Our privacy architecture enforces Consent Mode v2 and transparent marketing disclosures across all inquiries.

These disclosures became active and legally binding on October 13, 2026. All transmissions routed through kidrobotstoys.com, our acquisition forms, support chat streams, and showroom correspondence operate under this version until explicitly amended.

The data controller for this website and inquiry infrastructure is Kidrobotstoys, trading at kidrobotstoys.com.

Our physical premises and official legal mailing domicile are established at:
74 Leonard St, New York, New York 10013, New York, New York, United States.

Direct communications regarding controller governance may be initiated via telephone at 212-255-8066 or through electronic correspondence addressed to [email protected].

Our server architecture records only the information essential to fulfill edition acquisitions and verify network security:

• Inquiry Form Specifications: Submitted through sapue30.php: full name, telephone number, email address, physical delivery or pickup address, requested inquiry category, custom project notes, exact product specifications, and the affirmative consent timestamp.
• Technical and Server Telemetry: Automatically logged upon transmission: client Internet Protocol (IP) address, browser user-agent string, referring uniform resource locator (URL), exact render timestamp, and final dispatch timestamp.
• Support Chat Interactions: Submitted through wajoe5b.php: transcript text, session timestamps, and an episodic session token held in browser local storage.
• Attribution Identifiers: Marketing click parameters appended to query strings upon entrance: Google Ads gclid, Microsoft Advertising msclkid, and Meta Ads fbclid.
• Consent Preferences: Explicit choice tokens stored inside the browser cookie key site_consent_v2.

We maintain no user account profiles, demand no passwords, and process no credit card or payment credentials on this site.

Kidrobotstoys processes personal information exclusively for designated, finite operational objectives:

• Formulating non-binding pricing estimates and validating carton allocations for designer vinyl figures and blind boxes.
• Verifying physical showroom appointment reservations and contacting curators regarding production batch timing.
• Preventing malicious script injections, spam bots, and DDoS interference across form and chat gateways.
• Measuring advertising conversion attribution and campaign performance across authorized search and display networks.

In accordance with recognized global statutes, each processing activity is grounded in a specific legal basis:

• Affirmative Consent: Required prior to storing non-essential marketing cookies, activating analytics storage, or transmitting unsolicited marketing updates.
• Pre-Contractual Steps: Essential to answer your direct specification request, evaluate collector lot pricing, and prepare edition dispatches.
• Legitimate Interest: Maintaining web application firewall rules, defending against fraudulent form injections, and maintaining server availability.

This website is an active destination for paid digital advertising. We receive visitors through marketing campaigns deployed across three verified ad platforms:

• google ads: Links arriving from Google campaigns carry the gclid (Google Click Identifier) parameter.
• microsoft advertising: Links routed from Bing and Microsoft partner networks carry the msclkid (Microsoft Click ID) parameter.
• Meta Ads: Campaigns hosted across Meta platforms attach the fbclid parameter.

These parameters allow conversion attribution only when the visitor has explicitly granted storage authorization. No ad platform has reviewed, approved, or verified this website.

Under our consent mode architecture (Google Consent Mode v2), four critical operational parameters are held strictly denied upon page initialization:

• ad_storage: Denied by default.
• ad_user_data: Denied by default.
• ad_personalization: Denied by default.
• analytics_storage: Denied by default.

These signals are switched to granted only when a visitor clicks "Accept All" on our consent banner. If the visitor clicks "Decline Non-Essential" or closes the notice without accepting, all four signals remain denied. If a visitor later modifies their preferences via the footer control, the parameters are instantly set back to denied.

We do not sell personal information to data brokers. Data is transmitted exclusively to named service providers bound by data processing covenants:

• Google Ireland Ltd / Google LLC: Operates Google Ads and Google Analytics infrastructure, receiving conversion signals when authorized.
• Microsoft Ireland Operations Ltd: Operates Microsoft Advertising and Bing telemetry. Microsoft's independent handling of information is governed by their disclosure statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms Inc: Receives event parameters when marketing campaigns are deployed across Meta channels.
• Hosting Infrastructure Provider: Provides secure hardened data center hosting in the United States and manages encrypted SQL storage for inquiry logs.
• Secure Mail Delivery Route: Transmits encrypted SMTP notification payloads from sapue30.php directly to our operator desk inbox.

Kidrobotstoys is domiciled in New York, United States. When European or international collectors submit inquiries, personal data is transferred across international borders into US-based servers. Such transfers are validated through recognized legal safeguards, including the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and adequacy mechanisms where applicable.

We reject indefinite data warehousing. All stored categories are expunged according to fixed operational periods:

• Inquiries and Email Records: Retained for exactly 24 months following initial submission to manage edition provenance and repeat collector requests.
• Chat Transcripts: Preserved for exactly 6 months from conversation termination.
• Server Access and Security Logs: Rotated and permanently purged after exactly 30 days.
• Consent Choice Record: Stored within local browser storage for exactly 6 months before re-prompting.
• Data Subject Access Requests (DSAR): All verified requests receive a formal resolution within 7 days.

We enforce strict technical and administrative defenses:

• End-to-end TLS encryption with modern cipher suites on all external web endpoints.
• Automated honeypot verification and input sanitization to eliminate SQL injection and cross-site scripting vulnerabilities.
• Role-based access limitation restricting inquiry logs to authorized showroom personnel at 74 Leonard St.
• Automated server integrity monitoring and hardened firewall rule sets.

Under the European General Data Protection Regulation (gdpr), visitors reaching our showroom platform from the European Economic Area or United Kingdom possess defined statutory rights:

• Right of Access: Request confirmation and an exportable copy of personal data maintained in our records.
• Right to Rectification: Demand immediate correction of inaccurate or incomplete contact records.
• Right to Erasure ("Right to be Forgotten"): Request the complete deletion of inquiry history where retention is no longer justified.
• Right to Restrict Processing: Suspend active processing during factual disputes.
• Right to Data Portability: Receive submitted data in a structured, commonly used, machine-readable format.
• Right to Object: Oppose processing grounded in legitimate interest at any time.
• Right to Withdraw Consent: Revoke granted marketing consents with immediate forward effect without penalty.

Pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa), California residents and residents of states with comparable statutes (including Virginia, Colorado, Connecticut, Utah, and Texas) possess distinct protections:

• The right to know the specific pieces and categories of personal information collected, disclosed, or shared.
• The right to delete personal information collected from the consumer.
• The right to correct inaccurate personal information.
• The right to opt-out of the "sale" or "sharing" of personal information for cross-context behavioral advertising.
• The right to be free from discrimination or retaliatory pricing for exercising any privacy right.

Kidrobotstoys does not sell personal information for monetary compensation. Cross-context ad attribution is strictly subject to your affirmative opt-out preferences.

Our infrastructure actively monitors the browser request header Sec-GPC. When a global privacy control signal is detected, our script engine treats it as a binding instruction to opt out of marketing storage, analytics tracking, and cross-context behavioral sharing without demanding further user intervention or displaying conflicting consent prompts.

Our website, designer vinyl art pieces, and collector acquisition desk are intended solely for adult collectors and commercial buyers. We do not knowingly solicit or collect data from children under the age of 18 (or under 16 in applicable jurisdictions). If a parent or guardian discovers that a minor has submitted personal information, contact us immediately at [email protected] and the records will be expunged within 48 hours.

If you believe our processing of your information violates applicable statutes, you have the right to lodge a formal complaint with relevant enforcement agencies:

• In California: with the California Privacy Protection Agency (CPPA) or the California Attorney General.
• In New York and other US jurisdictions: with your state Attorney General's Consumer Protection and Privacy Bureau.
• In the European Union: with your local national Data Protection Authority (DPA) under GDPR Article 77.

Governing law: the law of New York, United States, with disputes heard in the courts of New York.

To exercise any statutory right under GDPR, CCPA, or related frameworks, transmit your request directly to our privacy officer:

• Electronic Transmission: Email [email protected] with the subject line DSAR Request - [Your Name].
• Postal Mail: Mail a formal written notice to: Kidrobotstoys DSAR Desk, 74 Leonard St, New York, New York 10013, United States.
• Response SLA: We verify applicant identity and deliver a full formal response within 7 days of receipt, without charging administrative fees.

We may revise this privacy disclosure to reflect changes in manufacturing operations, new ad channel deployments, or statutory updates. When amendments occur, the revised policy will be posted on this URL with an updated effective date at the head of the document. Continued use of our acquisition desk following an amendment constitutes acknowledgment of the revised policy.

A designated staff member handles inquiries personally. Direct your privacy or acquisition questions to:

• Entity Name: Kidrobotstoys (trading at kidrobotstoys.com)
• Showroom & Postal Address: 74 Leonard St, New York, New York 10013, New York, New York, United States
• Direct Telephone: 212-255-8066
• Direct Email: [email protected]

Kidrobotstoys maintains digital accessibility standards for collectors and curators of all abilities. We continually improve the user experience and apply relevant accessibility standards:

• Technical Standard: We adhere to the Web Content Accessibility Guidelines (WCAG) version 2.1 at Level AA conformance.
• Visual Contrast: Text elements maintain contrast ratios well above 4.5:1 against their backgrounds, pairing deep oxblood grounds with high-contrast cream type.
• Keyboard Navigation: All navigation menus, modal dialogs, disclosure accordions, and inquiry forms are fully operable via keyboard tab sequences with prominent visible focus rings.
• Screen Reader Semantic Markup: Page structures employ semantic landmarks, descriptive alternative text on real product photography, and ARIA live attributes.
• Assistance & Feedback: If you experience any barrier accessing our content, contact our desk at 212-255-8066 or [email protected] for personalized phone consultation.