Legal

Privacy Policy

This policy explains what personal information Kiddalou collects through this website, why we collect it, who we share it with, and how you can ask us to change or delete it.

Last updated: September 2, 2026

The short version

We never sell or rent your personal information.
We only ask for an email address when you unlock the bonus downloads that come with a book, choose to join our release list, or write to us.
Getting a book bonus does not automatically subscribe you to marketing emails. Joining the release list is a separate, optional choice.
Free printables download straight from the page — no account, no email address.
Our books are for kids. This website, our bonus forms, and our email list are for grown-ups, and we don’t knowingly collect information from children.
You can ask us to show, correct, or delete what we hold at any time, and we’ll do it.

This summary is here to save you time. It doesn’t replace the full policy below.

1. Who we are

Kiddalou is a children’s publishing brand run by Estefanía André Feijóo, based in Spain. Our full business identification details, including our registered address and tax number, are published in our Legal Notice.

We are the data controller for the personal information described in this policy. That means we decide what is collected through kiddalou.com and what happens to it.

You can reach us about anything on this page at privacy@kiddalou.com.

We have not appointed a Data Protection Officer, because we are not required to. Privacy requests are handled directly by the contact above.

Because we operate from Spain, the EU General Data Protection Regulation (GDPR) applies to everything we do with your information, wherever you live. If you are in the United States, the rights described in Section 14 also apply to you.

2. What this policy covers

This policy covers the website at kiddalou.com, the forms on it, the emails we send, and the bonus downloads that come with our books.

It does not cover other companies. When you buy one of our books on Amazon, Amazon collects your order and payment information under its own privacy policy — we never see your payment details, your shipping address, or your name as a buyer. The same applies to any other site you reach from a link on ours.

3. Information we collect

Information you give us

Bonus downloads. When a grown-up scans the QR code printed inside one of our books, we collect the email address entered on that page and information needed to identify the requested bonus, so we can send the right files.
Release list. If you separately choose to receive news about new Kiddalou books, we collect your email address and the information needed to record and demonstrate that subscription choice, such as the date and time of sign-up and other technical consent records made available by our email provider.
Contact form and emails. Your name, your email address, and whatever you decide to write to us.

Information collected automatically

Our hosting infrastructure processes server access logs when the website is accessed. These logs may include the IP address associated with the request, the date and time of access, the requested page or resource, the request method and protocol, the HTTP response status, the response size, and technical user-agent information that may identify the browser, device, software, or automated crawler making the request.

This information is used to operate and secure the website, diagnose technical problems, monitor requests, and detect or prevent malicious or abusive activity.

We do not use GPS or collect precise location data. We don’t currently use analytics or advertising cookies — see Section 7.

What we don’t ask for

Payment or card details. All sales happen on Amazon.
User accounts or passwords. This site doesn’t have them.
Special category data — health, religion, ethnicity, political views, biometrics. We never ask for it and no field on this site is designed to collect it. If you happen to mention something like that in a message, we use it only to answer you.
Information about children. We don’t ask for it, and we don’t knowingly collect it. See Section 6.
Lists bought from data brokers. We only have what people give us directly.

4. How we use your information

To send the bonus files you request through a QR code included in a Kiddalou book.
To tell you when a new Kiddalou book is out, only if you separately chose to join our release list.
To manage your subscription preferences and keep a record of your marketing consent.
To answer your messages and keep track of the conversation.
To keep the site running, spot abuse, and fix things that break.
To meet our legal obligations and to keep appropriate records where required.

We do not build advertising profiles, we do not run targeted advertising, and we do not make automated decisions that produce legal or similarly significant effects about you.

5. Legal bases for using your information

Under the GDPR we need a legal basis for each use. Ours are:

Consent: Using the email address you provide to send a bonus you specifically request; separately, joining the release list; and any non-essential cookies if we ever use them. These are separate purposes. You can withdraw consent at any time, and withdrawing it doesn’t affect anything we did before you withdrew it.
Legitimate interests: Keeping the site secure, preventing abuse and spam, maintaining technical records needed to operate the website, and responding appropriately to messages you send us. We’ve weighed these interests against your rights and keep the data to a minimum. You can object where this legal basis applies.
Legal obligation: Keeping records where the law requires us to do so and responding to lawful requests from authorities.

6. Children’s privacy

Kiddalou books and printables are made for children roughly 4 to 12 years old. This website, our email list, and our bonus download forms are intended for parents, teachers, and other adults. Free resources are designed to be downloaded and printed by an adult for a child to use. We ask that only an adult enter an email address or other personal information anywhere on this site. This website is not directed to children under 13.

We do not knowingly collect personal information from children under 13 in the United States, as defined by the Children’s Online Privacy Protection Act (COPPA), or from children under the age of digital consent in their country in the EEA — 14 in Spain, and between 13 and 16 elsewhere.
We never ask for a child’s name, age, photo, school, or any other detail about them.
There are no accounts, profiles, public comments, forums, or chat features on this site, so a child has no way to publish personal information here.
We do not use children’s information for advertising, and we do not sell or share it. Under California law, we do not sell or share the personal information of anyone under 16.

For parents. If you believe a child has given us personal information, email privacy@kiddalou.com with enough detail to find it. We’ll delete it promptly, stop any related emails, and confirm to you once it’s done. You don’t need to explain why, and there’s no charge.

If we become aware on our own that we hold information from a child without verifiable parental consent, we delete it without waiting to be asked.

7. Cookies and similar technologies

We keep cookies to a minimum. This site currently uses only cookies that do not require prior consent, such as cookies needed for essential website functions, security, and, where applicable, remembering your privacy or cookie preferences.

We don’t use analytics or advertising cookies, and we don’t use cookies to build advertising profiles. If we add any non-essential cookies in the future, we’ll ask for consent before they are set where the law requires it, and you’ll be able to withdraw that consent at any time.

Full details — names, purposes, providers, and durations — are in our Cookie Policy.

8. Email and marketing

We use MailerLite to deliver bonus content and to manage our optional release list. These are two separate purposes.

Bonus emails

If you enter your email address on a bonus page reached through a QR code in one of our books, we use that address to send the bonus you requested. Requesting a bonus does not automatically subscribe you to marketing emails.

The bonus form may also give you a separate, optional choice to join the Kiddalou release list. That choice is not pre-selected, and you can receive the bonus without joining the list.

Release list

If you separately choose to join our release list, we may email you when a new Kiddalou book is released and send closely related Kiddalou updates described at the point of sign-up. We do not add you to this list merely because you requested a bonus.

Every marketing email includes an unsubscribe link. You can withdraw your consent at any time, and unsubscribing does not affect bonus files you have already received.

MailerLite

Our email communications are managed through MailerLite Limited, based in Ireland. MailerLite processes subscriber information on our behalf as an email marketing and automation provider.

We’ve turned off email open-tracking pixels. MailerLite can still record clicks on links in our emails through its standard reporting. It also processes information needed to deliver messages and handle bounces and unsubscribes. We do not use this information to build advertising profiles.

We configure our email service to collect and use only the information reasonably necessary for these purposes.

10. International data transfers

Our principal hosting infrastructure is located in Belgium, within the European Economic Area (EEA), and our email service for EEA customers is provided by MailerLite Limited in Ireland using EU-based subscriber data infrastructure.

If a provider or subprocessor ever needs to process personal information outside the EEA, we will rely on an appropriate safeguard permitted by the GDPR, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, where required.

You can ask us about the safeguards in place for any specific provider by writing to privacy@kiddalou.com.

11. How long we keep your information

We keep personal information only as long as we need it, then delete it.

Release list: Until you unsubscribe, withdraw your consent, or ask us to delete your information. We may keep a minimal suppression record where necessary to make sure we do not accidentally add you back to marketing communications.
Bonus download requests: Up to 12 months from the request, so we can resend the files if something goes wrong. If you separately joined the release list, that subscription is kept under the release-list rule above instead.
Contact messages: Up to 12 months after our last exchange, and longer only where the law requires it.
Records of consent: For as long as the consent is active and, where necessary, for the period during which we may need to demonstrate that valid consent was obtained.
Server access logs: Access logs are archived by our hosting provider after daily statistics processing and are configured to be automatically deleted at the end of each month.

Where the law requires us to keep something longer — tax and accounting records, for example — we keep it for that period and nothing more.

When information is deleted from active systems, a copy may remain temporarily in provider backups. Some of those backups are immutable, which means they can’t be altered before their retention period ends. Backup copies are retained and removed in accordance with the relevant provider’s backup and retention procedures.

12. How we protect your information

The site runs over an encrypted HTTPS connection. Access to the website’s back end and to our hosting account is restricted to authorized users, protected with strong, unique passwords, and secured with two-factor authentication. We keep WordPress and its plugins updated.

We also pick providers who take this seriously. Our site and its backups run on infrastructure in an ISO/IEC 27001 certified data center in Belgium, with redundant systems and immutable backups, and our email platform stores subscriber data in an ISO/IEC 27001 certified data center in the European Union.

No method of transmitting or storing data online is completely secure, and we won’t pretend otherwise. If a personal data breach happens and it’s likely to put your rights at risk, we’ll report it to the Spanish supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to put your rights at high risk, we’ll also contact you directly and explain what happened and what you can do about it.

13. Your rights (EEA and UK)

You have the right to:

Access the personal information we hold about you, and get a copy of it.
Correct anything inaccurate or incomplete.
Delete your information, where there’s no legal reason for us to keep it.
Restrict how we use it while a dispute or a correction is being sorted out.
Take it with you in a portable, machine-readable format, or have us send it to another provider.
Object to processing based on legitimate interests. If you object to direct marketing, we stop — there is nothing for us to weigh.
Withdraw consent at any time, without affecting anything done before.
Not be subject to decisions based solely on automated processing. We don’t make any.

To exercise any of these, email privacy@kiddalou.com. It’s free. We reply within one month, and if a request is complex we may extend that by two more months and tell you why. We may ask you for information to confirm who you are, but only as much as we need.

If you think we’ve handled your information badly, please tell us first — we’d rather fix it. You also have the right to complain to a supervisory authority: in Spain, the Agencia Española de Protección de Datos; in the UK, the Information Commissioner’s Office; elsewhere in the EEA, the authority in the country where you live or work.

If you live in Switzerland, the Swiss Federal Act on Data Protection gives you comparable rights. Write to the same address to use them, and you can also contact the Federal Data Protection and Information Commissioner.

14. Your rights (United States)

Most Kiddalou readers are in the US, where privacy rights depend on the state you live in and on whether a given law applies to a business our size. Rather than work that out case by case, we treat everyone the same way: whatever your state gives you, you can ask us for it here. That includes knowing what we hold, getting a copy, correcting it, deleting it, and opting out of any sale, sharing, targeted advertising, or profiling.

Some things worth stating plainly:

We have not sold or shared personal information, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA, in the preceding 12 months, and we have no plans to.
We do not process sensitive personal information for any purpose that would give you a right to limit it.
We do not use personal information for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects.
We honor Global Privacy Control and similar browser opt-out signals where the law requires us to.
We will never treat you differently — worse service, different content — for exercising a privacy right.
Under California’s “Shine the Light” law, we confirm that we don’t disclose personal information to third parties for their own direct marketing.

Categories we collect

In the past 12 months we may have collected identifiers (such as an email address and technical identifiers such as an IP address) and limited internet or network activity needed to operate and secure the website and deliver emails. We collect this information for the purposes listed in Section 4, from you directly or through the technical operation of our website and service providers, and we disclose it only as described in Section 9.

How to exercise your rights

Email privacy@kiddalou.com with the subject line “Privacy request” and tell us what you’d like us to do. We’ll get to it as quickly as we can, and always within the time limit that applies where you live. We may need to confirm who you are first, and an authorized agent can act for you with written proof of permission.

If we can’t do what you asked, we’ll explain why, and you can reply and ask us to look at it again. If you’re still not satisfied, you can contact your state’s Attorney General.

15. Links to other sites

Our Books pages link to Amazon, and our footer links to our social profiles. Once you follow one of those links you’re on someone else’s site, under their privacy policy and their cookies. We don’t control what they collect, and this policy stops at our edge.

16. Changes to this policy

When we change this policy, we post the new version on this page and update the date at the top. Older versions are available on request.

If a change materially affects how we use information you’ve already given us, we’ll tell you before it takes effect — by email if we have your address — and we’ll ask for your consent again wherever the law requires it.

17. Contact us

Questions, corrections, deletions, or anything else on this page:

Email: privacy@kiddalou.com
Contact form: kiddalou.com/contact
Postal address: published in our Legal Notice

We read every message and we answer them ourselves.