Privacy Policy

The plain-language version of how Doodle Bazaar handles your information. We are a tiny shop, we collect as little as we can, and we never sell your personal data.

Last updated: 7 July 2026

For the shop owner: before publishing, fill in the bracketed legal details below (registered business name, postal address, and the contact email you want to use). Everything else describes what the site actually does today.

1. Who we are

Doodle Bazaar (“we”, “us”) is the shop at doodlebazaar.com. For data-protection law (including the EU/UK GDPR) we are the data controller for the information described here.

Controller: [Registered business name], [postal address]. Questions or requests: [email protected].

2. What we collect, and why

Information	Why we have it	Lawful basis (GDPR Art. 6)
Account - your email, a display name, sign-in method, and (if you sign in with Google) your Google display name and profile picture.	To give you an account, remember you, and let you see your orders.	Performance of a contract; and consent for Google sign-in.
Your doodle - the small style choices for your avatar (colour, hat, face, extra). No photo, no biometric data.	So your doodle can greet you around the shop.	Performance of a contract / your request.
Orders - name, shipping address, phone, the items you bought, and the amount. Payment is handled by Stripe; we never see or store your card number.	To take payment, ship your order, and keep tax records.	Contract; and legal obligation (accounting).
Essential cookies - a session cookie that keeps your cart and sign-in working, and a note of your cookie choice.	The shop cannot work without these.	Legitimate interest / strictly necessary.
Optional analytics - only if you choose “Accept all”. A random per-visit ID (not linked to your name), the pages you view, funnel steps (viewed a product, added to cart, began checkout), search terms, scroll depth and time on a page, plus your device size, language, the site you arrived from, any campaign tags, and your country (from our network provider - we do not store your IP address).	To understand how the shop is used and make it better and easier to buy from.	Your consent.
Server logs - standard technical logs kept briefly for security and debugging.	To keep the site safe and working.	Legitimate interest.

We do not use analytics to track you across other websites, we do not run third-party advertising trackers, and we do not sell or rent your personal data to anyone.

If you join our mailing list, you can leave any time - every letter has an unsubscribe link, or email [email protected] and we'll remove you by hand.

3. Cookies and your choice

On your first visit we ask a simple question. “Only essential” keeps just the cookies the shop needs to work. “Accept all” additionally turns on the first-party analytics described above. You can change your mind at any time by clearing this site's data in your browser (which forgets your choice and switches analytics off until you choose again). If you never choose, analytics stay off.

4. Who we share information with

Only the service providers we need to run the shop, each acting for us under contract:

Stripe - to process payments securely (they receive your payment and contact details directly; we receive a confirmation, never your card number).
Our fulfilment / supplier partners (e.g. CJ Dropshipping) - to pack and ship your order; they receive your name and delivery address.
Google - only if you choose to sign in with Google.
Our hosting and network providers (server host and Cloudflare) - to serve the site and keep it secure.

5. Sending data outside the EEA

Some of these providers process data outside the European Economic Area. Where that happens we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses or an adequacy decision). Contact us for details.

6. How long we keep it

Account & doodle - until you delete your account or ask us to.
Orders - as long as tax and accounting law requires (typically up to several years).
Analytics - automatically deleted after 90 days.
Server logs - kept only briefly.

7. Your rights

Under the GDPR you can ask us to:

see the personal data we hold about you (access);
correct anything that's wrong (rectification);
delete your data (erasure / “be forgotten”);
restrict or object to certain uses;
receive your data in a portable format;
withdraw consent at any time (for example, switch analytics back off) - this doesn't affect anything done before you withdrew.

Email [email protected] and we'll respond within one month. You also have the right to complain to your local data-protection authority.

A note on analytics and your rights: the analytics data uses a random per-visit ID that is not connected to your name or email, so we usually cannot single out “your” analytics rows to show or delete them. It is deleted automatically within 90 days regardless. Your account and order data, which are linked to you, we can always find and act on.

8. Children

Doodle Bazaar is not intended for children under 16, and we don't knowingly collect their data.

9. Changes

If we change this policy we'll update the date above and, for significant changes, let signed-in shoppers know.