Child data providers

RILEY'S WAY CHILD DATA OPERATORS AND SERVICE PROVIDERS

Last updated: September 18, 2026.

Provider roles and review status

Providers that help operate and protect Crown Club.

These providers help run Riley's Way. Each entry explains what the provider does, which information it may handle, and how that information is protected and retained.

Children's Privacy Notice Privacy request

Riley's Way, LLC

Service: Riley's Way and Crown Club
Role and purpose: Crown Club operator, parent-account administration, child-profile management, consent management, customer support, safety review, privacy requests, and Crown Club program delivery.
Child Information Categories: Child nickname; age or age-path placement; avatar; permissions; activity progress; rewards; wishlist information; saved responses where enabled; photo and moderation information where separately authorized; support information; safety information; limited technical information necessary to provide and protect Crown Club.
Stored: Yes, where necessary for the listed service.
Retention or Deletion: Information is retained and deleted according to the Riley's Way Privacy Policy and Children's Privacy Notice.
Verified Restrictions: Riley's Way does not authorize sale of minor data, targeted advertising using minor data, advertising profiles about minors, facial recognition, biometric profiling, or general-purpose or third-party AI model training using child information.
Verification Date: July 31, 2026

Shopify Inc.

Service: Shopify store, checkout, order, and supported payment services
Role and purpose: Riley's Way storefront, checkout, parent transaction processing, order administration, and membership purchase confirmation.
Parent Information Categories: Parent/customer checkout information; adult customer email; order and membership purchase details; technical checkout information. Crown Club Child Mode is configured not to send child photographs, child reflections, safety reports, or detailed child activity to Shopify..
Stored: Yes, where necessary for the listed service.
Retention or Deletion: Handled through Shopify store, checkout, order, and account systems. Riley's Way retains only the minimum membership matching evidence in the app.
Verified Restrictions: Riley's Way configuration uses Shopify for adult commerce and membership matching, not Child Mode activity or child photo processing.
Verification Date: July 31, 2026

SUPABASE PTE. LTD.

Service: Supabase database, authentication, and private storage
Role and purpose: Supports parent login, child profiles, consent records, app data, private photo review storage when enabled, audit records, and server-side data access.
Child Information Categories: Parent account data; child nickname; birthday or age path; avatar; consent records; activity progress; rewards; wishlist choices; support and safety records; audit logs; private photo records where separately enabled.
Stored: Yes, where necessary for the listed service.
Retention or Deletion: Riley's Way app deletion workflows remove active app records from Supabase. Child profile activation and private photo upload remain disabled unless production retention, storage, and backup controls match the active retention schedule.
Verified Restrictions: Riley's Way uses Supabase for app database, authentication, and storage. Riley's Way does not configure Supabase for independent advertising, facial recognition, biometric processing, or AI model training.
Verification Date: July 31, 2026

Netlify, Inc.

Service: Netlify app hosting, deployment, content delivery, and serverless functions
Role and purpose: Hosts and delivers the Crown Club web application and related server functions.
Child Information Categories: Limited request information; Internet Protocol address; browser/session technical data; security and function logs needed to deliver and protect the app.
Stored: Yes, where necessary for the listed service.
Retention or Deletion: Netlify function and edge-function logs are provider-managed by plan. Riley's Way redacts child content from function logs and keeps child profile activation disabled unless production log retention and redaction controls match the active retention schedule.
Verified Restrictions: Riley's Way uses Netlify for hosting and delivery, not independent advertising, facial recognition, biometric processing, or AI model training.
Verification Date: July 31, 2026

AC PM LLC

Service: Postmark transactional email through Supabase Auth SMTP and the Postmark Email API
Role and purpose: Delivers parent-account authentication messages through Supabase Auth custom SMTP and parent-only preview-start confirmations and reminders before the preview ends through the Postmark Email API.
Parent Information Categories: Parent email address; transactional message and delivery metadata; parent-account authentication email content; preview start and expiration dates and parent-only preview notice content.
Stored: Yes, where necessary for the listed service.
Retention or Deletion: Postmark public documentation states sent email message content and activity data are stored for 45 days by default unless an account retention add-on changes the activity-retention period. Riley's Way authentication and preview notices are limited to parent-account transactional messages and must not include child profile, activity, reflection, reward, photo, or safety content. Preview notices have open and link tracking turned off.
Verified Restrictions: Postmark's public DPA states it processes personal information according to customer instructions and does not sell or share personal information. Postmark's public security documentation states employee account access occurs only with explicit account-owner permission or Terms-of-Use compliance review.
Verification Date: Authentication and provider-account evidence: August 7, 2026. Preview notices and delivery configuration: September 18, 2026.

Cloudflare Stream (account contracting entity not yet verified)

Service: Cloudflare Stream embedded lesson videos configured for future releases
Role and purpose: Configured for 18 approved future lesson videos, with the earliest scheduled for May 20, 2027. As of September 18, 2026, none of these lessons is released; the current welcome videos use Riley's Way local files. This listing describes configured future use, not evidence that a child has played a Stream video.
Potential Information for Future Videos: If a future embedded video is loaded: connection IP address; browser/device request information; app origin/referrer; video playback and viewing analytics.
Stored: Account-specific storage and retention have not yet been verified. No current child-video transmission is established by the configuration review.
Retention or Deletion: Account-level retention, deletion and contractual terms remain pending review. No fixed retention period or verified account-level child-data protection is claimed here.
Restrictions Review: Account-level restrictions and the contracting entity have not yet been verified. Existing Riley's Way restrictions on child data still apply; this entry does not authorize advertising, profiling or additional child-data use.
Verification Date: September 18, 2026: configuration and release status only; account-level review pending.

Questions

Contact Riley's Way about child data.

Riley's Way, LLC, 14029 W. McNichols, Detroit, Michigan 48235, United States. Email customersupport@rileysway.com or call 313-364-9409.

Submit privacy request Privacy Policy and Children's Privacy Notice

Opening Riley's Way

Preparing the parent-led member experience.

Riley's Way, LLC

Service

Riley's Way and Crown Club

Role and purpose

Crown Club operator, parent-account administration, child-profile management, consent management, customer support, safety review, privacy requests, and Crown Club program delivery.

Child Information Categories

Child nickname; age or age-path placement; avatar; permissions; activity progress; rewards; wishlist information; saved responses where enabled; photo and moderation information where separately authorized; support information; safety information; limited technical information necessary to provide and protect Crown Club.

Stored

Yes, where necessary for the listed service.

Retention or Deletion

Information is retained and deleted according to the Riley's Way Privacy Policy and Children's Privacy Notice.

Verified Restrictions

Riley's Way does not authorize sale of minor data, targeted advertising using minor data, advertising profiles about minors, facial recognition, biometric profiling, or general-purpose or third-party AI model training using child information.

Verification Date

July 31, 2026

Shopify Inc.

Service

Shopify store, checkout, order, and supported payment services

Role and purpose

Riley's Way storefront, checkout, parent transaction processing, order administration, and membership purchase confirmation.

Parent Information Categories

Parent/customer checkout information; adult customer email; order and membership purchase details; technical checkout information. Crown Club Child Mode is configured not to send child photographs, child reflections, safety reports, or detailed child activity to Shopify..

Stored

Yes, where necessary for the listed service.

Retention or Deletion

Handled through Shopify store, checkout, order, and account systems. Riley's Way retains only the minimum membership matching evidence in the app.

Verified Restrictions

Riley's Way configuration uses Shopify for adult commerce and membership matching, not Child Mode activity or child photo processing.

Verification Date

July 31, 2026

SUPABASE PTE. LTD.

Service

Supabase database, authentication, and private storage

Role and purpose

Supports parent login, child profiles, consent records, app data, private photo review storage when enabled, audit records, and server-side data access.

Child Information Categories

Parent account data; child nickname; birthday or age path; avatar; consent records; activity progress; rewards; wishlist choices; support and safety records; audit logs; private photo records where separately enabled.

Stored

Yes, where necessary for the listed service.

Retention or Deletion

Riley's Way app deletion workflows remove active app records from Supabase. Child profile activation and private photo upload remain disabled unless production retention, storage, and backup controls match the active retention schedule.

Verified Restrictions

Riley's Way uses Supabase for app database, authentication, and storage. Riley's Way does not configure Supabase for independent advertising, facial recognition, biometric processing, or AI model training.

Verification Date

July 31, 2026

Netlify, Inc.

Service

Netlify app hosting, deployment, content delivery, and serverless functions

Role and purpose

Hosts and delivers the Crown Club web application and related server functions.

Child Information Categories

Limited request information; Internet Protocol address; browser/session technical data; security and function logs needed to deliver and protect the app.

Stored

Yes, where necessary for the listed service.

Retention or Deletion

Netlify function and edge-function logs are provider-managed by plan. Riley's Way redacts child content from function logs and keeps child profile activation disabled unless production log retention and redaction controls match the active retention schedule.

Verified Restrictions

Riley's Way uses Netlify for hosting and delivery, not independent advertising, facial recognition, biometric processing, or AI model training.

Verification Date

July 31, 2026

AC PM LLC

Service

Postmark transactional email through Supabase Auth SMTP and the Postmark Email API

Role and purpose

Delivers parent-account authentication messages through Supabase Auth custom SMTP and parent-only preview-start confirmations and reminders before the preview ends through the Postmark Email API.

Parent Information Categories

Parent email address; transactional message and delivery metadata; parent-account authentication email content; preview start and expiration dates and parent-only preview notice content.

Stored

Yes, where necessary for the listed service.

Retention or Deletion

Postmark public documentation states sent email message content and activity data are stored for 45 days by default unless an account retention add-on changes the activity-retention period. Riley's Way authentication and preview notices are limited to parent-account transactional messages and must not include child profile, activity, reflection, reward, photo, or safety content. Preview notices have open and link tracking turned off.

Verified Restrictions

Postmark's public DPA states it processes personal information according to customer instructions and does not sell or share personal information. Postmark's public security documentation states employee account access occurs only with explicit account-owner permission or Terms-of-Use compliance review.

Verification Date

Authentication and provider-account evidence: August 7, 2026. Preview notices and delivery configuration: September 18, 2026.

Cloudflare Stream (account contracting entity not yet verified)

Service

Cloudflare Stream embedded lesson videos configured for future releases

Role and purpose

Configured for 18 approved future lesson videos, with the earliest scheduled for May 20, 2027. As of September 18, 2026, none of these lessons is released; the current welcome videos use Riley's Way local files. This listing describes configured future use, not evidence that a child has played a Stream video.

Potential Information for Future Videos

If a future embedded video is loaded: connection IP address; browser/device request information; app origin/referrer; video playback and viewing analytics.

Stored

Account-specific storage and retention have not yet been verified. No current child-video transmission is established by the configuration review.

Retention or Deletion

Account-level retention, deletion and contractual terms remain pending review. No fixed retention period or verified account-level child-data protection is claimed here.

Restrictions Review

Account-level restrictions and the contracting entity have not yet been verified. Existing Riley's Way restrictions on child data still apply; this entry does not authorize advertising, profiling or additional child-data use.

Verification Date

September 18, 2026: configuration and release status only; account-level review pending.