Privacy Policy
What World Plush Inc collects, why, and how you get it back or deleted.
What we collect
When you shop: your name, email, phone number and shipping address, what you ordered and what you paid. Card details are entered on our payment provider’s hosted checkout page; we never see or store your card number. When you browse: a session identifier, and — only if you allow analytics or personalisation — the pages, stories and products you view, tied to a pseudonymous visitor identifier rather than your name. When you use the gift finder or quiz: your answers, used to suggest gifts in that session. When you sign up for email: your email address and the fact that you agreed. When you post to the community wall: what you write, any links you add, and whether you chose to post anonymously. If you are a creator we work with, or might work with: your name or handle, contact email, public profile and public post information from the platforms you publish on, our messages to you, your partner-portal activity, the agreement and disclosure terms you accepted (with date and version), tax form status, and payout details. When you contact us: what you send us.
Why we collect it
To take, pay for, pack and deliver your order and to handle returns (performing our contract with you). To keep records we are required to keep, such as tax records (legal obligation). To prevent fraud and keep the site and community safe (legitimate interests). To send marketing email, measure how the site is used, and personalise what you see — only where you have said yes (consent). To run our creator program: contacting creators, attributing sales to them and paying commission (contract and legitimate interests).
Consent, and how to withdraw it
Analytics, personalisation, marketing email, advertising and publishing your community posts are each a separate choice, and each is off until you turn it on. You can change any of them at any time in the privacy centre on your account page, or by writing to us. Every marketing email has a one-click unsubscribe link. Withdrawing consent stops future use; it does not undo what was lawfully done before. We honour Global Privacy Control signals sent by your browser as a request to opt out.
Children's data (COPPA)
Our products are gifts, and our site is intended for adults who buy them. We do not knowingly collect personal information from children under 13, and children under 13 should not post to the community wall or sign up for email. If you believe a child has given us personal information, write to peter@plushitos.com and we will delete it.
Cookies, pixels and attribution
We use first-party cookies only, and no third-party advertising or analytics pixels. pl_sid — keeps your session together while you browse and check out; deleted when you close your browser (strictly necessary). If your browser sends a Global Privacy Control or Do Not Track signal, we do not set it. pl_consent — remembers the privacy choices you made so we do not ask again; kept for 365 days (strictly necessary). pl_lang — remembers the language you chose from the language menu, so every page opens in it; kept for 365 days (strictly necessary). We only set it when you choose a language yourself. Opening a link that already carries a language, such as one starting /es/, shows you that language but does not change what we remember. pl_lang_hx — holds only the last few languages you chose yourself, so that if you keep switching we can ask you once which one you prefer, and then stop asking; kept for 365 days (strictly necessary). It holds nothing else: no pages, no times, no identifier. pl_cart — holds what you put in your cart (which product, which option, how many), so that what you add on one of our sites is waiting in the same cart on the other; kept for 30 days from your last change (strictly necessary). We only set it when you add something to your cart. It holds nothing about you: no name, no address, no identifier. pl_ref — when you arrive through a creator’s link, remembers that creator’s code so that the creator is credited if you order later on the same browser (strictly necessary for our creator program). In the United States it is kept for 30 days from the last time you arrived through a creator’s link; elsewhere it is deleted when you close your browser. We only set it when the link you arrive through carries a creator code. It holds that code and nothing about you: no name, no address, no identifier. It is sent only to our own sites under this domain, so that the credit still works when you move from one of them to the other; it is not sent to the creator, to advertisers or to any other third party. We set it whether or not your browser sends a Global Privacy Control or Do Not Track signal, because it is not used to sell or share your information. We do not currently set a long-lived visitor identifier. If we introduce one, we will update this policy first, and it would only ever be set with your consent.
Text messages (SMS)
If you give us your phone number and agree to receive text messages from Plushitos, we keep a record of that consent: the date, how it was given, and who on our team recorded it. We use your number only to send you the messages you agreed to receive, and to handle your replies. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Your number and your consent record are not shared with anyone outside World Plush Inc except the messaging carrier that delivers the message to your phone. You can stop the messages at any time by replying STOP to any message from us. We record the opt-out and stop sending. Reply HELP for help, or write to peter@plushitos.com. Message and data rates may apply.
Who we share data with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with service providers who process it for us under contract: our website hosting provider; our database and file storage provider; our online store and our hosted payment provider (to take payment and manage orders); our email delivery provider; and the carriers we use to ship your order. Creators never receive buyers’ personal information. We may also disclose information to professional advisers, or where the law requires it.
How long we keep it
Browsing and activity events: 24 months, then deleted. Raw order notifications received from our store or payment provider: the personal details inside them are removed after 90 days. Order records: 7 years, because tax law requires it; if you ask us to delete your data, we remove your name and contact details from them and keep only what the law requires. Your shipping address is removed from an order when you ask for deletion. Records of the consents you gave or withdrew: kept as proof of your choices. Email: until you unsubscribe; we keep the address on a do-not-contact list so we can honour that choice. Community posts: until you delete them or withdraw publishing consent.
Your rights (CCPA/CPRA and others)
Depending on where you live, you can ask to: know what personal information we hold and get a copy (the privacy centre lets you export it); correct it; delete it (the privacy centre lets you request deletion); opt out of sale or sharing (we do neither); and limit the use of sensitive information (we do not collect it). We will not treat you differently for using these rights. An authorised agent may make a request for you. We verify requests by confirming control of the email address on the account or order, and we respond within 45 days.
How to reach us
Write to peter@plushitos.com. World Plush Inc is the company responsible for your personal information on this site.