remember the previous turn during that visit. If you arrive from one of our Meta ads: to tell Meta which of its ads led to a visit, a reservation or a pre-order, in the cases described under Measuring our Meta ads. Nothing else. We do not build profiles or advertising audiences ourselves, we will never sell your details, and the only advertising platform that receives anything from us is Meta, and only as that section describes. The anonymous usage counts described under Website analytics are kept separate and cannot be linked back to you.
Legal basis
For the waitlist, a free reservation and the contact form: your consent, under Article 6(1)(a) GDPR. You gave it by ticking the box on the signup, reservation or contact form, and you can withdraw it at any time. For a pre-order: performance of a contract, under Article 6(1)(b) GDPR, because a toy cannot be reserved or delivered without knowing who it is for and where it goes, together with our legal obligation under Article 6(1)(c) GDPR to invoice the payment and to keep the accounting record that follows from it. For your child's first name on the certificate: your consent again, under Article 6(1)(a) GDPR, which is why it is asked for separately, why it is optional, and why the certificate is printed without it if you would rather not. For an account deletion request: our legal obligation under Article 6(1)(c) GDPR, because Article 17 GDPR requires us to act on a request to erase data, and confirming the request from the address on the account before we act is how we make sure it is yours. For measuring our Meta ads: see that section below.
How long we keep it
Waitlist signups and free reservations: until you unsubscribe, or until 24 months after the product launch, whichever comes first. Contact form messages: until the matter is closed and for up to 24 months afterwards, so we can follow up on a previous conversation. Account deletion requests: the request, your confirmation and our reply that it was done are kept for five years from the deletion, the general limitation period under Hungarian civil law, so that we can show a request was acted on. The account itself is gone long before that. Pre-orders: the order record and its invoices are kept for as long as Hungarian accounting law requires, which is eight years from the end of the year the transaction falls in. That period is a legal obligation, so it is the one thing we cannot delete earlier on request. Your child's first name is not part of that record: it is deleted once the certificate has been printed and the order has shipped. Demo messages: up to 30 minutes after the last turn, when the session and everything in it is deleted automatically. On your device, if you answer the question about our Meta ads: your answer for 180 days and, after a yes, the click identifier of the ad for 90 days; what Meta receives, Meta keeps under its own rules. After these periods your data is deleted.
Who else sees it
Our email provider, which stores and delivers the messages on our behalf; our hosting provider; PostHog, which counts anonymous website usage as described below; Microsoft, which runs the language model and the speech synthesis behind the "try it" demo; and, if you pre-order, Stripe, which takes the payment, and Billingo, which issues the invoice for it. All six work for us under a data processing agreement. The first four process data within the European Union. Microsoft also monitors its model for abuse, and a message its filter flags may be kept and read by its staff within the European Economic Area, which is the one copy of a demo message that is not ours to delete. Stripe is described in its own section below, because payment data does not follow quite the same rules. Billingo (Billingo Technologies Zrt., Budapest) passes the data of every invoice on to the Hungarian tax authority (NAV), as Hungarian VAT law requires; when the buyer is a private person, that report does not include the name or the address. If you arrive from one of our Meta ads, Meta also receives the data described under Measuring our Meta ads, not as our processor but as a controller in its own right. Nobody else.
Paying for a pre-order
The payment page you are sent to is Stripe's, not ours. Your card number, its expiry date and its security code are typed into Stripe and never reach our servers, our email or our systems in any form. What comes back to us is your name, your email address, the shipping and billing addresses you entered, the business name and tax number if you gave them, the amount, the currency and a payment reference, and that is what our order record contains, together with the invoice we issue for your deposit. Stripe here is Stripe Payments Europe, Limited, in Ireland. It acts as our processor for taking the payment, and as a data controller in its own right for the fraud prevention and anti-money-laundering checks the law requires of it, which is why it also has its own privacy policy. Stripe may transfer some data to its group companies outside the European Union under the European Commission's standard contractual clauses. If you ask for a refund, we ask Stripe to send the money back to the card you paid with, and that is the only reason we would touch the payment again.
Your rights
You can ask us for a copy of your data, correct it, delete it, or withdraw consent. Just reply to any email from us, or write to info@playnitive.com. We will act within 30 days. To delete the account you created in the Playnitive app, use the account deletion page, or the Delete account button in the app itself. The one exception is the accounting record behind a pre-order, its invoices included, which we are required by law to keep for the period described above; everything else about that order can still be corrected or removed. You can change your answer about our Meta ads at any time with the Meta ads measurement link at the bottom of every page. You also have the right to complain to the Hungarian data protection authority (NAIH).
Website analytics
We use PostHog to count how the site is used: which pages are opened, which questions in the FAQ and the troubleshooting guide are read, whether a video was played, and whether a form was submitted. It runs in cookieless mode, so it stores nothing on your device and sets no cookie, which is why it needs no cookie banner; the only question this site may ask you is the one about our Meta ads, described in the next section. It never receives your email address, your name or anything you typed into a form: only that a submission happened, which topic you picked, for a reservation or a pre-order how many plushes it was for, and for a pre-order the amount of the deposit. PostHog processes the data on servers in the European Union on our behalf, under a data processing agreement. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in understanding what people find unclear about a product for children, and you can switch it off by turning on Do Not Track in your browser, which we honour.
Measuring our Meta ads
We advertise on Facebook and Instagram, and we use Meta's Conversions API to learn which ads lead to pre-orders. It runs on our server, not as a Meta script in your browser, and it only ever concerns visits that arrive from a Facebook or Instagram link, to which Meta adds a click identifier. Those visitors find an optional checkbox in the pre-order box. If you tick it, our server tells Meta that you arrived with that click identifier and, for a free reservation, that you reserved, or for a pre-order, when you start the payment and afterwards whether you pre-ordered, with the amount. The same question for your whole visit sits behind the Meta ads measurement link at the bottom of every page: if you say yes there, our server also tells Meta which of our pages you open and whether you read the pre-order offer. Each of these goes with your IP address and your browser's identification (user agent) at that moment, which we pass on without storing them, and a reservation or a pre-order also with a SHA-256 hash of your email address, from which Meta can recognise your account. Meta uses this to measure our ads and to decide whom to show them to. Nothing about your child is ever sent, and nothing at all is sent if you leave the box unticked, say no or arrive from anywhere else. The answer you give with that link is kept on your device for 180 days, in your browser's local storage rather than in a cookie, together with the click identifier for 90 days if you said yes, and you can change it there at any time. A tick in the pre-order box covers that one reservation or pre-order and is not stored on your device. For a pre-order, the click identifier is also kept with the payment session at Stripe. The recipient is Meta Platforms Ireland Limited, which uses the data as a controller in its own right and may transfer it to Meta Platforms, Inc. in the United States under the EU-US Data Privacy Framework. The legal basis is your consent under Article 6(1)(a) GDPR, which you can withdraw at any time with the Meta ads measurement link.
The "try it" demo
On the Try it page you can type a sentence and hear Lotti speak the answer. What you type is sent to the language model that writes the answer, and is held encrypted on our server for up to 30 minutes so that Lotti remembers the previous turn within the same visit. It is deleted when that expires. It is never attached to you, never emailed to us, and never reaches our analytics: PostHog is told that a demo turn happened and nothing at all about what was in it. Nothing is stored on your device, so the demo sets no cookie and writes nothing into your browser storage. There is no microphone: the demo reads text, and nothing is ever recorded from you. Your IP address is used, in memory and for that hour only, to limit how many turns can be taken from one address and one network, and it is never stored alongside anything you typed. The page asks you not to type your child's name or other personal details, because the demo is aimed at you rather than at your child and nothing in it needs them. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in letting you hear what the product does before you decide whether to buy it; you exercise the choice by deciding whether to type anything at all.