Privacy Policy

This Privacy Policy covers DreamCraftr's global AI-powered storybook platform, including its child-character reference image feature and the handling of global privacy rights.

It is intended to address key requirements under GDPR, UK GDPR, COPPA, CCPA/CPRA, and related international privacy standards.

1. Scope of This Privacy Policy

This Privacy Policy explains how DreamCraftr collects, uses, discloses, transfers, stores, and otherwise processes personal data when you access dreamcraftr.com or use DreamCraftr's websites, applications, AI story generation tools, billing features, and related services (collectively, the "Service"). It is intended for a global audience, including users in the United States, European Union, United Kingdom, and other international markets.

DreamCraftr is designed for adult account holders. Accounts must be created, managed, and paid for by a parent, legal guardian, or other adult user. If an adult user chooses to provide a child's name, preferences, or reference photo as part of the story creation process, that information is provided solely by the adult user acting with explicit, proactive consent and authority.

2. Data Controller and Contact Details

DreamCraftr is the controller of the personal data described in this Privacy Policy, except where another party independently determines the purposes and means of processing, such as Lemon Squeezy as Merchant of Record for payment processing. For privacy requests or questions, contact us at privacy@dreamcraftr.com.

3. Categories of Personal Data We Process

• Account and identity data, such as your email address, display name, authentication identifiers, and profile information you choose to provide.
• Story creation inputs, such as prompts, character names, age-range selections for story audiences, preferences, and other instructions you submit.
• Generated outputs, such as AI-generated story text, cover art, page illustrations, saved story metadata, and library records associated with your account.
• Reference image inputs that you voluntarily upload to guide character illustration generation, processed only on a transient basis as described in Section 4.
• Transaction and billing records, such as order identifiers, subscription status, purchase amounts, tax amounts, payment status, and fraud-prevention metadata supplied by Lemon Squeezy or related service providers.
• Support and communications data, such as emails you send to us, customer support messages, and records needed to resolve complaints or technical issues.
• Usage, device, and analytics data, including event-level product analytics and technical logs, where permitted by law and, where required, based on your consent.
• Public sharing data, such as reviews, ratings, public story listings, and profile display information you intentionally publish within the Service.

4. Character Reference Images: Transient Processing Only

DreamCraftr offers a feature that allows an adult user to upload a reference photograph, such as a photo of that user's child, to guide the generation of a matching illustrated storybook character. Original reference images are processed strictly in transit and only for the limited purpose of executing the requested AI generation pipeline.

Those original uploaded images are held temporarily in volatile memory (RAM) or equivalent transient processing infrastructure during generation and are deleted immediately after the output is produced. DreamCraftr does not permanently store the original uploaded reference image in its application databases or long-term file storage.

DreamCraftr stores only the resulting generated illustration or other generated output that the adult account holder chooses to save to the account. DreamCraftr does not harvest, map, analyze for identity verification, use for biometric recognition, or store biometric identifiers, facial geometry, facial templates, or similar biometric data from uploaded reference images.

5. Sources of Personal Data

• Directly from you when you register, create stories, upload content, make purchases, publish content, or contact support.
• From identity or authentication providers when you choose a third-party sign-in option.
• From payment and commerce providers, including Lemon Squeezy, in connection with subscription management, transaction confirmation, tax handling, and fraud prevention.
• Automatically from your browser, device, and interactions with the Service, subject to applicable consent requirements.

6. How We Use Personal Data

• To create and manage your account and authenticate your access to the Service.
• To process prompts, generate stories and illustrations, and save outputs to your story library.
• To process uploaded reference images transiently in order to create requested character illustrations.
• To provide customer support, troubleshoot issues, maintain security, and prevent fraud or abuse.
• To process purchases, manage subscriptions, issue receipts, and comply with accounting and tax obligations.
• To monitor performance, measure product usage, and improve safety, quality, and reliability where permitted by law.
• To enforce our Terms of Service, investigate violations, and protect users, children, DreamCraftr, and the public.
• To comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

7. Legal Bases for Processing

If you are in the EEA, UK, or another jurisdiction that requires a legal basis for processing, DreamCraftr generally relies on the following bases depending on the processing activity:

• Performance of a contract: to create your account, deliver the Service, generate content, maintain your library, and administer purchases and subscriptions.
• Consent: where required for optional analytics, certain cookies or similar technologies, and where an adult user voluntarily provides a child's personal data or image to request a generation involving that child's likeness.
• Legitimate interests: to secure the Service, prevent misuse, improve performance, moderate abuse, maintain product quality, and protect legal rights, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: to retain tax and accounting records, respond to lawful requests, and satisfy applicable compliance duties.

8. Children's Privacy, COPPA, and GDPR-K

DreamCraftr is not directed to children as independent users. Accounts must be created, managed, and paid for by adults only. We do not knowingly permit children to open accounts or transact directly through the Service.

Where an adult user uploads a child's name, likeness, or other personal data for story creation, that information is provided by the adult parent or legal guardian through an explicit, proactive action at the point of upload or submission. The adult user is responsible for ensuring that the submission is lawful and appropriately consented under applicable law, including COPPA in the United States and GDPR-K or similar age-based consent rules in the EU or UK.

If we learn that a child has created an account directly or that personal data about a child was provided without appropriate parental or guardian authorization, we may suspend the account, delete the data, and take any other action reasonably necessary to protect the child and comply with law.

9. Sharing and Third-Party Disclosures

We disclose personal data only as reasonably necessary to operate the Service, complete transactions, comply with law, and protect rights or safety. Categories of recipients include:

• Google Vertex AI, Gemini, and Imagen APIs, which process prompts, generation instructions, and transient image inputs needed to create requested text and image outputs.
• Cloud hosting, storage, authentication, database, logging, security, and infrastructure providers that help us operate the Service.
• Lemon Squeezy, which acts as Merchant of Record for purchases, handles checkout, payment processing, invoicing, local tax calculation and compliance, and transaction-related customer service.
• Analytics and diagnostics providers where you have consented or where permitted by applicable law.
• Professional advisers, auditors, insurers, regulators, law enforcement, courts, or counterparties in connection with legal obligations, enforcement, or corporate transactions.

10. International Data Transfers

DreamCraftr operates globally and may transfer personal data to, or permit access from, countries other than the one in which you are located, including the United States and other jurisdictions where our service providers or technical infrastructure are based.

Where required by applicable law, DreamCraftr implements appropriate safeguards for cross-border transfers, such as Standard Contractual Clauses (SCCs), equivalent UK transfer mechanisms, or supplementary contractual or technical measures. By using the Service, you understand that your data may be processed in countries whose data protection laws may differ from those of your home jurisdiction.

11. Retention

• Account data is retained for as long as your account remains active and for a limited period thereafter as needed for legal, security, backup, fraud-prevention, or dispute-resolution purposes.
• Saved stories, generated illustrations, and related outputs are retained until you delete them or your account is deleted, subject to limited backup or legal retention periods.
• Original uploaded reference images are not retained as stored assets; they are processed transiently and deleted immediately after generation completes.
• Transaction and tax records may be retained for the period required by applicable accounting, tax, chargeback, and financial compliance laws.
• Moderation, abuse-prevention, and security records may be retained for as long as reasonably necessary to protect the Service and users.

12. Security Measures

DreamCraftr uses technical and organizational measures designed to protect personal data, including encryption in transit, access controls, authentication safeguards, and service-provider security commitments. No method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security.

13. Your Privacy Rights

Depending on where you live, you may have rights to access personal data, request correction, request deletion, obtain portability, restrict or object to certain processing, withdraw consent, and appeal a privacy decision. California residents may also have rights under CCPA/CPRA, including the right to know, delete, correct, and limit certain uses of sensitive personal information.

DreamCraftr does not sell personal data and does not share personal data for cross-context behavioral advertising. To exercise your privacy rights, contact privacy@dreamcraftr.com. We may need to verify your identity before acting on your request.

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete information.
• Right to data portability: request a portable copy of data you provided to us where applicable.
• Right to be forgotten or deletion: request deletion of your account and generated assets, subject to lawful retention exceptions.
• Right to object or restrict: object to certain processing or ask us to limit it where the law provides that right.
• Right to withdraw consent: withdraw consent for consent-based processing, including optional analytics, without affecting prior lawful processing.

14. Cookies, Analytics, and Tracking Technologies

DreamCraftr uses essential cookies and similar technologies required for authentication, security, session management, and core Service functionality. These essential technologies cannot be disabled without materially impairing the Service. We also use optional analytics technologies, deployed only with your consent where required by applicable law, as described below.

Google Analytics 4 (GA4): We use Google Analytics 4, a web analytics service provided by Google LLC ("Google"), to understand how users interact with the Service. When you grant analytics consent, GA4 may collect and transmit to Google's servers information such as pages visited, time on page, click events, referral sources, device type, browser type, and a truncated or anonymized IP address. This data is used solely to analyze Service usage and improve the product. DreamCraftr configures GA4 with advertising personalization and ad storage disabled; your analytics data is not used for targeted advertising or remarketing.

Consent Mode v2 and Cookieless Signals: DreamCraftr implements Google Consent Mode v2. In compliance with this specification, the GA4 script library is loaded on all page visits regardless of your consent choice. When you decline analytics, no advertising or analytics cookies are set and no identifiable personal data is transmitted. However, Google may receive limited, aggregate, cookieless modeling signals (non-identifying behavioral patterns) for statistical conversion modeling as part of how Consent Mode v2 operates technically. If you grant analytics consent, full event-level interaction data is transmitted to Google and is governed by Google's Privacy Policy (policies.google.com/privacy).

Managing Your Consent: You may grant or withdraw analytics consent at any time using the consent banner displayed on your first visit or through controls in your account settings. Withdrawing consent immediately stops all cookie-based analytics tracking. You may also use the Google Analytics Opt-Out Browser Add-On (tools.google.com/dlpage/gaoptout) or your browser's privacy controls to limit tracking.

Do Not Track: DreamCraftr does not currently alter its data collection practices in response to browser "Do Not Track" signals because no universally accepted standard exists for interpreting such signals. California residents may use the opt-out rights described in Section 15.

15. California Privacy Notice (CCPA/CPRA)

This section supplements this Privacy Policy and applies specifically to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). For the preceding twelve (12) months, DreamCraftr has collected and processed the categories of personal information described in Section 3, disclosed them for business purposes to the service provider categories in Section 9, and has not sold personal information for monetary consideration.

Analytics "Sharing" Disclosure: When a California resident grants analytics consent, certain online identifiers (such as anonymized IP address, browser and device characteristics, and interaction data) are transmitted to Google LLC under our GA4 integration. Under the CCPA, this type of transmission to a third party may constitute "sharing" personal information for cross-context behavioral advertising purposes, even where advertising features are disabled on our end. DreamCraftr configures GA4 with advertising personalization (ad_personalization) and ad storage (ad_storage) permanently denied. To opt out of analytics data sharing, you may: (1) decline or withdraw analytics consent at any time via the consent banner; (2) use the Google Analytics Opt-Out Add-On at tools.google.com/dlpage/gaoptout; or (3) submit a written opt-out request to privacy@dreamcraftr.com with the subject line "CCPA Opt-Out."

California Consumer Rights: As a California resident, you have the right to: (i) know what personal information we collect, use, share, and disclose about you; (ii) request deletion of your personal information, subject to lawful retention exceptions; (iii) request correction of inaccurate personal information; (iv) opt out of the sale or sharing of your personal information for cross-context behavioral advertising (see the Analytics Sharing Disclosure above); (v) limit use and disclosure of sensitive personal information to what is necessary to perform the Service; and (vi) non-discrimination for exercising your privacy rights. To submit a verifiable consumer request, contact privacy@dreamcraftr.com. We will verify your identity before processing your request and will respond within 45 days (extendable by an additional 45 days where reasonably necessary with notice).

Shine the Light (Cal. Civ. Code § 1798.83): DreamCraftr does not disclose personal information to third parties for their own direct marketing purposes, and therefore no annual Shine the Light disclosure is required.

CalOPPA Compliance: This Privacy Policy is publicly posted on the Service and updated to reflect material changes in our practices. Users may review and update their personal information through account settings or by contacting privacy@dreamcraftr.com.

16. Email Communications and CAN-SPAM Compliance

Types of Emails We Send: DreamCraftr sends the following categories of email: (a) Transactional emails, including account registration confirmations, password resets, billing receipts, subscription renewal notices, and critical service or safety announcements — these are sent as a necessary part of your account relationship and cannot be opted out of while your account remains active; and (b) Marketing emails, including feature announcements, promotional offers, and story-creation tips — sent only where you have opted in or where otherwise permitted by applicable law.

How to Opt Out: You may opt out of non-essential marketing emails at any time by clicking the "Unsubscribe" link included in every marketing email, or by emailing support@dreamcraftr.com with the subject line "Unsubscribe." We will honor all opt-out requests within ten (10) business days as required by the CAN-SPAM Act (15 U.S.C. § 7701 et seq.). Opting out of marketing emails does not affect your receipt of transactional emails.

Physical Address: In compliance with the CAN-SPAM Act, our physical business mailing address is included in the footer of every marketing email we send. [OPERATOR ACTION REQUIRED: Insert your verified physical mailing address here and in marketing email footers, e.g.: "DreamCraftr, [Street Address], [City, Country/State, ZIP]."]

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, our providers, or our practices. When we do, we will post the revised version here and update the last updated date. If changes are materially adverse or otherwise require notice under applicable law, we will provide additional notice through the Service or by other appropriate means.

18. Contact Us and Complaints

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how we handle personal data, contact DreamCraftr at privacy@dreamcraftr.com.

If you are located in the EEA or UK, you may also have the right to lodge a complaint with your local supervisory authority if you believe that our processing of your personal data violates applicable law.