Privacy policy

In Ecuador, the Spanish version prevails if there is any difference between versions.

Summary for kids

• You play here without telling us your name. Your nickname comes from a word list, like "Swift Comet 27".
• We never ask for your photo, your voice, where you live or your email.
• There is no chat with other people. No stranger can message you.
• Orbi, the robot guide, is a computer program and not a person. Do not tell it your name, your school or where you live.
• We save your points, stars and badges so you can see yourself getting better.
• Your family can see your progress and choose how long you play.
• If your family says yes, your points and progress are also saved on our secure computer, so you can play on another device.
• If something worries you, tell a grown-up in your family. They can write to us.

Summary for families

• The controller is D-Legacy SAS, an Ecuadorian company that runs the Daleki Gaming brand.
• Without a family account, everything stays only in the browser on the device. We do not receive your child's progress.
• With your authorization, we keep a pseudonymous profile and game results on our servers to sync, show reports and, if you turn it on, weekly leaderboards with nicknames.
• We never ask children for a real name, photo, voice, location, email or phone number. No chat between people, no ads, no third-party trackers. We do not sell data.
• Orbi, the site guide, uses artificial intelligence to answer questions about the studio and the games. We do not keep those conversations on our servers, and we remove emails and phone numbers before sending them to the AI provider.
• You can view, download and delete the data in the Family zone or by writing to [PRIVACY EMAIL] (pending).

1. Who is responsible for your data

Controller: D-Legacy SAS Tax ID (RUC): [RUC] (pending) Registered address: [ADDRESS] (pending), Quito, Ecuador Phone: [PHONE] (pending) Privacy email: [PRIVACY EMAIL] (pending)

Daleki Gaming is a brand of D-Legacy SAS and part of Daleki Global. D-Legacy SAS is the only operator that collects or maintains children's data on Daleki Gaming.

Data Protection Officer: [DPO NAME] (pending) Address: [DPO ADDRESS] (pending) Phone: [DPO PHONE] (pending) Email: [DPO EMAIL] (pending)

2. Who the service is for

Daleki Gaming is a studio of learning games for girls and boys aged 6 to 12. We treat everyone who plays as a minor. Family accounts, payments and authorizations can only be managed by a person over 18 who is the child's parent, guardian or legal representative (the "parent" in this policy).

Under Ecuadorian law, children and teenagers under 15 exercise their data rights through their legal representative. That is why this policy is written mainly for families, with a summary for kids at the top.

3. What data we process

3.1 If you play without a family account (on-this-device mode)

Everything is saved in the browser's local storage: the nickname picked from a fixed list, the character and color, the age range (6 to 8 or 9 to 12), the language, the results of each match, progress, badges, daily missions, the daily play limit and sound and theme preferences. In this mode we do not receive or store that data on our servers. If browser data is cleared, the progress is lost.

To show you the website, our hosting provider receives technical connection data (see 3.3).

3.2 If an adult creates a family account and authorizes sync

From the adult:

• Email address, language and country.
• Proof of authorization: date, time, version of this policy, IP address and the text accepted.
• If they buy a paid plan: plan, subscription status, billing and renewal dates, and the data the payment provider sends back to us (for example, country and last digits of the card). We do not store the full card number.
• Messages sent to support.

From each player profile (no real name):

• A pseudonymous identifier we generate.
• Nickname from a fixed list, character and color, age range and language.
• Results of each match: game, score, stars, correct answers, attempts, level, duration and date.
• Calculated progress: experience, skills, badges, missions and days played in a row.
• Temporary 6-character codes to continue on another device, which expire after 10 minutes.

3.3 Technical connection data

When anyone visits the website, our servers and hosting provider receive the IP address, browser and device type, the page requested and the time. We use it to deliver the page, limit abuse (for example, too many requests in a row) and protect security. We do not use it to identify children, build profiles or advertise.

3.4 App waitlist

If an adult leaves their email for the launch announcement, we keep the email, language, chosen platform and the date of their consent.

4. What we do not do

• We never ask children for a real name, photo, video, voice, address, location, school, email or phone number.
• There is no chat or messaging between people, no voice and no public profile with photos. Orbi is an automated assistant, not a person.
• We show no advertising, contextual or personalized.
• We use no third-party analytics, pixels or trackers.
• We do not sell, rent or share personal data with third parties for their own purposes.
• We do not use biometric data or facial recognition.
• We do not record voices. Read-aloud instructions are produced by the browser itself from the game's text.

5. Why we use data and on what legal basis

6. Authorization from the legal representative

Before we store any child's game data on our servers, we ask the adult to:

1. Create a family account with their email.
2. Confirm they are an adult and the child's legal representative.
3. Read this policy and tick the authorization.
4. Confirm through the link we email them. We then send a second confirmation email explaining how to revoke the authorization.

If the adult buys a paid plan, the card transaction also helps confirm they are an adult.

Authorization for weekly leaderboards is separate and optional. Without it, the child can still play and sync.

If you do not authorize, your child can keep playing in on-this-device mode. You can revoke authorization at any time in the Family zone or by writing to [PRIVACY EMAIL] (pending). When you revoke it, we stop collecting profile data and delete what we hold on the server, except what the law requires us to keep.

7. What other people can see

• Nothing in the profile is public unless you turn on weekly leaderboards.
• Leaderboards show only the fixed-list nickname, the character and the best score of the week. They do not show age, country, photos or anything else.
• The adult who holds the family account can see the child's learning report. We tell the child on their profile that their family can see their progress.

8. Personalization and automated decisions

Some games adjust difficulty based on answers (for example, three right answers in a row raise the level and two mistakes lower it) and the report suggests games to balance skills. These automated assessments only change the challenge inside the game. They have no legal effects, are not used for advertising, are not shared and do not decide access to the service. You can ask for an explanation of how they work or object to us using play history for suggestions by writing to [PRIVACY EMAIL] (pending).

9. Where data is stored and international transfers

Our technical providers are in the United States, which has not been declared to offer an adequate level of protection by Ecuador's Personal Data Protection Superintendency as of this date. Each transfer therefore relies on binding data processing contracts that include the model contractual clauses recognized by the Superintendency, with obligations equal to or higher than Ecuadorian law, and rights to complain and obtain redress. We register or notify these transfers with the Superintendency as current rules require.

These providers only process data on our instructions, to provide their service to us, and commit in writing to keep it confidential, secure and intact. They do not receive data for their own purposes.

The game La Mansión Boo loads fonts from Google Fonts, so Google receives the device's IP address to deliver them.

10. How long we keep data

We never keep children's data indefinitely. When we delete it, we use measures that prevent recovery.

11. How we protect data

• Encrypted connections (HTTPS) across the site.
• The session lives in a cookie that page code cannot read (httpOnly).
• The database allows no public access; only our server can read and write it.
• Request limits and strict validation of what the server receives.
• Internal access limited to the people who need it, with two-factor authentication.
• A written information security program, with a named coordinator, a risk assessment at least once a year and regular testing of safeguards.
• We collect the minimum: nicknames come from fixed lists so a child cannot type their name.

12. If a security incident happens

If an incident could affect people's rights, we will notify Ecuador's Personal Data Protection Superintendency and any other competent authority within the legal deadlines (in Ecuador, no later than 5 business days after we become aware), and we will tell affected families without delay, within 3 business days when there is a risk to their rights, explaining what happened and what they can do.

13. Your rights

The adult who holds the account, for themselves or as the child's representative, can:

• Access the data and learn how we process it.
• Correct or update inaccurate data.
• Delete the data.
• Object to processing.
• Request portability, meaning receive the data in a structured, commonly used format.
• Ask us to suspend or restrict processing.
• Not be subject to decisions based solely on automated assessments.
• Withdraw authorization or consent at any time, without retroactive effect.
• Refuse further collection of the child's data.

How to exercise them:

• In the Family zone: view the report, download data, turn off leaderboards, delete a profile or the whole account.
• By email to [PRIVACY EMAIL] (pending) or to the DPO at [DPO EMAIL] (pending), or in writing to [ADDRESS] (pending).

To protect the child, we will verify that the request comes from the account holder (for example, with a link sent to the registered email). We answer free of charge within 15 days.

If you are not satisfied with our answer, you can file a complaint with Ecuador's Personal Data Protection Superintendency (www.spdp.gob.ec). If you live in another country, you can also contact your local data protection authority.

14. Local storage and cookies

We only use storage that is strictly necessary for the service to work. We use no advertising, analytics or cross-site tracking cookies, so we do not show a cookie banner.

15. Emails to adults

We send service emails (authorization confirmation, receipts, trial and renewal reminders, notices of important changes and of deletion for inactivity). We only send news if you agreed to it. Every news email has an unsubscribe link that we apply immediately. We never email children.

16. People outside Ecuador

United States (COPPA). D-Legacy SAS is the operator of the service. We collect from children only the data described in section 3.2, with verifiable consent from their parent or guardian. A child cannot make personal information public: leaderboards only show fixed-list nicknames, if the family turns them on. Parents and guardians can review their child's information, ask us to delete it and refuse further collection or use, through the means in section 13. We do not condition a child's participation on giving more information than necessary. We do not sell or share personal information, and would not sell or share that of anyone under 16 without consent.

European Union, European Economic Area and United Kingdom. For now we do not direct or promote the service in these regions. If you use it from there, our legal bases are performance of the contract with the adult, consent from the holder of parental responsibility for the child's data (art. 8 GDPR), legal obligations and legitimate interest in security. Transfers outside these regions rely on standard contractual clauses. You can complain to the supervisory authority in your country.

17. Changes to this policy

We publish each version with a number and date, and a history at the end. If a change significantly affects how we handle children's data, we will email the family account before applying it and ask for a new authorization. Without it, we will not apply the change to the child's data.

18. Contact

D-Legacy SAS, [ADDRESS] (pending), Quito, Ecuador [PRIVACY EMAIL] (pending) · [PHONE] (pending) Data Protection Officer: [DPO NAME] (pending), [DPO EMAIL] (pending)

Version history