Privacy Policy

Who looks after your details

This website is run by Toy Gate, the toy shop on Eastern Boulevard, Saida, Lebanon. Toy Gate is responsible for the details you give through it. For anything on this page, message us on WhatsApp at +961 79 30 81 41 or email toygate.lb@gmail.com.

What we collect, and why

• When you order: your name, phone number, delivery area and street address, plus an email address and delivery notes if you choose to give them. For a gift, also the gift message, who it is from and the date you need it by. We use these to confirm the order with you, deliver it and answer questions about it.
• If an order does not go through: your name, phone number, area and the toys in your cart. We may message you once on WhatsApp about it, as checkout says under the Place order button.
• Tell me when it's back: your WhatsApp number, your name if you give it, the toy, and the sentence you ticked. We message you once when that toy is back, and about nothing else.
• The Birthday Club: your name, your WhatsApp number, your child’s first name if you give it, and the birthday (day and month, and the year if you give it). We message you on WhatsApp a few days before the birthday: one birthday message a year for each child.
• Offers on WhatsApp: only if you tick the box asking for them. We send no more than 3 messages in a month, and you can reply STOP at any time.
• If you make an account: your email address, and the name, phone number and delivery addresses you choose to save, your wishlist, the orders placed while signed in or that you add with the order number and phone, and the birthdays you add. We use them to fill in checkout for you and to show you your orders. An account is optional; you can always order as a guest.
• Any box you tick agreeing to messages from the shop: we keep the exact sentence you agreed to and when, so it is always clear what you said yes to.
• The shop’s own notes: the shop may note things about your orders, such as your Instagram name or a reminder you asked for. Only the shop’s owner-level logins can see them.
• Messages you send us on WhatsApp stay in the shop’s WhatsApp.

The Birthday Club is the only place the website asks about a child: a first name, which is optional, and a birthday. We use them only for the birthday message. The website is meant for parents and other adults buying toys, not for children to use on their own.

Card details and payment

Today every order is paid in cash when it reaches you, so the website does not ask for card details. If card payment is added, it will be processed by our payment provider, MontyPay, on its secure checkout, and Toy Gate will never see or store your full card details.

All credit and debit card details and personally identifiable information will not be stored, sold, shared, rented or leased to any third party.

Cookies and your browser

Your cart and your gift choices are kept in your own browser so they survive a refresh. They hold which toys and how many, nothing about you, and they are not cookies.

The website sets these small first-party cookies, which only the Toy Gate website can read:

• A visit cookie (tg_fs): a random number that ends after 30 minutes without activity. It lets us count how many visits look at a toy, add to the cart, start checkout and place an order, so we can see where ordering goes wrong. It holds no name, phone number or address, and the counts are deleted after 180 days.
• Arrival cookies (tg_land, tg_utm and tg_src), kept for 30 days: the page you first arrived on, the website or link that sent you, and the tags on any link we shared, for example from our Instagram. They are read only when you place an order, so we know which posts bring orders.
• Sign-in cookies, only if you sign in to an account: they keep you signed in until you sign out. A short cookie (tg_next) remembers for up to one hour which page to bring you back to after you ask for a sign-in link.
• A staff cookie (tg_staff), only on the browsers of the shop’s own team who sign in to the shop’s admin, so their visits are not counted as shoppers. Shoppers never receive it.

We count page views with Vercel Web Analytics, which uses no cookies. It never receives the account, order or admin pages, or anything after the question mark in a web address.

Google Analytics also sets its own cookies (named _ga) when you visit, to tell a returning visit from a new one; see Who else handles it.

You can block or delete cookies in your browser settings. You can still browse and order without them; you need them only to stay signed in to an account.

Who else handles it

We do not sell or rent your details, and we do not give them to anyone to market to you. We share them only with the services that help us run the shop, and only as far as each needs:

• The website runs on Vercel, and its database is hosted by Supabase in Frankfurt, Germany. Like any website, the hosting keeps short technical logs, such as the address of the device that made a request.
• The person who delivers your order sees the name, phone number and address needed to deliver it.
• WhatsApp carries the messages between you and the shop. The shop sends its messages by hand from its own WhatsApp.
• If you make an account, your sign-in links are emailed by the website’s sign-in service (Supabase), and your email address is kept there with the account.

The website does not use any advertising tracking today.

We use Google Analytics, from Google, to count visits and see which pages and toys people look at, what goes into carts and how many orders are placed, so we can improve the shop. It sets cookies to tell one visit from the next. We have switched off its advertising features: it is not used to show you ads, and it is not linked to your Google account. It never receives the account, order or admin pages, and we never send it your name, phone number, email address, delivery address or order number. Google explains how it uses this information at policies.google.com/technologies/partner-sites.

We may also share details where the law requires it, for example to answer a valid request from a Lebanese authority.

How long we keep it

• Orders: the name, phone number, email and address on an order are kept for 3 years after it is delivered, then removed. What was bought and paid stays, without your name, so the shop’s accounts still add up.
• A cart from a checkout that did not go through is deleted after 30 days. The name, phone number and area on that failed checkout are erased after 90 days; only a count stays.
• Tell me when it's back: a request that is not answered within 90 days expires and is never messaged, and every request is deleted 180 days after you made it.
• Visit counts are deleted after 180 days.
• The shop’s history of changes to orders and products is deleted after 24 months.
• If you tell us to stop messaging you, we keep a scrambled form of your number that cannot be turned back into it, so that we never message you again. That record is never deleted.
• An account, its saved addresses and wishlist are kept until you delete the account. You can do that yourself on the account page, at any time.
• Birthday Club sign-ups are kept until the child turns 12, or until you ask us to remove them, whichever comes first.
• WhatsApp chats are kept in the shop’s WhatsApp for up to 2 years.

Your rights: stopping messages, seeing and deleting your details

Reply STOP to any message from us and we will not message you again.

To see what we hold about you, correct it or have it deleted, message us on WhatsApp at +961 79 30 81 41 from the number you gave us, or email toygate.lb@gmail.com. We answer within 14 days. We may ask you to confirm the request from the phone number on the order, so nobody else can ask for your details.

If you have an account, you can change your details, remove saved addresses, wishlist toys and birthdays, turn birthday and occasion offers off, and delete the account yourself, on the account page. Deleting the account removes your name, phone number and address from the orders in it, as below.

When we delete your details, your name, phone number, email, address and gift words are removed from your orders, and your Birthday Club sign-ups, back-in-stock requests, saved carts and the shop’s notes about you are deleted. What you bought and what you paid stay, without your name, so the shop’s accounts still add up. Your number is added, scrambled, to the list we never message.

You can also ask in person at the shop on Eastern Boulevard, Saida, open 10am to 7pm in winter.

Keeping it safe

The website uses an encrypted connection (https) on every page. The shop’s admin is behind a login, and a staff login can run orders and products but cannot see customer names and phone numbers. No website can promise perfect security, but we keep access to your details to the people who need it.

Changes to this policy

When this policy changes, the date at the top changes with it. See also our Terms and Conditions, Shipping Policy and Returns and Refund Policy.