Privacy

Who we are

Dragon Kids Land (dragonkidsland.com) is run by Mindsolve Consulting SRL. For the personal data described here, Mindsolve Consulting SRL is the data controller under the EU General Data Protection Regulation (GDPR).

• •Mindsolve Consulting SRL, a company registered in Romania
• •Website: www.mindsolveconsulting.com
• •Email: hello@dragonkidsland.com

We are a small team and have not appointed a data protection officer, as the law does not require one for what we do. Privacy questions sent to the address above are read and answered by a person.

Who the site is for

The songs, videos and stories are made for children. The website itself is made for the adults who share them: parents, carers and teachers. Children are welcome to listen, watch and read with a grown-up, but there is nothing on the site for a child to sign up to or fill in.

Using the site without an account

You can listen to every song, watch every video and read every story without an account and without telling us who you are.

• •No advertising, and no advertising or tracking cookies
• •No analytics scripts and no third-party marketing pixels
• •No behavioural profiling of anybody, at any age
• •No embedded players from other platforms: the songs, videos, pictures and fonts are served from our own server
• •Our pages switch off access to your location, camera and microphone

What we collect, why, and the legal basis

This is everything we handle about people, with the reason and the legal basis the GDPR asks us to name.

• •Server logs. When your browser asks for a page, our web server records the IP address, the date and time, the page requested, the page you came from and the browser's user-agent string. We use them to keep the site running, fix faults and block abuse. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f)).
• •Error reports. If a page breaks, we record the error, the page address (without anything after a ?), the browser family and a shortened, salted one-way code made from the IP address, not the address itself. Same purpose and basis as the logs.
• •Abuse protection. To stop automated abuse, the server counts requests per IP address for a few minutes. The count is kept in memory only and is never written down. Same basis.
• •The waitlist. If you join, we keep your email address, the date you joined, the page you joined from, your browser's language setting and, if you were signed in, which account joined. We use it for one thing: to email you once when personalised stories open. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• •Your account. If you sign in, we keep your email address, the dates the account was created and changed, your language and, where you gave them, a display name and the confirmations you ticked (that you are an adult, that you accept the terms, whether you want product news). Sign-in uses a one-time link valid for 15 minutes; we store only a scrambled (hashed) copy of it. Legal basis: providing the account you asked for (Art. 6(1)(b)).
• •Emails you send us. Your address and what you write, so we can answer and keep a record of what was agreed. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)).
• •Legal duties. If the law makes us keep something, for example accounting records once there are sales, we keep it for that reason (Art. 6(1)(c)).

We do not use personal data for automated decisions about anybody, we do not build profiles, and we do not use your data to train AI models.

Personalised stories (not open yet)

Personalised stories are not open yet, and the part of the site that would make them is switched off. Today we do not ask for, and do not hold, any information about a child.

When they open, a personalised story will need a few details about the child that the adult chooses to give us, such as a first name or nickname and an age range, and never a photograph. We will update this notice before that happens and explain exactly what is collected, why, and for how long.

How long we keep it

• •Server logs: 30 days, then deleted.
• •Error reports: 90 days, then deleted.
• •Abuse-protection counters: a few minutes, in memory only.
• •The waitlist: until we have sent the email saying personalised stories are open, then deleted within 30 days. If they have not opened within 24 months of the day you joined, we delete your entry anyway. You can ask us to delete it sooner at any time.
• •Sign-in links: they stop working after 15 minutes or once used.
• •The sign-in cookie: 30 days, or until you sign out.
• •Your account: until you delete it. We delete the account and everything in it within 30 days of your request, except anything the law makes us keep.
• •Emails you send us: as long as we need them to deal with what you asked, and no longer than 2 years after the conversation ends.

Who else handles it

We use a small number of service providers (processors) who handle data only on our instructions, under a data processing agreement:

• •OVHcloud (OVH SAS, France): hosts our web server and database in the European Union. Everything listed in this notice is stored there.
• •Resend (Plus Five Five, Inc., United States): delivers the emails we send, which are sign-in links and the one waitlist email. It receives your email address and the message.
• •The provider that hosts our mailbox receives the emails you send to us.

We do not sell or rent personal data, and we do not share it with advertisers or data brokers. We would only disclose it to someone else if the law required us to, for example a valid order from a court or a public authority.

Links to YouTube and other platforms

Our pages link to our channels and to the songs on YouTube, YouTube Music, Spotify, Apple Music, Instagram, TikTok and Facebook. These are plain links: nothing from those platforms loads on our pages, and they learn nothing from us until you click. Once you are on their site, their own privacy policies apply.

International transfers

Our server and database are in the European Union. The one exception is email delivery: Resend is based in the United States. That transfer is covered by the EU-U.S. Data Privacy Framework, which Resend is certified under, and by the European Commission's Standard Contractual Clauses in Resend's data processing agreement.

Cookies and storage on your device

We do not use advertising or analytics cookies, which is why there is no cookie banner. What we store on your device is either strictly necessary or remembers a choice you made, and is never used to track you. This is everything:

• •pt_session (cookie): set only when you sign in, so you stay signed in. It holds a signed account reference, cannot be read by scripts, and lasts 30 days or until you sign out.
• •theme (local storage): remembers whether you chose the light or the dark look.
• •puddletales:ambience (local storage): remembers whether background sounds in the story reader are on and how loud.
• •puddletales.duel.progress.v1 (local storage): your stars and progress in the story game, where that game is switched on. It stays on your device and is never sent to us.
• •pt:studio-draft:v1 (local storage): only if you use the personalised story studio. It keeps an unfinished story, including any first name you typed, on your device so nothing is lost if you reload. It is never sent to us until you order, expires after 24 hours and is cleared once an order goes through.
• •pt-chunk-reload-at (session storage): a timestamp that lets a page reload itself once after we update the site. It is deleted when you close the tab.

You can remove all of these at any time by clearing this site's data in your browser settings. The site still works without them; you will just be signed out and your choices reset.

Children

Our content is for children; the website is for the adults with them. We have built it so that a child using it leaves no trace with us. There are no accounts for children, no chat, no comments, no uploads and nothing to fill in.

The waitlist and accounts are for adults only. We do not knowingly collect personal data from children: in the EU and UK that means anyone under the age set by local law for consenting to online services (16 in Romania), and in the United States anyone under 13. If you think a child has given us personal data, for example by typing an email address into the waitlist, write to us and we will delete it.

For families in the United States: no feature of the site collects personal information from children, and there are no third-party trackers or ad networks on our pages, so no personal information of a child under 13 is collected through the site under the Children's Online Privacy Protection Act (COPPA).

For families in the United Kingdom: we follow the principles of the Age Appropriate Design Code. Privacy is high by default, nothing is used for profiling, location is never requested, and nothing is shared for advertising.

AI-made content

The stories on this site are new retellings of public-domain tales, written with AI tools. The illustrations, narration, songs (music and vocals), song videos and the dragon mascot's artwork are created with AI tools too. How we make and source it.

None of your personal data is used to create this content or to train AI models.

Your rights

Under the GDPR you can ask us, free of charge, to:

• •tell you what data we hold about you and give you a copy
• •correct anything that is wrong
• •delete your data
• •restrict how we use it while a question is being sorted out
• •give you the data you gave us in a common, machine-readable format
• •stop using it where we rely on our legitimate interests (you can object at any time)
• •withdraw your consent, for example by leaving the waitlist, without affecting what was done before

How to use your rights, and how to complain

Email hello@dragonkidsland.com. We reply within one month. If a request is complex we may need up to two more months, and we will tell you why. We may ask you to confirm the request from the email address it concerns, so that we never hand your data to someone else.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to a data protection authority at any time:

• •in Romania: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro
• •elsewhere in the EU: the authority in the country where you live or work (list of EU authorities)
• •in the United Kingdom: the Information Commissioner's Office, ico.org.uk

Security

The site only works over an encrypted connection (HTTPS). Sign-in links are stored only in scrambled form, the sign-in cookie is signed and cannot be read by scripts, and access to the server and database is limited to the people who run the site. No system is perfectly safe, but if something went wrong that put your data at risk, we would tell you and the authority as the law requires.

Changes to this notice

If we change what we collect or why, we update this page and the date at the top before the change takes effect. If a change matters to people who have an account or are on the waitlist, we will also tell them by email.

Questions

Email hello@dragonkidsland.com. The rules for using the site are in our terms.