Squiggle Tags Make your labels

Privacy policy

Last updated

This page says what we collect when you make labels with us, and why. It also says who else sees it, how long we keep it, and how you can see, correct or delete it. We follow New Zealand's Privacy Act 2020.

The short version

Who we are

Squiggle Tags is a sole trader business in Tāmaki Makaurau Auckland, New Zealand. We make name labels for children at squiggletags.co.nz.

Our privacy officer looks after the information we hold and answers questions about it. Email hello@squiggletags.co.nz.

If you need our full name, postal address and phone number for a privacy request or a legal claim (at the Disputes Tribunal, say), email us and we'll give them to you.

What we collect, and why

Here's what we collect at each step of making labels, and what it's for.

When you arrive

If you followed a link from one of our ads, we note the ad's tags in that link. They say which ad it was. Facebook and Google also add a click id to their links, and we keep it with the tags. We note the first page you opened too, and the name of the website that sent you.

Your browser gives your visit a random number. It tells us when your visit reaches each step, from our home page to a paid order. We use this to count how many visits reach each step, and which ads they came from. None of it includes your internet address, your name or your email address.

For 3 days, we keep which steps each visit's number has reached, so no step is counted twice. After that we keep only each day's totals.

A photo of the drawing

If you take or choose a photo of a drawing, we upload it and cut the drawing out as a sticker. We keep the photo and the sticker, to show you your labels and to print them. We don't keep the photo's file name. You don't have to give us a photo: you can choose one of our characters, or just the name.

Photos can carry hidden details from your phone, like when and where they were taken. We remove them as your photo reaches us, and keep only the picture. We use them only to turn the photo the right way up first.

Your child's name and the label choices

To make name labels, we need the name to print and your choice of lettering, colour and words (like Nā). While you design, these stay in your browser. They come to us as saved labels when you email the labels to yourself or order them.

If you email yourself the labels

“Email me these labels” asks for your email address. We use it to send you a link back to your labels.

We keep your email address with your saved labels, and when we sent them. If you tick the box for occasional emails about new characters and offers, we keep that too, with the words you agreed to. We also keep a coded copy of the address, so the same labels aren't sent to the same address twice. All of these are deleted with the saved labels.

When you order

You pay on Stripe's checkout page. Stripe asks for your email address, your name and a New Zealand postal address, and passes them to us. We use them to post your labels and to email you about your order: a confirmation, a note when your labels are posted, and any refund. Stripe takes your card, Apple Pay or Google Pay payment itself. We never see your card number.

The order keeps your child's name and the label design, your email address, name and postal address, and Stripe's reference for the payment (we need it for refunds). If you post the labels to someone else, please let them know we use their name and address only to post the labels.

Your saved labels and order also note which ad or website you came from, and your visit's random number. This tells us which ads lead to orders.

Daily limits

We limit how many photo cut-outs, emails and error reports one household, or a computer program, can use in a day. To do this, we count them by a coded version of your internet address. We use it only for that day's count, and it's deleted within a few days.

If something goes wrong

If one of our pages breaks in your browser, it sends us a short error report. It says what went wrong in our code, and on which page (without your order number). It doesn't include your name, email address or photo. We keep error reports in our server logs for 30 days.

Your child's information

Your child's name and drawing come to us from you, as their parent or caregiver, not from your child. We collect them only to make and post their labels. Everyone who sees them is listed under Who else sees it. We never use your child's drawing in our own pictures or ads without asking you first.

You might like to tell your child about this. They can ask us what we hold about them, or ask us to correct or delete it, just as you can for them (see Seeing, correcting and deleting your information).

Who else sees it, and where

We use a few companies to run the shop. Some only store and handle information for us. Others also use it for their own purposes, under their own privacy policies.

Working for us

Also using it under their own policies

If Stability AI can't cut the drawing out

This is switched off for now. Before we switch it on, we'll update this page and the date at the top.

Once it's on, AWS can cut the drawing out instead if we can't reach Stability AI, or Stability AI turns your photo away before cutting it out (because it's too busy, say). We never send AWS a photo that Stability AI refuses under its safety rules. AWS runs Stability AI's cut-out model itself, on its Amazon Bedrock service, in the United States.

We send AWS the same copy of your photo we'd have sent Stability AI. Nothing else goes with it: not your child's name, your email address or anything else about you. The sticker comes back to us in Sydney.

AWS may check each photo automatically against its own rules and Stability AI's. It may keep a photo its checks flag, to look into it. Otherwise it keeps no copy of its own of your photo or the sticker. It doesn't use them to train any models, and doesn't pass them to Stability AI.

If you came from our Facebook or Instagram ad

This is switched off for now. Before we switch it on, we'll update this page and the date at the top.

Once it's on, we tell Meta about your purchase if you came from one of our Facebook or Instagram ads and paid for an order. This lets us see which ads work. We know you came from our ad because the link had our ad's tag as well as Facebook's click id. Only a link with our ad's tag counts. A plain link to us that someone shared doesn't. We send:

We don't send your name, your postal address, or your child's name or drawing. No Meta code runs on our site.

We keep your internet address and browser details with the order only until we've told Meta. If the order isn't paid, or we can't reach Meta, we remove them within 30 days.

Meta handles what we send in the United States and elsewhere. It uses it under its own terms, the Meta Business Tools Terms, and its privacy policy.

If you came from our Google ad

This is switched off for now. Before we switch it on, we'll update this page and the date at the top.

Once it's on, we tell Google about your purchase if you came from one of our Google ads and paid for an order. This lets us see which ads work. We know you came from our ad because the link had our ad's tag as well as Google's click id. Only a link with our ad's tag counts. A plain link to us that someone shared, or a normal Google search result, doesn't. We send:

We don't send your name, postal address, email address or phone number, your internet address or your browser's details, or your child's name or drawing. We tell Google not to use what we send to personalise ads. We don't tell Google you've agreed to anything. No Google code runs on our site, and Google sets no cookies on it.

We usually tell Google 6 to 30 hours after you order.

Google handles what we send in the United States and elsewhere. It uses it under its own terms, the Google Ads Controller-Controller Data Protection Terms, and its privacy policy. Google also explains how it uses information from sites that use its services.

Information outside New Zealand

AWS stores and handles your information for us in Australia. Stability AI, Stripe, Cloudflare, Meta and Google may handle it in the United States and other countries, under their own privacy policies, linked above. Once we've switched it on, AWS may also cut the drawing out for us in the United States, when Stability AI can't (see above).

We don't sell your information. Beyond the companies above, we only share it if you ask us to, to sort out a payment dispute with your bank, or when the law requires it.

Emails from us

We only email you about your labels: the link you ask for, your order confirmation, a note when your labels are posted, and any refund. If you reply to one, it comes to hello@squiggletags.co.nz.

We only send emails about new characters and offers if you tick the box, and every one lets you unsubscribe. You can also ask us to stop at any time by emailing us.

How long we keep it

Our backups keep deleted information for up to 35 days more, then it's gone from them too.

You can ask us to delete your information sooner. We'll delete everything we hold that we don't need to keep for tax.

Keeping it safe

If a privacy breach is likely to cause serious harm, we'll tell you and the Privacy Commissioner as soon as we can.

Seeing, correcting and deleting your information

You can ask us for the information we hold about you or your child. You can also ask us to correct it, or to delete it. Email hello@squiggletags.co.nz. So we know it's you, we may ask you to write from the email address you used with us.

We'll answer as soon as we can, and within 20 working days. If you ask us to delete your information, we'll delete everything we hold that we don't need to keep for tax. Stability AI keeps its own copy of your photo, under its privacy policy.

If you're not happy with how we've handled your information or your request, tell us first and we'll try to put it right. You can also complain to the Privacy Commissioner at privacy.org.nz.

Cookies and your browser

We don't use cookies. To keep your place, your browser keeps a few things for our site in its storage for this tab only:

They go when you close the tab, and nothing is used to follow you to other websites. Stripe's checkout page is Stripe's own site, with its own cookies. Cloudflare's check runs in a frame from Cloudflare's own site.

Changes to this policy

If we change this policy, we'll update this page and the date at the top.