1. Responsible party
Bang Bang Creative Co (Pty) Ltd, registration number 2019/079159/07, trading as Toastee, is the responsible party for personal information processed through Toastee.
Address: 2 Bentonite Street, Alrode, Alberton, South Africa
Information Officer: hello@toastee.co.za
Telephone: 078 747 4044
This policy applies to customers, prospective customers, website visitors, account holders, people using Toastee Studio, support contacts, people who submit reviews or marketing preferences, and other people whose personal information is processed through the customer-facing Toastee service.
It does not govern the separate relationship between Toastee and approved creators using the creator dashboard, which may be subject to separate terms, agreements or notices.
2. Information we collect
Depending on how you use Toastee, we may collect:
Identity and contact information: name, surname, email address, telephone number, billing address, delivery address and account identifier.
Order and transaction information: products, variations, quantities, order number, value, payment status, transaction reference, courier and tracking information, returns, exchanges, refunds and information relating to Custom Products.
Account information: account details, securely processed credentials, order history, saved addresses, preferences and account settings.
Toastee Studio information: saved or temporary designs, garment selections, sizes, colours, garment views, print areas, print configurations, layers, text, fonts, positions, dimensions, transformations, design snapshots, previews and other information necessary to create or manufacture a Studio product.
Uploaded media and artwork: photographs, illustrations, logos, graphics, SVG files, images and other files that you upload or use through Toastee Studio, together with associated file information such as filenames, file types, dimensions and technical metadata where applicable.
AI information: prompts, instructions, uploaded or selected reference images, generation settings, generation requests, generated images or other outputs, safety or moderation results, request information, AI Credit usage and technical information required to operate AI features.
Technical and usage information: IP address, browser, device, operating system, pages viewed, referring source, session information, cart and checkout identifiers, Studio session or project identifiers, cookie choices, security information and optional analytics or advertising events.
Communications and content: contact forms, support messages, reviews, ratings, images, marketing choices and responses to promotions or surveys.
We do not intentionally request special personal information unless it is genuinely necessary for a feature requested by the customer and processing is permitted by law.
Because customers may upload photographs, artwork or other content themselves, content submitted to Toastee may sometimes contain personal information about the customer or another person.
3. Information about other people
If you upload a photograph, image, logo, artwork or other content containing another person's personal information, you are responsible for ensuring that you have the authority, permission or other lawful basis required to provide and use that information.
This is particularly important where content contains a recognisable person, a child, private information or information that may qualify as special personal information.
Do not upload another person's personal information where you do not have the right to use it.
Toastee does not use Studio photographs for facial recognition or biometric identification unless such functionality is expressly introduced and appropriately disclosed in the future.
4. How information is collected
We may collect information:
- directly from you when you register, purchase, upload content, create a design, use an AI feature, contact us or otherwise interact with Toastee;
- automatically through essential website, Studio, security and session technologies;
- through Google Analytics and Meta technologies according to the visitor's current privacy settings;
- from payment providers;
- from couriers;
- from Brevo in connection with email delivery and marketing preferences;
- from OpenAI or another AI service provider when an AI feature is used;
- from hosting, storage, content-delivery and technical infrastructure providers; and
- through lawful security, fraud-prevention and abuse-prevention processes.
5. Purposes and lawful grounds
We process personal information where reasonably necessary to:
- create and manage accounts;
- process payments and orders;
- produce and deliver products;
- operate Toastee Studio;
- create, save and restore designs;
- store and display uploaded media;
- generate product and design previews;
- convert designs into information required for production;
- provide AI generation features;
- manage AI Credit balances and usage;
- perform technical, security and content-safety checks;
- prevent fraud, abuse and misuse;
- provide tracking;
- handle returns, exchanges and refunds;
- respond to support requests;
- send transactional communications;
- operate, maintain and improve Toastee;
- keep accounting, tax and operational records;
- comply with legal obligations;
- establish, exercise or defend legal claims;
- display and moderate reviews;
- measure website activity where Analytics is enabled;
- measure and improve advertising where Marketing is enabled; and
- send marketing where legally permitted.
Depending on the purpose, processing may be necessary to perform a contract, take steps requested before entering into a contract, comply with a legal obligation, pursue or protect a legitimate interest where permitted, or may be based on consent.
Where we rely on consent, consent may be withdrawn subject to applicable law. Withdrawal does not invalidate processing that was lawful before withdrawal.
6. Information required to provide the service
Information required to process an order, produce a Custom Product or deliver goods is mandatory for those purposes. If it is not provided, we may be unable to process or fulfil the order.
Certain information is also necessary to operate specific Studio features. For example, an uploaded image must be processed if the customer asks Toastee to place that image on a garment or use it as part of an AI generation request.
Marketing information and optional tracking choices are voluntary.
Disabling Analytics or Marketing does not prevent normal browsing, account use, cart use, checkout or ordinary Studio functionality.
7. Toastee Studio
Toastee Studio allows customers to create personalised products and may store information necessary to preserve, reopen, preview, manufacture and order those designs.
A Studio project may include:
- the selected garment;
- colours and sizes;
- garment views;
- print sizes and print configurations;
- uploaded or generated artwork;
- text;
- design layers;
- positions, dimensions, rotations and other transformations;
- preview images;
- production information;
- a project or design identifier;
- account or guest-session information; and
- information connecting a completed design to an order.
Studio designs may remain associated with an account so that the customer can reopen or reuse them.
Where Studio is used without signing in, Toastee may use browser storage, session identifiers or temporary server-side records to preserve the design or uploaded content. If the customer later signs in, information may be associated with or transferred to that customer's account where the feature supports this.
Studio designs and uploaded media are not made publicly available merely because they are stored in a customer's Studio account.
They may be accessible to authorised Toastee personnel and service providers where reasonably necessary to operate the service, provide support, investigate a problem or manufacture an ordered product.
8. AI features
Toastee Studio includes features that use artificial intelligence.
At the date of this policy, certain AI features are provided using OpenAI API services. Toastee may use additional or replacement AI service providers in future. Where a material change affects how personal information is processed, this policy will be updated where appropriate.
When an AI feature is used, information sent for processing may include:
- the customer's prompt or instructions;
- uploaded or selected images;
- reference artwork;
- information necessary to perform the requested generation;
- technical request information; and
- information used for security, rate-limiting, safety or abuse prevention.
The AI provider processes this information to generate the requested output and to operate, secure and protect its service in accordance with its applicable terms and data-processing practices.
OpenAI currently states that data submitted through its business/API services is not used to train or improve its models by default unless the API customer expressly opts in. Toastee does not intend to opt customer Studio content into model training without appropriate notice and any consent required by law.
OpenAI's current API documentation also states that standard API abuse-monitoring logs may contain prompts, responses and related metadata and are generally retained for up to 30 days, subject to applicable legal requirements and any different data-retention controls configured for the relevant API project. Some API features may have separate application-state retention requirements.
AI-provider practices may change over time. Toastee will take reasonable steps to use providers and configurations appropriate for the service and applicable privacy obligations.
9. AI-generated content and saved generations
AI-generated images or other outputs may be temporarily processed as part of a generation request.
Where a customer chooses to save, use or add generated content to a Studio design or media library, Toastee may retain that output together with information required to identify the design, account, generation or AI Credit transaction.
Information about generation requests may also be retained where reasonably necessary for:
- AI Credit accounting;
- customer support;
- security;
- fraud or abuse prevention;
- investigating failed generations;
- enforcing applicable Terms;
- resolving disputes; and
- legal or accounting obligations.
A customer's AI prompt or output is not treated as a public review or public post merely because it is processed through Toastee.
10. AI safety and automated processing
AI prompts, uploaded content and generated content may be assessed using automated safety, security or abuse-prevention systems.
These systems may refuse, block or restrict a generation request where content appears to violate applicable rules, provider requirements or law.
Toastee does not use its Studio AI features to make decisions about customers that produce legal consequences or similarly significant effects based solely on automated profiling.
Automated processing may nevertheless be used for ordinary technical purposes such as content-safety screening, rate limiting, fraud detection, security and service operation.
POPIA includes rights and safeguards concerning certain decisions based solely on automated processing.
11. Sensitive information in AI prompts and uploads
Customers should avoid including unnecessary confidential, sensitive or special personal information in AI prompts or uploaded content.
Where you deliberately provide personal information because it is necessary for the design or generation you requested, Toastee will process it for that purpose and related service, security and legal purposes described in this policy.
Do not submit another person's sensitive information unless you have the necessary authority or legal basis to do so.
12. AI Credits
Where Toastee provides free or paid AI Credits, we may process information about:
- the customer's AI Credit balance;
- credits granted or purchased;
- credits used;
- generation transactions;
- failed or reversed deductions;
- applicable account identifiers; and
- payment information relating to paid credit purchases.
This information is used to operate the credit system, prevent abuse, provide support, maintain transactional records and resolve billing disputes.
AI Credit records may be retained separately from generated artwork where necessary for accounting, fraud prevention or legal purposes.
13. Payments
Payments may be processed through Payfast, Yoco, Payflex, PayJustNow or another provider shown at checkout.
These providers process information under their own privacy notices and security systems.
Toastee ordinarily receives information such as payment status, amount, payment method and a transaction or order reference.
We do not ordinarily receive or store a customer's complete card number, CVV or online-banking credentials.
14. Delivery
We share necessary delivery information with The Courier Guy and any replacement or supporting delivery provider.
This may include recipient name, delivery address, telephone number, email address, parcel information, locker or collection details and delivery instructions.
Couriers may contact customers directly about delivery.
15. Service providers and recipients
We may disclose or make available necessary personal information to service providers involved in operating Toastee, including, where applicable:
- WordPress and WooCommerce infrastructure;
- Cloudways and other server or hosting providers;
- Vercel and frontend hosting infrastructure;
- Bunny.net or other database, storage and content-delivery infrastructure;
- OpenAI and other AI service providers;
- payment providers;
- The Courier Guy and other delivery providers;
- Brevo for transactional email and permitted marketing;
- Google Analytics where Analytics is enabled;
- Meta Pixel and Meta advertising services where Marketing is enabled;
- cybersecurity, monitoring and technical providers;
- accountants, auditors, lawyers, insurers and professional advisers;
- regulators, law-enforcement authorities or courts where lawfully required; and
- a lawful purchaser, investor or successor in connection with a sale, restructuring or transfer of all or part of the business.
The information disclosed is limited, as reasonably practicable, to what is necessary for the relevant purpose.
Service providers are expected to process information for authorised purposes and to apply appropriate safeguards.
Some providers may also process limited information as an independent responsible party under their own terms where applicable.
We do not sell customer personal information to advertisers.
16. International processing
Some of Toastee's hosting, storage, AI, analytics, advertising, payment, email or other technology providers may process or store information outside South Africa.
This includes circumstances where information submitted to an AI feature is transmitted to infrastructure operated outside South Africa.
Where personal information is transferred outside South Africa, Toastee will take reasonable steps to ensure that the transfer is permitted under POPIA and that an appropriate legal basis or safeguard applies.
POPIA regulates transfers of personal information outside South Africa, including through section 72.
17. Security
We use reasonable technical and organisational safeguards appropriate to the information and risks involved.
These measures may include:
- encrypted connections;
- restricted administrative access;
- secure authentication;
- HTTP-only or otherwise protected session cookies where appropriate;
- specialist payment providers;
- access controls;
- separation of development and production systems where appropriate;
- software updates;
- monitoring;
- backups; and
- security and abuse-prevention controls.
No internet-connected system can be guaranteed completely secure.
Where a qualifying security compromise occurs, we will follow applicable investigation, response and notification obligations.
18. Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or where continued retention is required or permitted by law.
Retention periods may differ depending on the information.
For example:
- order and financial records may be retained for accounting, tax, warranty, dispute and legal purposes;
- account information may remain while an account is active and for a reasonable period thereafter;
- Studio designs and media may remain while required to provide design-library and account functionality;
- production snapshots and order-related artwork may be retained where necessary to fulfil, reproduce, investigate or defend an order;
- AI usage records may be retained for credit accounting, security, fraud prevention and support;
- temporary files and technical logs may have shorter retention periods; and
- backups may continue to contain information for a limited period after deletion from active systems.
Third-party providers may apply their own retention periods to information processed through their systems, subject to Toastee's agreements and available configuration controls.
When information is no longer required, we will delete, destroy, anonymise or securely restrict it where reasonably possible unless continued retention is required or permitted by law.
19. Deleting Studio content and account information
Customers may contact Toastee regarding deletion of personal information, Studio content or account information.
Where the applicable feature provides a direct delete control, customers may also use that control.
Deletion of an image or design from a customer's active Studio library does not necessarily require immediate deletion of every related copy where the information:
- forms part of a completed order;
- is required for accounting or legal records;
- is required to resolve a dispute;
- is retained temporarily in a backup;
- is required for fraud or security purposes; or
- must otherwise be retained by law.
Where deletion is legally required, we will take reasonable steps to delete or de-identify the relevant information.
20. Essential cookies and storage
Toastee uses essential cookies and similar storage technologies required for features such as:
- cart contents;
- WooCommerce and Toastee sessions;
- checkout continuity;
- customer login;
- creator and administrator authentication;
- Toastee Studio sessions and guest functionality;
- saving or restoring temporary Studio information where applicable;
- security;
- payment continuity;
- website preferences; and
- recording privacy choices.
These technologies remain active where necessary because disabling them may prevent the website, Studio, account, cart or checkout from functioning correctly.
21. Analytics
Analytics is enabled by default when a visitor first uses Toastee unless that visitor has previously disabled it in Cookie settings.
Google Analytics may help us understand pages visited, product views, Studio entry and usage events, add-to-cart activity, checkout activity, purchases, device and browser information, approximate location and website performance.
We do not intentionally send customer artwork, AI prompts, AI-generated artwork, names, email addresses, telephone numbers, physical addresses or payment credentials to Google Analytics.
Analytics can be switched off at any time through Cookie settings.
22. Marketing and advertising measurement
Marketing tracking is enabled by default when a visitor first uses Toastee unless that visitor has previously disabled it in Cookie settings.
Meta Pixel and related advertising technologies may be used to measure advertising performance, understand whether advertising contributed to a visit or purchase, build or measure audiences and record events such as product views, Studio visits, cart activity, checkout and purchases.
We do not intentionally send customer-uploaded artwork, AI prompts, generated artwork, physical addresses, order notes or payment credentials in standard browser advertising events.
Marketing tracking can be switched off at any time through Cookie settings.
23. Cookie choices
On a first visit, Toastee displays a privacy and cookie notice at the bottom of the website.
Analytics and Marketing are enabled by default unless the visitor has previously saved a different choice.
The notice provides a Manage control that opens Cookie settings, where Analytics and Marketing can be switched on or off separately.
Dismissing the notice, allowing it to disappear automatically or continuing to browse does not itself change the current settings.
The first-visit notice may disappear automatically after a short period and is not ordinarily shown again after it has been displayed.
The Cookie settings control in the website footer remains available so visitors can review or change their choices at any time.
A saved choice overrides the default settings until it expires, is changed or browser storage is removed.
24. Direct marketing
We may send promotional email, abandoned-cart email, SMS or WhatsApp marketing where the required consent has been given or the communication is otherwise permitted by law.
Customers can withdraw or opt out using an unsubscribe link, an opt-out instruction in a message or by emailing hello@toastee.co.za.
Withdrawing from marketing will not stop necessary order, payment, delivery, account, security, AI Credit or support communications.
25. Reviews and public content
A review, rating, display name or image submitted for public display may be visible to other people.
Customers should not include addresses, telephone numbers, payment information, private order information, another person's private information or sensitive information in a public review.
Toastee may moderate public content to protect privacy, prevent abuse and enforce its Terms.
Studio designs, uploaded artwork and AI generations are not public content merely because they are stored or processed through Toastee.
26. Children
Toastee is not directed at children who can independently enter into transactions.
A person under 18 should use Toastee only with the involvement of a parent or legal guardian where required.
Customers should not upload personal information or images of a child unless they are the child's parent or legal guardian or otherwise have lawful authority to do so.
Where Toastee becomes aware that children's personal information has been processed without appropriate authority, we may restrict the relevant content or take other steps required by law.
27. Your rights
Subject to POPIA and other applicable law, you may have the right to ask Toastee to:
- confirm whether we hold personal information about you;
- provide access to your personal information;
- correct or update inaccurate information;
- delete or destroy information where legally applicable;
- object to certain processing;
- restrict certain processing where applicable;
- stop direct marketing;
- withdraw consent where processing depends on consent; and
- provide information about the basis on which your information is processed.
POPIA establishes rights relating to the protection and processing of personal information.
We may take reasonable steps to verify identity before acting on a request.
Some information cannot immediately be deleted where it must be retained for legal, accounting, fraud-prevention, security, dispute, contract or other lawful purposes.
Requests may be sent to hello@toastee.co.za.
28. PAIA manual and access to records
Our PAIA manual is being prepared for publication and will be made available on request.
Requests or enquiries concerning access to records may be directed to the Information Officer at hello@toastee.co.za.
29. Complaints
Please first contact the Information Officer at hello@toastee.co.za if you have a privacy concern.
You may also lodge a complaint with the Information Regulator of South Africa through its published complaint channels.
30. Changes to this policy
We may update this policy when our processing activities, Toastee Studio, AI features, providers, website functionality or legal obligations change.
The current version will display an updated effective date.
Where a material change affects optional processing or consent, we may request a new choice or consent where appropriate.
31. Contact
Information Officer
Bang Bang Creative Co (Pty) Ltd trading as Toastee
2 Bentonite Street, Alrode, Alberton, South Africa
hello@toastee.co.za
078 747 4044