Privacy Policy

This Privacy Policy covers DreamCraftr's global AI-powered storybook platform, including its child-character reference image feature and the handling of global privacy rights.

It is intended to address key requirements under GDPR, UK GDPR, COPPA, CCPA/CPRA, and related international privacy standards.

1. Scope of This Privacy Policy

This Privacy Policy explains how DreamCraftr collects, uses, discloses, transfers, stores, and otherwise processes personal data when you access dreamcraftr.com or use DreamCraftr's websites, applications, AI story generation tools, billing features, and related services (collectively, the "Service"). It is intended for a global audience, including users in the United States, European Union, United Kingdom, and other international markets.

DreamCraftr is designed for adult account holders. Accounts must be created, managed, and paid for by a parent, legal guardian, or other adult user. If an adult user chooses to provide a child's name, preferences, or reference photo as part of the story creation process, that information is provided solely by the adult user acting with explicit, proactive consent and authority.

2. Data Controller and Contact Details

DreamCraftr is the controller of the personal data described in this Privacy Policy, except where another party independently determines the purposes and means of processing, such as Lemon Squeezy as Merchant of Record for payment processing. For privacy requests or questions, contact us at privacy@dreamcraftr.com.

3. Categories of Personal Data We Process

• Account and identity data, such as your email address, display name, authentication identifiers, and profile information you choose to provide.
• Story creation inputs, such as prompts, character names, age-range selections for story audiences, preferences, and other instructions you submit.
• Generated outputs, such as AI-generated story text, cover art, page illustrations, saved story metadata, and library records associated with your account.
• Reference image inputs that you voluntarily upload to guide character illustration generation, processed only on a transient basis as described in Section 4.
• Transaction and billing records, such as order identifiers, subscription status, purchase amounts, tax amounts, payment status, and fraud-prevention metadata supplied by Lemon Squeezy or related service providers.
• Support and communications data, such as emails you send to us, customer support messages, and records needed to resolve complaints or technical issues.
• Usage, device, and analytics data, including event-level product analytics and technical logs, where permitted by law and, where required, based on your consent.
• Public sharing data, such as reviews, ratings, public story listings, and profile display information you intentionally publish within the Service.

4. Character Reference Images: Transient Processing Only

DreamCraftr offers a feature that allows an adult user to upload a reference photograph, such as a photo of that user's child, to guide the generation of a matching illustrated storybook character. Original reference images are processed strictly in transit and only for the limited purpose of executing the requested AI generation pipeline.

Those original uploaded images are held temporarily in volatile memory (RAM) or equivalent transient processing infrastructure during generation and are deleted immediately after the output is produced. DreamCraftr does not permanently store the original uploaded reference image in its application databases or long-term file storage.

DreamCraftr stores only the resulting generated illustration or other generated output that the adult account holder chooses to save to the account. DreamCraftr does not harvest, map, analyze for identity verification, use for biometric recognition, or store biometric identifiers, facial geometry, facial templates, or similar biometric data from uploaded reference images.

5. Sources of Personal Data

• Directly from you when you register, create stories, upload content, make purchases, publish content, or contact support.
• From identity or authentication providers when you choose a third-party sign-in option.
• From payment and commerce providers, including Lemon Squeezy, in connection with subscription management, transaction confirmation, tax handling, and fraud prevention.
• Automatically from your browser, device, and interactions with the Service, subject to applicable consent requirements.

6. How We Use Personal Data

• To create and manage your account and authenticate your access to the Service.
• To process prompts, generate stories and illustrations, and save outputs to your story library.
• To process uploaded reference images transiently in order to create requested character illustrations.
• To provide customer support, troubleshoot issues, maintain security, and prevent fraud or abuse.
• To process purchases, manage subscriptions, issue receipts, and comply with accounting and tax obligations.
• To monitor performance, measure product usage, and improve safety, quality, and reliability where permitted by law.
• To enforce our Terms of Service, investigate violations, and protect users, children, DreamCraftr, and the public.
• To comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

7. Legal Bases for Processing

If you are in the EEA, UK, or another jurisdiction that requires a legal basis for processing, DreamCraftr generally relies on the following bases depending on the processing activity:

• Performance of a contract: to create your account, deliver the Service, generate content, maintain your library, and administer purchases and subscriptions.
• Consent: where required for optional analytics, certain cookies or similar technologies, and where an adult user voluntarily provides a child's personal data or image to request a generation involving that child's likeness.
• Legitimate interests: to secure the Service, prevent misuse, improve performance, moderate abuse, maintain product quality, and protect legal rights, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: to retain tax and accounting records, respond to lawful requests, and satisfy applicable compliance duties.

8. Children's Privacy, COPPA, and GDPR-K

DreamCraftr is not directed to children as independent users. Accounts must be created, managed, and paid for by adults only. We do not knowingly permit children to open accounts or transact directly through the Service.

Where an adult user uploads a child's name, likeness, or other personal data for story creation, that information is provided by the adult parent or legal guardian through an explicit, proactive action at the point of upload or submission. The adult user is responsible for ensuring that the submission is lawful and appropriately consented under applicable law, including COPPA in the United States and GDPR-K or similar age-based consent rules in the EU or UK.

If we learn that a child has created an account directly or that personal data about a child was provided without appropriate parental or guardian authorization, we may suspend the account, delete the data, and take any other action reasonably necessary to protect the child and comply with law.

9. Sharing and Third-Party Disclosures

We disclose personal data only as reasonably necessary to operate the Service, complete transactions, comply with law, and protect rights or safety. Categories of recipients include:

• Google Vertex AI, Gemini, and Imagen APIs, which process prompts, generation instructions, and transient image inputs needed to create requested text and image outputs.
• Cloud hosting, storage, authentication, database, logging, security, and infrastructure providers that help us operate the Service.
• Lemon Squeezy, which acts as Merchant of Record for purchases, handles checkout, payment processing, invoicing, local tax calculation and compliance, and transaction-related customer service.
• Analytics and diagnostics providers where you have consented or where permitted by applicable law.
• Professional advisers, auditors, insurers, regulators, law enforcement, courts, or counterparties in connection with legal obligations, enforcement, or corporate transactions.

10. International Data Transfers

DreamCraftr operates globally and may transfer personal data to, or permit access from, countries other than the one in which you are located, including the United States and other jurisdictions where our service providers or technical infrastructure are based.

Where required by applicable law, DreamCraftr implements appropriate safeguards for cross-border transfers, such as Standard Contractual Clauses (SCCs), equivalent UK transfer mechanisms, or supplementary contractual or technical measures. By using the Service, you understand that your data may be processed in countries whose data protection laws may differ from those of your home jurisdiction.

11. Retention

• Account data is retained for as long as your account remains active and for a limited period thereafter as needed for legal, security, backup, fraud-prevention, or dispute-resolution purposes.
• Saved stories, generated illustrations, and related outputs are retained until you delete them or your account is deleted, subject to limited backup or legal retention periods.
• Original uploaded reference images are not retained as stored assets; they are processed transiently and deleted immediately after generation completes.
• Transaction and tax records may be retained for the period required by applicable accounting, tax, chargeback, and financial compliance laws.
• Moderation, abuse-prevention, and security records may be retained for as long as reasonably necessary to protect the Service and users.

12. Security Measures

DreamCraftr uses technical and organizational measures designed to protect personal data, including encryption in transit, access controls, authentication safeguards, and service-provider security commitments. No method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security.

13. Your Privacy Rights

Depending on where you live, you may have rights to access personal data, request correction, request deletion, obtain portability, restrict or object to certain processing, withdraw consent, and appeal a privacy decision. California residents may also have rights under CCPA/CPRA, including the right to know, delete, correct, and limit certain uses of sensitive personal information.

DreamCraftr does not sell personal data and does not share personal data for cross-context behavioral advertising. To exercise your privacy rights, contact privacy@dreamcraftr.com. We may need to verify your identity before acting on your request.

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete information.
• Right to data portability: request a portable copy of data you provided to us where applicable.
• Right to be forgotten or deletion: request deletion of your account and generated assets, subject to lawful retention exceptions.
• Right to object or restrict: object to certain processing or ask us to limit it where the law provides that right.
• Right to withdraw consent: withdraw consent for consent-based processing, including optional analytics, without affecting prior lawful processing.

14. Cookies and Analytics

DreamCraftr may use essential cookies or similar technologies required for authentication, security, and core functionality. Optional analytics technologies are used only in accordance with your consent choices where required by law. You can manage consent through the tools we provide and through your browser controls, though disabling certain technologies may affect functionality.

15. California Privacy Notice

For the preceding twelve months, DreamCraftr has collected the categories of information described in this Privacy Policy, disclosed them for business purposes to the categories of service providers described above, and has not sold personal information or shared it for cross-context behavioral advertising. We use and disclose personal information only for the business and commercial purposes described in this Policy.

If you are a California resident, you may submit a request to know, correct, delete, or access your personal information by contacting privacy@dreamcraftr.com. You may also designate an authorized agent to make a request on your behalf, subject to verification requirements.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, our providers, or our practices. When we do, we will post the revised version here and update the last updated date. If changes are materially adverse or otherwise require notice under applicable law, we will provide additional notice through the Service or by other appropriate means.

17. Contact Us and Complaints

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how we handle personal data, contact DreamCraftr at privacy@dreamcraftr.com.

If you are located in the EEA or UK, you may also have the right to lodge a complaint with your local supervisory authority if you believe that our processing of your personal data violates applicable law.