Privacy & Cookie Policy

Last updated: 28 September 2026

At Everly, we are committed to protecting the privacy and security of your personal information. These information we collect, helps us perform the duties of bringing you the toy-rental service that you will come to enjoy. By accessing or using our services, you agree to the terms of this Privacy Policy.

1. Who we are

This Privacy & Cookie Policy explains how Everly Services Private Limited (“we”, “us”, “our”) collects, uses, discloses and protects personal data when you use our website, app, and toy-rental services in Singapore.

Everly Services Private Limited is the organisation responsible for personal data under Singapore’s Personal Data Protection Act 2012 (“PDPA”). For questions, contact us at hello@everlyplay.com.

PDPA overview of obligations: consent/notification, purpose/retention limitation, accuracy, protection, access/correction, transfer limitation, data breach notification, accountability. pdpc.gov.sg

2. The data we collect

2.1 Information you provide

• Account & profile: name, email, mobile number, password, delivery addresses.
• Orders & rentals: items selected, delivery/collection preferences, claims (e.g. lost/damaged items), customer service messages, photos you submit (e.g. proof of condition and/or damaged toy condition).
• Payments: we use third-party payment processors (e.g. Stripe) to handle card data; Everly does not store full card numbers.
• Household/child info: to personalise recommendations and safety guidance, you may be required to share your child’s age band (e.g. “2–3 years”) or general interests. We do not request or store a child’s date of birth.
• Marketing preferences: newsletter opt-ins, channels and topics.

2.2 Information collected automatically

• Device & usage: IP address, device identifiers, browser type, pages viewed, interactions, session duration, referral URLs.
• Cookies & similar tech: Analytics and advertising information is collected only in line with the choices you make in our cookie banner (see #10).

2.3 Information from third parties

• Payment providers, logistics partners, analytics/advertising partners, and social media login (if enabled) may send us limited data needed to provide services or measure performance (see #6 and #10).

3. Why we collect and how we use personal data

We collect, use and disclose personal data only for purposes a reasonable person would consider appropriate in the circumstances, and only with consent or under PDPA exceptions where applicable. Key purposes include:

• Provide the service: account creation, identity verification, delivering and collecting toys, managing your rental plan, processing payments, fraud prevention, customer support.
• Service improvements: analytics, troubleshooting, A/B testing, understanding usage to improve catalogue and logistics where you have allowed analytics cookies.
• Personalisation: show relevant toys (e.g. by age band) and content.
• Marketing: send updates, promotions and recommendations according to your preferences and the Do Not Call (DNC) rules (see #9).
• Legal & compliance: maintain records, handle disputes, detect misuse, and meet regulatory or tax obligations.
• Security: monitor, prevent and investigate fraud or abuse.

PDPA allows collection/use/disclosure with consent and recognises specific exceptions (e.g. legitimate interests with balancing and safeguards), alongside purpose limitation. pdpc.gov.sg

4. Our legal bases under the PDPA

• Consent / Deemed consent: given by you (e.g., ticking a box), or deemed when you voluntarily provide data for a purpose and it’s reasonably expected (e.g. giving an address to receive rentals).
• Legitimate Interests Exception (PDPA): in limited cases (e.g. fraud detection, service security, analytics with low privacy impact) where benefits outweigh risks and safeguards are applied.
• Contractual necessity: to perform our agreement with you (e.g. fulfil a rental).
• Legal obligations: where required by law, regulation, court order or regulator.

PDPC’s Key Concepts Guidelines explain consent, deemed consent and legitimate interests (including the need for a balancing assessment and safeguards). pdpc.gov.sg

5. Retention

We keep personal data only as long as necessary for the purposes above or to meet legal/operational requirements (e.g. accounting and tax). After that, we anonymise or securely delete it. Typical examples:

• Account, rental and support records: kept while your account is active and for a reasonable period after closure for operational or legal needs.
• Marketing preferences: kept until you unsubscribe; we maintain a minimal “do-not-contact” record thereafter.

6. How we share personal data

We disclose personal data only to the extent needed for the purposes described:

• Service providers (“data intermediaries”): delivery/courier partners, payment processors (e.g. Stripe), cloud hosting (e.g. Cloudflare), analytics (e.g. Google Analytics), customer support tools (e.g. Tally), communications platforms, and fraud-prevention vendors—under contracts that require appropriate protective measures.
• Professional advisors: auditors, lawyers, insurers.
• Corporate transactions: in a merger, acquisition, financing or sale of assets, with safeguards.
• Legal and safety: to comply with laws, enforce terms, or protect rights, property or safety.

Under the PDPA, “data intermediaries” processing on behalf of an organisation are directly subject to protection, retention and breach-notification duties. pdpc.gov.sg

7. International data transfers

Our website tools are delivered through Cloudflare's global network, and analytics data is processed by Google; both may process data outside Singapore. We rely on their contractual commitments to provide a standard of protection comparable to the PDPA.

8. Your choices and rights

Under the PDPA, you have the following:

• Access: request a copy of personal data we hold about you.
• Correction: ask us to correct inaccuracies.
• Withdrawal of consent: you may withdraw consent for non-essential uses at any time; we will inform you of likely consequences (e.g. inability to deliver certain features) and act within a reasonable time.
• Data portability: if/when Singapore’s Data Portability Obligation takes effect, we will comply with applicable regulations. Note: as of the date above, this obligation has been legislated but not yet commenced.

To exercise your rights, contact hello@everlyplay.com. We may need to verify your identity and may charge a reasonable fee for access requests in line with PDPA guidelines.

9. Marketing communications

• Email & in-app: we send marketing communications only with your consent or as permitted by law; you can unsubscribe via each message or in settings.

10. Cookies, SDKs and similar technologies

10.1 What we use

• Strictly necessary cookies: to log you in, keep the site secure and manage your cookie selection.
• Performance/analytics (e.g. first-party analytics, third-party analytics, privacy-centric measurement): to understand site usage and make improvements.

10.2 Your controls

You can change or withdraw your choices at any time using the Cookie settings link the bottom of the page. You can also block or delete cookies in your browser settings, but blocking strictly necessary cookies may stop parts of the site from working properly.

11. Children’s data

Our services are intended for parents/guardians. We do not request or store a child’s date of birth. Should you choose to provide a non-identifying age band (e.g. “3–4 years”), we use it only to recommend suitable items and guidance. If we learn we inadvertently collected unnecessary children’s data, we will delete it.

12. Security

We implement technical and organisational measures appropriate to the risks of our services, including encryption in transit (HTTPS), access controls, password hashing, least-privilege internal access, and vendor due diligence. No method of transmission or storage is 100% secure; we continuously review and improve safeguards.

13. Data breach notification

If we discover a data breach that results in, or is likely to result in, significant harm, or meets prescribed thresholds (e.g. affecting a significant number of individuals), Everly will assess, contain and notify the PDPC and affected individuals as required by law.

14. Third-party links and features

Our site/app may include links or integrations (e.g. payment providers, social networks). Their privacy practices are governed by their own policies; please review them before sharing data.

15. Keeping your data accurate

Please keep your profile up to date. You can edit most fields in your account; otherwise, contact us at support@everlyplay.com.

16. How to contact us

Data Protection Team
Email: hello@everlyplay.com

17. Changes to this policy

We may update this policy from time to time. If changes are material, we will provide a prominent notice (e.g., email or in-app). Your continued use of our services after the effective date signifies acceptance of the updated policy.