Privacy Policy

1. Who we are

Kali.J Design, operating as The Toy Showroom, 1302 Monte Vista Ave, Suite 21, Upland, CA 91786. We are the business responsible for the information described here. Contact us any time at [email protected] or (909) 870-7095.

2. What we collect, and why

All of it comes directly from you. We do not buy lists and we do not append data about you from outside sources.

When you place an order

• Your email address — to send your receipt and tracking, and to reach you if something is wrong with the order. Required.
• Your name and shipping address — to rate the parcel with the carriers and print the label. Not collected if you choose local pickup.
• What you bought, what you paid, tax, shipping, and the carrier — this is our sales record, and we are required to keep it for tax purposes.
• Whether the order ships or is collected in person.

The checkout does not ask for a phone number. If we have your number, it is because you gave it to us on an offer, an appointment request, or in the showroom.

When you make an offer

We store the item, your offer amount, your email, your name and phone number if you chose to give them, any message you wrote, and the IP address the offer came from — the IP is kept to stop abuse and rate-limit spam offers, nothing else.

We keep offers even when we decline them, and we want to be straight about why: a declined offer tells us our asking price is wrong. That pricing history is genuinely useful to us. If you would rather we did not keep yours, say so and we will remove it.

When you book a visit or contact us

Your name, contact details and whatever you tell us, so we can be there when you arrive and answer your question.

What we never collect

Card numbers, CVV codes, bank account details. Those go straight to Stripe on Stripe's own page and never reach our servers. We also do not ask for your date of birth, your Social Security number, or a government ID for an online order.

3. The companies that see your data

This is the complete list of service providers involved in an order. Each one gets only what it needs to do its job, and none of them are permitted to use your information for their own marketing.

Val, our chat assistant

Val is an assistant, not a person. Most of what she answers — stock, prices, shipping estimates, hours — comes straight from our own catalogue and never leaves our server. When a question needs phrasing we could not look up, the message and the last few turns go to our AI provider (see the table above).

We keep the conversation, the page you were on, and your IP address, so that a real person can pick up the thread if you ask for one and so we can stop abuse. If you ask us to escalate, whatever you give us — name, email, phone — goes to the owner’s phone so a human can answer you. Anything Val tells you about an order, a price or a policy is our best information, not a binding offer — the terms on your order and our posted policies govern. If she gets something wrong, tell us and we will make it right.

Beyond that list, we disclose information only when the law requires it, or if the business is ever sold or transferred — in which case your information would move with the business records and this policy would continue to apply until you were told otherwise.

4. Cookies, and what is really in your browser

Most privacy policies have a long cookie section because most sites are full of trackers. Ours is short because this one is not.

• This storefront runs exactly one analytics tool: Google Analytics 4 (measurement ID G-P3TPY2Z44F). It sets the _ga and _ga_P3TPY2Z44F cookies, which distinguish one browser from another so we can count visitors and see which pages lead to a sale. We use it for measurement only; we have not enabled Google Signals, advertising personalisation, or remarketing audiences. Separately, opening the chat creates a short-lived session on our own server so a conversation survives a page reload — that cookie is ours and is used for nothing else.
• There is no Meta pixel, no TikTok pixel, and no advertising or retargeting tag anywhere on this site. We are not building advertising audiences out of your visit. If you would rather not be counted at all, Google publishes an official Google Analytics Opt-out Browser Add-on, and your browser’s cookie controls will also block it.
• Your cart is stored in your browser's own local storage under kjd_cart_v1. It never leaves your device until you check out. When you do, your browser sends us only the item numbers and quantities — we re-read the real prices ourselves.
• If you follow an accepted-offer link, your browser holds that offer token in session storage under kjd_offer_token until you close the tab.
• If you open the chat, your browser holds that conversation’s id in session storage under kjd_support_v1 so your place is not lost on a reload. It goes when you close the tab.
• You can wipe both at any time by clearing site data for this domain. You will lose your cart; nothing else happens.

One honest exception: when you go to pay, you are on Stripe's checkout page, and Stripe sets its own cookies there for fraud prevention. That is Stripe's domain under Stripe's privacy policy, and it is a normal part of not getting your card stolen.

Because we run no cross-site tracking, a Global Privacy Control or Do Not Track signal has nothing to switch off here. There is no behavioral profile of you to suppress.

5. We do not sell your personal information

We have never sold or rented personal information, and we do not share it for cross-context behavioral advertising. We do not disclose it to third parties for their own direct marketing, so there is nothing to request under California's “Shine the Light” law (Civil Code § 1798.83) — but ask us anyway if you want it confirmed in writing.

We do not knowingly collect or sell the personal information of anyone under 16.

6. How long we keep things

• Sales records — kept for at least four years, because California requires sellers to retain records supporting their sales and use tax returns. We cannot delete these while that obligation runs.
• Offers — kept as pricing history. Removed or anonymized on request.
• Emails and messages you send us — kept while they are useful for support, then cleared out.
• Marketing contacts — until you unsubscribe or ask us to remove you.

7. Your California rights — the honest version

The California Consumer Privacy Act, as amended by the CPRA, applies to a business only if it meets at least one of these three tests:

• annual gross revenue above $26,625,000 (the inflation-adjusted figure in effect since January 1, 2025); or
• buying, selling or sharing the personal information of 100,000 or more California consumers or households in a year; or
• deriving 50% or more of annual revenue from selling or sharing personal information.

So, on request, you can ask us to:

• Tell you what we hold about you and who we shared it with.
• Delete it, subject to the tax records we are required to keep.
• Correct anything that is wrong.
• Get a copy in a portable format.
• Be free of any penalty for asking. We will not refuse you service, change your price, or treat you differently because you made a request.

8. How to make a request

Email [email protected] with the subject line Privacy request, or call (909) 870-7095. Tell us what you want done.

To protect you, we verify requests against the email address on your order — we will not hand your order history to whoever emails us claiming to be you. We aim to respond within a few days and will not take longer than 45 days. An authorized agent may act for you with written permission.

What we cannot delete: the sales records behind a completed purchase, for as long as tax law requires us to keep them; and Stripe's own record of your payment, which lives with Stripe under their retention rules. Everything else goes.

9. Security

This site is served over HTTPS. Payment credentials never reach our systems. Our service credentials are held in a restricted secrets store rather than in application code, and access to order data is limited to the owner and the systems listed above.

We are not going to claim your data is perfectly safe, because no one can honestly claim that. If a breach affecting your personal information ever happens, we will notify you as required by California Civil Code § 1798.82.

10. Children

This site is meant for adult collectors and is not directed at children under 13. We do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.

11. Changes

If we change this policy we will update the date at the top. If we ever start doing something materially different with your information — analytics, advertising, anything of that kind — we will say so here explicitly rather than quietly widening the wording.