Privacy Policy

DRAFT for Brent's review (Nov 2, 2026). Business privacy policy for Play Therapy Toolbox, written for the consent v2.2.1 backport. Items in [brackets] need a decision before this goes live.

Effective date: [DRAFT: set on the day this version goes live]
Last updated: [DRAFT: set on the day this version goes live]

This policy explains what information Play Therapy Toolbox ("we," "us") collects through this website, playtherapytoolbox.com, how we use it, who we share it with, and the choices you have.

Play Therapy Toolbox provides continuing-education courses, supervision training and resources for play therapists and play therapy supervisors. This website is for professionals learning about our training. It is not a place to get counseling or to share anyone's health information.

The short version

• Optional cookies stay off until you say yes. You can change your mind any time in Cookie preferences.
• We may run advertising, such as Google Ads, but we don't do remarketing, and we don't share your data with third-party advertisers or remarketing tools.
• We don't sell or share your personal information.
• You can unsubscribe from our emails and texts at any time.
• You can ask to see, fix or delete your information. Use our contact form or email us at [DRAFT: privacy contact email, written as name [at] domain].
• Our courses run on a separate course platform with its own terms and privacy policy.

Information we collect

Information you give us

When you fill out a form on this site (for example, our contact form or a free checklist download), email us or sign up for our emails, we may collect:

• Your name
• Your email address and phone number, if you give it
• Professional details you choose to share, such as your credentials, the state you practice in, or where you are on the path to becoming a Registered Play Therapist
• Anything you write in a message box

Please don't include information about clients or anyone's health in a message or form. We don't need it to answer you.

Our forms

Our forms are provided by TheraSaaS, a form and contact-management service that runs on technology from LeadConnector.

• Our forms load only when you choose. At first you see a short note and a button in place of each form. Nothing loads from TheraSaaS until you turn on Functional cookies (or press "Accept all"), or click the button on a form. One click turns on all our forms, and we remember it in your browser. You can turn it off in Cookie preferences.
• What the form collects: the details you type in, plus the date and time, the page you were on, and basic technical details like your IP address and browser.
• What else loads with the form: when a form loads, it also gets fonts from Google Fonts and files from Google Cloud Storage, so Google receives your IP address and browser details. It also runs a Cloudflare security check that helps stop spam, which may set a cookie named __cf_bm (about 30 minutes).
• Where it goes: your answers are stored in our TheraSaaS account so we can reply, send what you asked for, and keep in touch if you agreed to that.

Information collected automatically

Like most websites, our site and the tools it uses can collect some details automatically, such as your IP address and rough location, your browser and device type, the pages you visit and the page you came from, and, if you allow Analytics cookies, a random ID stored in a cookie.

How we use your information

We use your information to:

• Reply to your questions
• Send you the checklist, guide or other resource you asked for
• Send you our emails or text messages about courses, events and resources, if you signed up
• Understand how people use our website so we can improve it (only if you allow Analytics cookies)
• Keep our website safe and working
• Follow the law and protect our rights

Email and text messages

• Emails. If you sign up or download a free resource, we may send you emails about our courses, events and resources. Every marketing email has an unsubscribe link. Click it any time and we will stop.
• Text messages. We send marketing texts only if you agree on the form. Message and data rates may apply. Reply STOP to any text to stop, or HELP for help. Agreeing to texts is never a condition of buying anything.
• Even after you unsubscribe, we may still send messages you need, such as a reply to your question.

Advertising and remarketing

We may run advertising, such as Google Ads, but we don't do remarketing, and we don't share your data with third-party advertisers or remarketing tools.

If we run Google Ads, the Google Ads tag only measures which of our ads bring visitors to this site. It loads only if you allow Advertising cookies (or press "Accept all"). It never loads if you choose "Reject all" or your browser sends a Global Privacy Control signal.

By "remarketing tools," we mean code that follows your visit so ads can be shown to you later on other websites and apps. We don't use any of these, for example Google Ads remarketing (audience) tags, the Meta (Facebook and Instagram) Pixel, the TikTok Pixel, the Microsoft (Bing) UET tag, the LinkedIn Insight Tag, or Google Analytics advertising features such as Google Signals or ads personalization.

If this ever changes, we will update this policy first.

Cookies and similar tools

Cookies are small files a website saves in your browser. Similar tools include pixels, tags, scripts and local storage. You choose which ones to allow.

When you first visit, a small box asks what you want to allow. "Reject all" is just as easy as "Accept all." To choose category by category, open "Review options." You can change your choices any time with the Cookie preferences link in the footer of every page.

We use Google Consent Mode, so Google tools on our site are told your choice. If you have not said yes, Google Tag Manager and Google Analytics do not load.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as "Reject all" for Analytics and Advertising, even if you pressed "Accept all" before. You can still turn on our forms yourself. Learn more at globalprivacycontrol.org.

You can also block or delete cookies in your browser settings.

The tools we use

These are the outside services our website uses. Each has its own privacy policy.

Necessary

• Website hosting (Netlify) and network security (Cloudflare). They deliver the site and protect it from attacks, and they handle your IP address and basic request details. Cloudflare may set a security cookie to block bots.
• [DRAFT: Cloudflare Web Analytics. A page-view counter that does not use cookies. Brent is deciding whether to turn it off; delete this line if it is off before launch.]
• Your cookie choices. Saved in your browser (local storage key cookie_consent).

Analytics

• Google Tag Manager and Google Analytics 4 (Google). Google Tag Manager loads our Google Analytics tag, only after you allow Analytics cookies. Google Analytics counts visits and shows which pages are used. It sets cookies named _ga and _ga_<ID> that keep a random ID for up to 2 years. We keep Google Signals and ads personalization turned off. Google Analytics keeps visit data for up to 14 months. Google's privacy policy.

Functional

• TheraSaaS forms. See "Our forms" above.

Our courses, events and other sites

• Courses. When you click "Courses" or "Login," you go to our course platform at training.playtherapytoolbox.com. Course purchases, accounts, progress and certificates are handled there, under that platform's own terms of use and privacy policy, not this website policy. [DRAFT: name the course platform and link its terms and privacy policy.]
• Events. Live events are sold through Eventbrite, under Eventbrite's terms and privacy policy.
• Other links. Our site links to other websites, such as social media pages and partner sites. We are not responsible for their content or privacy practices.

Who we share information with

We don't sell or share your personal information. "Share" means giving your information to other companies so they can show you targeted ads on other websites and apps. We don't do that.

We give information to others only in these cases:

• Service providers that help us run the website and our business, like our web host, TheraSaaS, our email and text-message tools, and Google Analytics (if you allow it). They may use the information only to provide their service to us.
• When the law requires it, such as a valid court order, or to protect our rights and the safety of others.
• If our business changes hands, as part of that change, with this policy's protections kept in place.
• With your permission, for any other reason.

How long we keep information

• Contact details and messages: while you are on our contact list, and for a reasonable time after you stop hearing from us, unless you ask us to delete them.
• Unsubscribe requests: we keep a record so we don't email or text you again.
• Google Analytics data: up to 14 months.
• Privacy requests: about 24 months, so we can show we handled them.

How we protect information

We use reasonable safeguards, including encryption (HTTPS) on this site, and we choose service providers that protect data. No website or email system is 100% secure.

Your choices and rights

No matter where you live, you can:

• Change your cookie choices any time in Cookie preferences.
• Unsubscribe from emails (use the link in any email) or texts (reply STOP).
• Ask what information we have about you.
• Ask us to fix information that is wrong.
• Ask us to delete your information. We may need to keep some of it if the law requires it.

How to make a request: use our contact form or email [DRAFT: privacy contact email]. Please say "Privacy request" and tell us what you would like us to do. We'll confirm we got your request within 10 days and respond within 45 days. If we need more time, we will tell you why. We may ask you to confirm who you are, and we will not treat you differently for using your privacy rights.

[DRAFT: no California section. Add one only if Play Therapy Toolbox meets a California (CCPA) threshold.]

Visitors outside the United States

Our website and service providers are based in the United States. If you visit from another country, your information will be handled in the United States.

Children

This website is for professionals and is not meant for children. We do not knowingly collect personal information from children under 13. If you think a child sent us information, please contact us and we will delete it.

Changes to this policy

We may update this policy when our website or the law changes. We will post the new version here and change the "Last updated" date. If we make a big change, such as adding remarketing, we will update this policy first.

Contact us

Play Therapy Toolbox [DRAFT: legal business name]
Illinois, United States
Email: [DRAFT: privacy contact email]
Or use our contact form.

Related pages: Website Terms · Cookie preferences