Last updated 24 October 2026
Privacy and cookies
What information Squigglestick collects, why, who helps us handle it, how long we keep it, and your rights. Squigglestick is in a friends-and-family test, and this notice describes the site as it works today.
The short version
- We use your drawing only to make your sticker, and to print it if you order.
- Only you can see it. We never sell it, show it publicly or use it to train AI.
- While we test, we keep drawings until you ask us to delete them. Automatic deletion after 30 days is coming before we open to everyone.
- One essential cookie. No tracking or advertising cookies, so no cookie banner.
- You can ask to see or delete your information at any time.
If you’re a child, this bit is for you
When you make a sticker, we look at your drawing so we can turn it into a sticker. We don’t show it to anyone else, and we never sell it. If anything worries you, talk to a grown-up you trust. They can ask us questions too.
1. Who we are
Squigglestick is a small UK business. We’re the “controller” of your information: we decide how it’s used, and we’re responsible for looking after it.
To contact us about privacy, email support@squigglestick.co.uk with “Privacy” in the subject. For physical mail correspondence, please contact us at support@squigglestick.co.uk to request our temporary mailing address.
2. What we collect
When you make a sticker
- Your drawing: the photo you upload or the drawing you make on screen, including any words typed on it. A drawing can include personal information, such as a child’s name written on it.
- The stickers we make from it, and the AI’s written notes about the drawing (what it shows, its colours and any writing on it).
- The result of our safety check.
- A random ID in a cookie, which links your stickers to your browser (see Cookies).
- A scrambled code made from your internet (IP) address, used for the daily limits and to stop misuse. It can’t be turned back into your IP address.
Like most websites, our hosting provider also records basic technical details of each visit, such as the IP address and the page requested, to keep the service running and secure.
When you order printed stickers
Printed stickers are coming soon. When they’re on sale, we’ll also collect:
- Your name, delivery address and email address, which you enter on Stripe’s secure payment page.
- What you ordered, the price and the delivery option.
- Confirmation that you’ve paid. We never see your card number.
When you contact us
- Your email address and whatever you choose to tell us.
What we don’t collect
We don’t ask for your child’s age, birthday or surname. We don’t use your location, we don’t build profiles of anyone, and we don’t track you across other websites. We remove hidden location and camera details from every photo you upload.
3. Why we use it, and our legal reasons
Data protection law says we must have a legal reason (a “lawful basis”) for each thing we do with your information. Here they are.
| What we do | Information used | Legal reason |
|---|---|---|
| Make your sticker and show it to you | Drawing, stickers, AI notes, cookie ID | Contract: you’ve asked us to make it |
| Check pictures are safe and not misused | Drawing, check result | Legitimate interests: keeping children and the service safe |
| Daily free limits, and stopping abuse and fraud | Cookie ID, scrambled IP code | Legitimate interests: keeping the service fair, safe and affordable |
| Print and post your order, and contact you about it | Name, address, email, order, sticker | Contract |
| Keep accounting and tax records | Order and payment records | Legal obligation |
| Answer your messages and put things right | Email address, your message | Legitimate interests (or contract, if it’s about an order) |
Where we rely on legitimate interests, we’ve weighed them against your rights, especially children’s. You can object at any time (see Your rights).
We don’t send marketing emails. If we ever start a newsletter, we’ll only send it to people who ask for it.
4. Automatic checks
Our safety check is automatic: an AI model decides whether a picture can be made into a sticker. The most it can do is stop a picture being used. If you think it got it wrong, email us and a person will look at it again.
5. Who we share it with
We use a small number of trusted companies to run the service. They work for us under data protection contracts, which limit what they can do with your information. We never sell or rent your information, and we don’t share it with advertisers.
| Who | What they do | Where |
|---|---|---|
| AI service providers | Check each picture is safe, note what the drawing shows, redraw it as a sticker and cut it out | USA |
| Our hosting provider | Runs our website and database | Europe (technical logs may be kept in the USA) |
| Our storage provider | Stores the pictures, encrypted | Europe |
| Our email provider | Carries the emails you send us and our replies | USA |
| Stripe (when orders open) | Takes your payment, and collects your delivery address and email for us | UK and USA |
| Our printing partner (when orders open) | Prints your stickers and posts them to you. It gets your name, delivery address and the sticker picture, not your email address | UK |
If you’d like the names of the companies we use, email us and we’ll tell you.
We’d only share your information otherwise if the law requires it (for example, a court order), or to protect a child from harm. If Squigglestick is ever sold, your information would pass to the new owner only on the same terms as this notice.
6. Information sent outside the UK
Some of the companies we use are based in, or keep some data in, the USA. When information goes outside the UK, it’s protected by contract terms approved by the UK (the ICO’s International Data Transfer Agreement or Addendum), or by the UK–US “data bridge” where a company is certified under it. You can ask us for details.
7. How long we keep it
| Information | How long |
|---|---|
| Drawings, stickers, the AI’s notes and safety check results | While we test, until you ask us to delete them. Before we open to everyone, automatic deletion will remove them 30 days after they’re made (90 days after an order), including anything older from the test. |
| Copies at our AI service providers | Up to 30 days, except the finished sticker pictures at one provider, which don’t have a set deletion date yet. We’re fixing this during the test. |
| Order records (name, address, items, payment) | 6 years, because tax law requires it |
| Emails to us | Up to 12 months after the matter is sorted |
| Our hosting provider’s technical logs | Up to 90 days |
| The visitor cookie | Up to 13 months |
8. Your rights
You have the right to:
- ask for a copy of your information
- ask us to correct it
- ask us to delete it
- object to how we use it, or ask us to limit it
- ask for it in a format you can take elsewhere
Parents and guardians can make these requests for their children, and children can make them for themselves. Email support@squigglestick.co.uk with “Privacy” in the subject. It’s free, and we’ll reply within one month.
As there are no accounts, please tell us the day and roughly the time you made your sticker and what the drawing shows, so we can find it. We may ask a question or two to check we’re dealing with the right person.
9. Cookies
We use one cookie, and it’s essential: without it the site can’t work. The law doesn’t require us to ask permission for essential cookies, which is why there’s no cookie banner.
| Name | What it does | How long |
|---|---|---|
| vid | A random ID that tells our site which stickers are yours, so nobody else can see them. It also counts your free goes, and keeps your basket and the list of your orders on this device. It contains nothing about you. | Up to 13 months |
Your browser also keeps a note of the sticker you’re working on (in its “session storage”), so refreshing the page doesn’t lose it. The note is deleted when you close the tab.
We don’t use analytics, advertising or social media cookies. If that changes, we’ll update this notice first, and ask your permission where the law requires it.
10. Children
Children use Squigglestick with their families, so we’ve designed it with them in mind, following the ICO’s Age Appropriate Design Code (the Children’s code). Privacy is set high from the start, we collect as little as we can, we don’t profile anyone, we don’t use location, and nothing nudges anyone to share more. We’ve also written a risk assessment of how we handle children’s drawings.
Orders must be placed by an adult (18 or over).
11. Keeping it secure
Everything is encrypted between your device and our site, pictures are stored privately, and every link to a picture expires. Read more on our Safety page.
12. Complaints
If you’re unhappy with how we’ve handled your information, please tell us first. We’ll reply within 30 days and do our best to put it right.
You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
13. Changes to this notice
If we change this notice, we’ll update the date at the top. If it’s an important change, such as switching on automatic deletion or opening orders, we’ll say so on our home page too.