Privacy for families
Privacy policy
Information about contact enquiries, character favorites, site analytics and data handling.
Responsible party
- Name
- Lester Romero Bernardo
- Tax ID
- 60679024X
- Postal address
- Calle Juana María Condesa Lluch 6, Valencia, España
- Privacy contact
- lasaventurasdecurileta@gmail.com
Information sent through the contact form
The form is intended for adults. It asks for a name, email address, organisation (if applicable), country, enquiry category and message, together with adult and privacy confirmations. When the production form is active, the website stores the submission and form answers in Supabase so authorised team members can review them in the dashboard. If email delivery is configured, Resend sends a notification to the selected project address. A delivery failure leaves the submission available in the dashboard. Vercel hosts the website, Supabase stores enquiries, Cloudflare Turnstile checks public submissions for spam and Resend sends email notifications when enabled. The processing regions, transfer safeguards and contractual roles of these providers still need confirmation.
Do not include personal information about children in the message. The technical hosting and email providers may process data as needed to deliver and secure the service; their applicable privacy terms should also be reviewed.
The backend stores daily aggregate counts by page, language, content and sharing method. Social, email and SMS options record a click to start sharing; the device share sheet and copy action are recorded only when the browser confirms the action. The website cannot confirm whether an external message was sent. Optional video votes are counted only after a visitor chooses to vote and passes Cloudflare Turnstile; a local browser marker discourages repeat votes. If you choose a character as a favorite, a random browser token is stored in local storage and its one way hash is kept on the server so the site can remember your favorites and count them. This token is separate from analytics and is not used to build a visitor profile. Analytics events respect the browser’s Do Not Track signal.
If you choose a sharing service, the browser opens it with the content link and, depending on the option, its title or message. WhatsApp, Telegram, Facebook, LinkedIn, X, email and messaging services then process your interaction under their own terms. YouTube loads only after you open a video.
Purpose, rights and contact
Information is used to respond to the enquiry and manage the resulting conversation. Open enquiries are kept while they are being handled. Enquiries closed without lead follow-up are deleted from Supabase 30 days after closure. Leads are reviewed after 12 months without activity; the team receives a notice and the record is scheduled for deletion 30 days after that notice unless follow-up activity resumes. Email notifications already delivered to the recipient mailbox are not removed by this database cleanup and follow that mailbox’s retention settings. To exercise your rights, contact the responsible party at lasaventurasdecurileta@gmail.com. The legal basis for each purpose, provider processing regions and transfer safeguards still need review before this draft becomes the final notice and the production form is activated.
You may request access, rectification, erasure, restriction or portability where applicable, and object to processing where the law allows. You may withdraw consent where consent is the legal basis. You can also lodge a complaint with the Spanish Data Protection Authority. AEPD
Contact the team