RILEY’S WAY PRIVACY POLICY AND CHILDREN’S PRIVACY NOTICE

Effective and Last Updated: July 31, 2026

1. PURPOSE AND SCOPE

Riley’s Way, LLC operates the Riley’s Way store, website, and connected Crown Club app experience, including related information, content, features, products, memberships, digital resources, tools, and services, collectively referred to in this Privacy Policy as the “Services.”

This Privacy Policy and Children’s Privacy Notice explains how Riley’s Way collects, uses, discloses, protects, retains, and deletes personal information when a person:

• Visits rileysway.com or app.rileysway.com;
• Creates or manages a Riley’s Way parent account;
• Creates or manages a Crown Club child profile;
• Uses Crown Club or Child Mode;
• Purchases a product or membership;
• Uses a wishlist, reward, activity, photo, safety, or community feature;
• Contacts customer support;
• Submits a safety, privacy, correction, or deletion request; or
• Otherwise communicates with Riley’s Way.

If there is a conflict between the Riley’s Way Terms of Use and this Privacy Policy concerning the collection, use, disclosure, retention, or deletion of personal information, this Privacy Policy controls.

This Privacy Policy provides notice of Riley’s Way’s information practices. It does not, by itself, constitute consent where federal or state law requires separate consent. Riley’s Way provides separate notices and obtains separate consent when required, including verifiable parental consent for covered information from children under 13 and consent for optional photo or community features.

2. WHO WE ARE

Riley’s Way, LLC is the business and online-service operator responsible for Riley’s Way and Crown Club.

Riley’s Way, LLC is the operator designated to respond to questions from parents, legal guardians, customers, and users concerning the collection and use of personal information from or about children.

Contact information:

Riley’s Way, LLC
14029 W. McNichols
Detroit, Michigan 48235
United States

Email: customersupport@rileysway.com
Phone: 313-364-9409

The names and functions of other operators and service providers that collect or maintain child personal information on behalf of Riley’s Way are listed in the Riley’s Way Child Data Operators and Service Providers List available at:

https://app.rileysway.com/child-data-providers

That list is incorporated into this Children’s Privacy Notice and will be updated when a provider is added, removed, or its role materially changes.

3. UNITED STATES SERVICE

At this initial launch, Riley’s Way and Crown Club sales, checkout, and app enrollment are open to customers and parent-led families in the 50 United States and the District of Columbia while broader availability is prepared.

International visitors may explore the public website, but Riley’s Way does not enable checkout, paid memberships, parent accounts, child profiles, Child Mode, or Crown Club enrollment for additional locations until the required tax, checkout, shipping, subscription, privacy, provider, notice, rights, consent-system, and international data-transfer settings are verified for those locations.

The Riley’s Way public website or store may be technically accessible from other countries. Personal information submitted to Riley’s Way may be processed in the United States and in other countries where Riley’s Way’s properly authorized service providers operate.

4. PARENT-MANAGED CROWN CLUB ACCOUNTS

Crown Club is a parent-led service for girls ages 6 through 16.

A parent or legal guardian who is at least 18 years old must:

• Create and own the parent account;
• Complete checkout;
• Manage membership access;
• Create and manage child profiles;
• Receive child-privacy notices;
• Provide or decline consent;
• Manage permissions;
• Select a child profile before Child Mode is used; and
• Supervise the child’s use of Crown Club.

Children do not independently create customer accounts, purchase memberships, complete checkout, manage billing, provide payment-card information, or control the parent account.

Creating a parent account does not, by itself, authorize Riley’s Way to collect personal information from or about a child. Before an under-13 child profile becomes active or covered child information is collected, Riley’s Way provides the parent or legal guardian with a direct notice and obtains verifiable parental consent, except where limited collection is permitted by law without prior consent.

5. INFORMATION RILEY’S WAY COLLECTS OR PROCESSES

The personal information Riley’s Way collects depends on the Services and features used.

A. Parent and Customer Contact Information

Riley’s Way may collect:

• Parent or customer name;
• Email address;
• Telephone number;
• Billing address;
• Shipping address;
• Customer-support contact information;
• Communication preferences; and
• Information needed to verify the identity or authority of a parent, customer, or privacy-requestor.

B. Parent Account and Authentication Information

Riley’s Way may collect:

• Parent account email;
• Username or account identifier;
• Password and authentication information;
• Account-verification status;
• Password-reset and login records;
• Membership status;
• Account settings;
• Permission settings;
• Communication preferences;
• Parent-child profile relationship records; and
• Records showing the date, method, scope, and version of a parent’s consent.

Passwords are handled through Riley’s Way’s authorized authentication systems. Riley’s Way does not display a user’s existing password to Riley’s Way staff.

C. Payment, Transaction, and Store Information

Riley’s Way may process:

• Products or memberships viewed;
• Cart and checkout activity;
• Products placed on a wishlist;
• Purchases;
• Order confirmation;
• Subscription or membership status;
• Payment confirmation;
• Shipping and fulfillment information;
• Returns;
• Exchanges;
• Cancellations;
• Refunds;
• Discounts;
• Reward redemptions; and
• Past transaction records.

The Riley’s Way store and checkout are powered by Shopify and supported payment processors. Full payment-card numbers are submitted to and processed by Shopify or its authorized payment processors. Riley’s Way does not ask a child to submit payment information and does not collect full payment-card details inside Child Mode.

D. Crown Club Child Profile Information

After required notice and consent, Riley’s Way may collect or process limited child profile information, including:

• A child nickname selected by the parent;
• Date of birth or age information entered by the parent;
• Age-group or age-path placement;
• Avatar selection;
• The child profile’s connection to the parent account;
• Parent consent and permission settings;
• Profile status;
• Safety settings;
• Membership eligibility;
• Content eligibility;
• Activity completions;
• Crown Wins;
• Fresh Drop progress;
• Reward points or progress;
• Badges or digital rewards;
• Wishlist selections;
• Parent-managed support records; and
• Information needed to deliver and maintain the requested Crown Club experience.

Riley’s Way uses age information to place the child in the appropriate Crown Club age path, including Little Dreamers, Rising Stars, or Future Leaders.

Riley’s Way does not require a child’s public full name, school name, home address, personal telephone number, personal email address, social-media handle, public contact information, or precise geolocation to create a standard Crown Club child profile.

E. Child Mode Activity and Content

When a child uses Child Mode, Riley’s Way may process information about:

• The child profile selected by the parent;
• Content viewed;
• Fresh Drops opened;
• Videos, images, or activities accessed;
• Activities completed;
• Reward progress;
• Wishlist selections;
• Age-appropriate prompts;
• Preapproved Kind Words selections, when enabled;
• Reflection or journal responses, if an enabled feature saves them;
• Feature settings; and
• Dates and times associated with app activity.

Riley’s Way collects only the information reasonably necessary to provide the requested feature, maintain progress, operate rewards, protect account security, or meet a disclosed safety purpose.

Families should not enter full names, school names, addresses, telephone numbers, email addresses, precise locations, medical information, passwords, financial information, or other unnecessary identifying details in reflection, journal, support, photo-caption, or open-text fields.

F. Photographs and Photo-Review Information

When a parent separately authorizes a photo feature, Riley’s Way may collect or process:

• A photograph selected and submitted by the parent;
• A processed or re-encoded version of the photograph;
• File type, file size, dimensions, and upload date;
• Technical-screening results;
• Metadata-removal results;
• Parent photo consent;
• Parent community-sharing consent, if separately provided;
• Human review or moderation status;
• Approval or rejection decision;
• Safety or privacy flags;
• Parent deletion or consent-withdrawal records; and
• Records necessary to investigate a reported safety or privacy concern.

Riley’s Way does not use child photographs to create facial-recognition templates, perform identity matching, conduct biometric profiling, target advertising, or train general-purpose or third-party artificial-intelligence models.

G. Community and Safety Information

When an applicable feature is enabled, Riley’s Way may process:

• Approved Kind Words selections;
• Community permission status;
• Photo permission status;
• Moderation decisions;
• Parent warnings;
• Restricted-access decisions;
• Reports of bullying or harsh words;
• Reports of unsafe adult behavior;
• Reports concerning identifying information;
• Privacy or photo concerns;
• Safety investigations; and
• Records needed to protect children, enforce the Community Guidelines, and respond to parents.

Riley’s Way does not provide private adult-to-child messaging, public child contact details, public child location sharing, or unreviewed open-text conversations between children and adults.

H. Device, Cookie, and Technical Information

Riley’s Way and properly restricted service providers may automatically process limited technical information, including:

• Device type;
• Operating system;
• Browser type;
• Internet Protocol address;
• Network connection information;
• Session information;
• Cookie or local-storage identifiers;
• Authentication tokens;
• Log data;
• Error or security information;
• Pages or app screens accessed; and
• Dates and times of access.

Riley’s Way may use an Internet Protocol address to provide the service, maintain security, prevent fraud, investigate misuse, and derive a general geographic area. Riley’s Way does not request or intentionally collect a child’s precise geolocation through Crown Club.

Persistent identifiers associated with children are used only as necessary for authentication, security, session delivery, content delivery, maintaining a child’s requested progress, protecting the service, and other legally permitted internal operations. Riley’s Way does not use a child’s persistent identifier to contact the child, target advertisements, build an advertising profile, or track the child across unrelated websites or services.

I. Communications and Privacy Requests

Riley’s Way may collect information submitted when a parent or customer:

• Contacts customer support;
• Requests membership assistance;
• Reports a concern;
• Requests access to information;
• Requests correction;
• Requests deletion;
• Withdraws consent;
• Appeals a privacy decision;
• Reports suspected fraud or account misuse; or
• Otherwise communicates with Riley’s Way.

Parents should avoid including unnecessary child information in support or privacy requests.

6. HOW RILEY’S WAY COLLECTS INFORMATION

Riley’s Way may collect personal information:

• Directly from a parent, legal guardian, customer, or authorized user;
• From a child’s use of an activated, parent-managed Child Mode profile after required notice and consent;
• Automatically through the Services and necessary cookies, local storage, logs, and similar technologies;
• From Shopify and authorized payment processors;
• From app hosting, database, authentication, cloud-storage, security, email, support, moderation, and other service providers acting on Riley’s Way’s behalf;
• From a person who submits a safety or privacy report; and
• From government authorities or other persons where permitted or required by law.

7. HOW RILEY’S WAY USES PERSONAL INFORMATION

Riley’s Way may use personal information to:

A. Provide the Services

• Create and maintain parent accounts;
• Verify account email addresses;
• Authenticate users;
• Process purchases;
• Fulfill orders;
• Maintain memberships;
• Match a membership purchase to the parent checkout email;
• Create parent-managed child profiles;
• Provide Child Mode;
• Deliver age-appropriate content;
• Save requested progress;
• Maintain rewards and wishlist selections;
• Provide customer support; and
• Process returns, refunds, exchanges, or cancellations.

B. Provide Age-Appropriate Crown Club Content

Riley’s Way may use a child’s date of birth, age, or age-path placement to show content intended for the child’s age group.

Riley’s Way does not use age information to target advertising to the child.

C. Operate Parent-Approved Photo and Community Features

When separately authorized, Riley’s Way may use a submitted photograph to:

• Remove metadata;
• Re-encode the file;
• Conduct technical screening;
• Store the processed image privately;
• Conduct human safety review;
• Allow the parent to review or delete it; and
• Prepare it for a separately authorized Community Photos feature.

A parent’s permission for private photo submission and review does not automatically authorize disclosure of the photograph to other members. Separate permission is required before member-visible Community Photos disclosure.

D. Protect Safety and Security

Riley’s Way may use information to:

• Authenticate accounts;
• Prevent unauthorized access;
• Protect children;
• Enforce parent controls;
• Investigate suspicious activity;
• Prevent fraud;
• Review safety or privacy concerns;
• Moderate approved features;
• Prevent adult-to-child private contact;
• Restrict harmful access;
• Enforce Riley’s Way policies; and
• Maintain the security, confidentiality, and integrity of the Services.

E. Communicate With Parents and Customers

Riley’s Way may use adult contact information to:

• Confirm an account;
• Send purchase or membership information;
• Send important service or safety notices;
• Respond to support requests;
• Respond to privacy requests;
• Notify a parent of a material child-privacy change;
• Obtain or renew legally required consent; and
• Send marketing communications when permitted.

Riley’s Way does not send behavioral advertising or direct marketing to a child profile.

F. Improve the Services

Riley’s Way may use limited information to troubleshoot, test, secure, maintain, and improve the Services.

Whenever reasonably possible, Riley’s Way uses aggregated or de-identified information for research, analytics, and product improvement.

Riley’s Way does not use child personal information to train a general-purpose or third-party artificial-intelligence model. If Riley’s Way proposes a material new automated-processing use involving child personal information, Riley’s Way will provide a new direct notice and obtain any consent required before that use begins.

G. Comply With Law

Riley’s Way may use information to:

• Comply with applicable law;
• Respond to valid legal process;
• Protect legal rights;
• Maintain required business records;
• Investigate fraud or illegal conduct;
• Protect a child or another person from a credible safety threat;
• Participate in a legal proceeding; or
• Enforce applicable agreements and policies.

8. WHAT RILEY’S WAY DOES NOT DO WITH MINOR DATA

Riley’s Way does not:

• Sell personal information from or about minors;
• Share personal information from or about minors for cross-context behavioral advertising;
• Use personal information from or about minors for targeted advertising;
• Build advertising profiles about minors;
• Place third-party behavioral advertising in Child Mode;
• Use child photographs for facial recognition or biometric identification;
• Use child personal information to train general-purpose or third-party artificial-intelligence models;
• Require more child personal information than is reasonably necessary to participate in a Crown Club activity;
• Require a child to provide additional personal information to earn a prize or reward;
• Permit public child profiles;
• Permit private adult-to-child messaging;
• Publish a child’s school, address, telephone number, email address, precise location, or other direct contact information;
• Permit unmoderated Community Photos; or
• Use manipulative design intended to pressure a child into disclosing additional personal information.

These promises apply to personal information from or about users Riley’s Way knows are under 18, not only to the information displayed on the visible child profile.

9. COOKIES, ANALYTICS, AND PRIVACY SIGNALS

The Riley’s Way storefront may use cookies and similar technologies supplied by Shopify or other properly authorized providers to operate checkout, remember preferences, maintain security, understand general website performance, and provide features requested by adult customers.

Child Mode is configured to use only technical information reasonably necessary for authentication, session delivery, content delivery, requested progress, security, fraud prevention, service reliability, and legally permitted internal operations.

Riley’s Way does not use Child Mode information for targeted advertising or cross-site behavioral tracking.

Where applicable law requires consent for a nonessential cookie or similar technology, Riley’s Way will request that consent before activating the technology.

Where required by law, Riley’s Way recognizes supported opt-out preference signals, including Global Privacy Control, for the browser or device sending the signal.

More information about Global Privacy Control is available at:

https://globalprivacycontrol.org/

10. HOW RILEY’S WAY DISCLOSES PERSONAL INFORMATION

Riley’s Way may disclose personal information only as described below.

A. Service Providers Acting for Riley’s Way

Riley’s Way may provide limited information to service providers that perform authorized services on Riley’s Way’s behalf, such as:

• Store and checkout services;
• Payment processing;
• App hosting;
• Database services;
• Authentication;
• Cloud storage;
• Email delivery;
• Customer support;
• Order fulfillment;
• Shipping;
• Security;
• Fraud prevention;
• Error monitoring;
• Technical maintenance;
• Photo processing;
• Human moderation; and
• Privacy-request management.

Service providers that receive child personal information must be contractually restricted to using that information only to perform the services Riley’s Way requests. They may not use child personal information for their own advertising, profiling, model training, sale, or unrelated purposes.

Before allowing an operator, service provider, or third party to collect or maintain child personal information, Riley’s Way takes reasonable steps to determine that the provider can protect the information and obtains written assurances requiring reasonable confidentiality, security, integrity, retention, and deletion protections.

The names and functions of current child-data operators and providers are listed at:

https://app.rileysway.com/child-data-providers

B. Shopify and Payment Providers

Shopify provides the Riley’s Way store, checkout, order, and related commerce services.

Shopify and authorized payment processors may process adult customer, checkout, transaction, device, and payment information under their own applicable privacy terms and as necessary to provide commerce services.

Riley’s Way does not intentionally send child photographs, child reflections, safety reports, or detailed Child Mode activity to Shopify. Membership confirmation may be connected to the parent account through the parent email used at checkout.

Shopify’s consumer privacy information is available at:

https://privacy.shopify.com/en

C. At the Parent’s Direction

Riley’s Way may disclose information when a parent or authorized customer specifically requests, directs, or separately consents to the disclosure.

A parent’s consent to basic Crown Club collection and use does not constitute consent to optional Community Photos disclosure.

D. Safety and Legal Disclosures

Riley’s Way may disclose information when Riley’s Way reasonably believes disclosure is necessary to:

• Comply with applicable law;
• Respond to valid legal process;
• Protect a child from a credible safety threat;
• Investigate fraud, abuse, or illegal activity;
• Protect the rights or security of Riley’s Way or others;
• Enforce Riley’s Way policies; or
• Respond to an emergency involving danger of death or serious physical injury.

E. Business Transactions

If Riley’s Way is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be reviewed or transferred as part of that transaction.

Any successor must continue to protect child personal information consistently with this Privacy Policy unless Riley’s Way first provides legally required notice and obtains new consent for a material change.

11. CHILDREN UNDER 13 AND COPPA

Crown Club includes services directed to children under 13. Riley’s Way follows the Children’s Online Privacy Protection Act and the Federal Trade Commission’s COPPA Rule when collecting, using, or disclosing covered personal information from a child under 13.

Before collecting covered personal information from or about a child under 13, Riley’s Way:

• Provides the parent or legal guardian with a direct notice;
• Explains the information Riley’s Way proposes to collect;
• Explains how the information will be used;
• Identifies the specific categories of service providers or recipients;
• Explains any potential disclosure;
• Provides a link to this Privacy Policy and Children’s Privacy Notice;
• Explains the method of parental verification;
• Obtains the parent’s affirmative, verifiable consent; and
• Records the date, method, scope, and applicable notice version associated with the consent.

Riley’s Way does not activate an under-13 child profile or begin covered child-data collection until verifiable parental consent has been completed, except where law permits limited collection for purposes such as obtaining consent, protecting safety, or responding to a one-time request.

For a paid Crown Club membership, Riley’s Way may use a qualifying credit-card, debit-card, or other online-payment transaction that provides notice of the discrete transaction to the primary account holder as part of the parental verification process.

For a free Starter Preview, the preview must remain an adult-only demonstration that does not activate a real child profile or collect covered child information until Riley’s Way completes parental verification through an electronically signed parental-consent form or another legally permitted verification method.

If Riley’s Way collects a parent’s or child’s name or online contact information only to provide notice and obtain parental consent, and consent is not completed within 30 days, Riley’s Way deletes that information unless a shorter period is required by law.

Riley’s Way provides a parent the option to consent to collection and use of the child’s personal information without consenting to optional disclosure to other Crown Club families or other non-integral third parties.

Riley’s Way obtains separate verifiable parental consent before optional disclosure unless the disclosure is integral to the specific service the parent requested and is permitted by law.

Riley’s Way obtains new verifiable parental consent before making a material change to child-information collection, use, or disclosure practices for which the parent previously provided consent.

12. USERS AGES 13 THROUGH 17

Crown Club remains parent-managed for users ages 13 through 17.

Riley’s Way processes personal information reasonably necessary to provide the specific Crown Club service selected by the parent, maintain the account, protect security, deliver age-appropriate content, and perform other legally permitted purposes.

Where state law requires the teen user’s consent for processing that is not strictly necessary to provide the parent-selected service, Riley’s Way provides the teen with an age-appropriate notice and obtains the teen’s affirmative consent before the optional processing begins.

Optional processing may include:

• Optional Community Photos disclosure;
• Optional member-visible sharing;
• Nonessential personalization;
• Nonessential research;
• Processing unrelated to the feature requested;
• A material new use of saved responses; or
• Other processing for which minor consent is required by applicable law.

A teen’s refusal to approve optional processing will not prevent access to core Crown Club features unless the information is reasonably necessary to provide the particular feature requested.

Riley’s Way does not sell teen personal information, use teen personal information for targeted advertising, or use it to build an advertising profile.

13. PHOTO AND COMMUNITY FEATURES

A. Separate Permission Before Photo Collection

A parent must provide separate photo permission before Riley’s Way accepts or processes a child photograph.

Basic child-profile consent does not include photo permission.

B. Private Review

As of the effective date of this Privacy Policy, public and member-visible Community Photos sharing is closed.

After separate parent permission, a parent-submitted photograph may enter private review. Riley’s Way may:

• Validate the file type and size;
• Re-encode the file;
• Remove available device and location metadata;
• Store the processed photograph privately;
• Create a private human-review item;
• Approve or reject the photograph;
• Record the review decision; and
• Provide the parent with a deletion control.

C. Separate Permission Before Community Disclosure

Permission to upload a photograph for private review does not authorize Riley’s Way to show the photograph to another Crown Club family.

If Riley’s Way activates member-visible Community Photos, Riley’s Way will first obtain separate parent consent for that disclosure.

Where applicable law requires the consent of a user ages 13 through 17 for optional disclosure, Riley’s Way will also obtain the teen’s consent.

D. Moderation and Identifying Information

Before an approved photograph may appear in any parent-approved community feature, it must pass human moderation.

Riley’s Way does not permit photo captions or child profiles to display:

• Full names;
• School names;
• Home addresses;
• Precise locations;
• Telephone numbers;
• Email addresses;
• Social-media handles;
• Public contact information; or
• Other identifying details that create an unreasonable safety risk.

Kind Words are limited to preapproved, age-appropriate phrases. Riley’s Way does not permit unreviewed open-text adult-to-child communication.

E. Photo Prohibitions

Riley’s Way does not use submitted child photographs for:

• Facial recognition;
• Face geometry templates;
• Identity matching;
• Biometric profiling;
• Targeted advertising;
• Advertising profiles;
• General-purpose artificial-intelligence training;
• Third-party artificial-intelligence model training; or
• Sale to another business.

F. Parent Controls

A parent may:

• Review the status of a submitted photograph;
• Withdraw photo permission;
• Withdraw Community Photos permission;
• Delete a submitted photograph;
• Request removal from any enabled community feature; and
• Submit a privacy or safety concern.

Withdrawal applies prospectively and results in deletion under the retention schedule below, except for a limited record Riley’s Way is legally required to keep or temporarily needs for a documented safety investigation.

14. DATA MINIMIZATION

Riley’s Way limits collection of child personal information to information reasonably necessary to provide the parent-selected service, maintain security, protect children, and fulfill other disclosed and legally permitted purposes.

Riley’s Way does not condition a child’s participation in an activity, game, reward, or prize on the child providing more personal information than is reasonably necessary to participate.

Where a less identifying alternative is reasonably sufficient, Riley’s Way uses the less identifying alternative.

15. RETENTION AND DELETION SCHEDULE

Riley’s Way retains personal information only for as long as reasonably necessary for the specific purpose for which it was collected.

Riley’s Way does not retain child personal information indefinitely.

The following schedule applies unless a shorter period is required by law or a documented legal hold, fraud investigation, or serious child-safety matter requires limited additional retention.

A. Information Collected Only to Obtain Parental Consent

Parent or child name and online contact information collected only to provide notice and obtain parental consent is deleted within 30 days if consent is not completed.

B. Active Parent Account Information

Parent account information is generally retained while the account is active.

After a verified parent-account deletion request or final account closure, information not subject to a separate retention requirement is deleted from active systems within 30 days and expires from routine backups within 90 days.

C. Child Profile and Core Crown Club Information

Child nickname, age-path information, avatar, activity completions, reward progress, wishlist selections, saved responses, and related profile information are retained while the child profile is active and the information is reasonably necessary to provide Crown Club.

After the parent deletes the child profile, withdraws consent for continued collection, or closes the applicable account, child profile information is deleted from active systems within 30 days and expires from routine backups within 90 days.

D. Parental Consent Records

Records demonstrating the date, method, scope, and version of parental consent may be retained for three years after the related child information is deleted, or longer if reasonably necessary to establish legal compliance.

Consent records are separated from unnecessary child content and are not used for marketing.

E. Original Photo Uploads

Where technically feasible, the original uploaded photo file is deleted after secure validation, metadata removal, and creation of the processed review copy, and ordinarily within 24 hours.

F. Rejected Photos

A rejected processed photograph is deleted from active systems within 30 days after the review decision, unless it is temporarily needed for a documented safety investigation or legal obligation.

Routine backup copies expire within 90 days.

G. Approved Private Photos

An approved photograph kept in private review is retained only while the parent’s photo permission remains active and the photograph is reasonably necessary for the parent-selected feature.

After the parent deletes the photograph, withdraws photo permission, or closes the child profile, the photograph is deleted from active systems within 30 days and expires from routine backups within 90 days.

H. Community Photos

If Community Photos becomes active, a parent-approved community photograph is retained only while the relevant photo and community permissions remain active.

After permission is withdrawn or the parent requests removal, the photograph is removed from member-visible access as promptly as reasonably possible, deleted from active systems within 30 days, and allowed to expire from routine backups within 90 days.

I. Technical and Security Logs

Ordinary device, authentication, security, and technical logs are generally retained for no more than 12 months.

A limited log may be retained longer when reasonably necessary to investigate a specific security incident, fraud event, account takeover, or legal matter.

J. Support and Privacy Requests

Support, correction, access, deletion, consent-withdrawal, and privacy-request records are generally retained for 24 months after the request is completed so Riley’s Way can document and manage the request.

Unnecessary child content submitted with a request is deleted sooner where reasonably possible.

K. Safety and Moderation Records

Safety and moderation records are generally retained for up to two years after the matter is resolved when continued retention is reasonably necessary to protect children, identify repeated harmful conduct, document the response, or defend legal rights.

Records may be retained longer only for a documented legal hold, credible ongoing safety risk, law-enforcement matter, or other legal requirement.

L. Transaction, Accounting, and Tax Records

Parent purchase, payment-confirmation, accounting, and tax records may be retained for up to seven years or the period required by applicable financial, tax, or accounting law.

Riley’s Way does not use the need to retain an adult transaction record as a reason to retain an unnecessary child photograph, reflection, activity history, or child profile.

M. Backup Information

Information scheduled for deletion may remain temporarily in encrypted or access-restricted backups until the backup expires under the ordinary backup cycle.

Backup information is isolated from routine use and is not restored except for disaster recovery, security, or legal necessity.

16. SECURITY OF PERSONAL INFORMATION

Riley’s Way maintains administrative, technical, and physical safeguards designed to protect personal information, including safeguards appropriate to the sensitivity of information from or about children.

Riley’s Way’s child-information security program includes:

• A written information-security program;
• A designated person responsible for coordinating the program;
• Initial and at least annual risk assessments;
• Access controls;
• Least-privilege access;
• Authentication safeguards;
• Secure transmission;
• Secure storage appropriate to the information;
• Testing and monitoring;
• Service-provider review;
• Written provider security assurances;
• Retention and secure-deletion procedures;
• Incident-response procedures; and
• Periodic review and updating of safeguards.

Riley’s Way limits access to child personal information to personnel and authorized providers that reasonably need access to perform their assigned responsibilities.

No security system can guarantee absolute security. If Riley’s Way discovers a security incident involving personal information, Riley’s Way will investigate and provide notice to affected persons and authorities where required by law.

17. PARENT RIGHTS CONCERNING CHILD INFORMATION

A verified parent or legal guardian may:

• Ask whether Riley’s Way maintains personal information from or about the child;
• Receive a description of the specific categories of child personal information collected;
• Review personal information collected from the child;
• Request correction of inaccurate information;
• Request deletion of child personal information;
• Withdraw previously provided consent;
• Refuse further collection or use;
• Decline optional photo collection;
• Decline optional Community Photos disclosure;
• Consent to collection and use without consenting to optional third-party disclosure;
• Delete a child profile;
• Delete submitted photographs;
• Manage permissions; and
• Submit a privacy or safety complaint.

Riley’s Way takes reasonable steps to verify that the requestor is the child’s parent or legal guardian before providing access to or deleting child personal information.

Riley’s Way does not require a parent to disclose more information than is reasonably necessary to verify the request.

Withdrawing consent or requesting deletion may prevent Riley’s Way from continuing to provide a feature that reasonably requires the information. Riley’s Way will explain the effect of the request before completing it where appropriate.

Parents may submit a request through:

https://app.rileysway.com/privacy-request

Parents may also contact:

customersupport@rileysway.com

18. OTHER PRIVACY RIGHTS AND CHOICES

Depending on the person’s state of residence and subject to applicable exceptions, a person may have the right to:

• Confirm whether Riley’s Way processes personal information;
• Access personal information;
• Correct inaccurate personal information;
• Delete personal information;
• Receive a portable copy of certain information;
• Opt out of the sale of personal information;
• Opt out of sharing for cross-context behavioral advertising;
• Opt out of targeted advertising;
• Opt out of qualifying profiling;
• Limit certain uses of sensitive personal information;
• Withdraw consent;
• Appeal a decision concerning a privacy request; and
• Use an authorized agent where permitted.

Riley’s Way does not sell personal information from or about minors or use it for targeted advertising.

Riley’s Way may need to verify the requestor’s identity, account relationship, or parental authority before completing a request.

Riley’s Way will not unlawfully discriminate against a person for exercising a privacy right.

If Riley’s Way denies a request, Riley’s Way will provide an explanation and information about any available appeal right where required by law.

19. MARKETING COMMUNICATIONS

Riley’s Way may send marketing communications to an adult parent or customer when permitted by law.

Riley’s Way does not send direct marketing to child profiles or use a child’s private activity, photograph, reflection, safety report, or emotional content to market products.

A person may unsubscribe from promotional emails by using the unsubscribe link in the message. Opting out of marketing emails does not prevent Riley’s Way from sending necessary account, purchase, membership, safety, consent, privacy, or service communications.

Consent to receive automated promotional text messages must be requested separately from account creation, membership purchase, and child-data consent.

Consent to marketing text messages is not a condition of purchasing a product or membership.

A recipient may follow the instructions in a text message, including replying STOP where available, to withdraw consent. Message and data rates may apply.

20. DE-IDENTIFIED AND AGGREGATED INFORMATION

Riley’s Way may create and use information that has been aggregated or de-identified so that it cannot reasonably identify or be linked to a particular person or child.

When Riley’s Way maintains information as de-identified information, Riley’s Way takes reasonable measures to prevent reidentification and does not attempt to reidentify it except to test whether de-identification protections are effective or as otherwise permitted by law.

21. THIRD-PARTY WEBSITES AND SERVICES

The Services may contain links to websites or services operated by third parties.

A third-party website’s privacy practices are governed by that third party’s own privacy notice and terms. Riley’s Way is not responsible for the privacy, security, accuracy, or practices of an unaffiliated third-party website.

Riley’s Way does not treat the presence of a link as permission for the third party to collect child personal information through Crown Club.

22. CHANGES TO THIS PRIVACY POLICY

Riley’s Way may update this Privacy Policy to reflect changes in the Services, legal requirements, safety practices, providers, or information practices.

Riley’s Way will:

• Post the updated Privacy Policy;
• Update the effective date;
• Provide additional notice where required; and
• Preserve records of material prior versions where reasonably necessary.

Before making a material change to the collection, use, or disclosure of covered personal information from a child under 13, Riley’s Way will provide the parent with a new direct notice and obtain new verifiable parental consent.

Where applicable law requires the consent of a user ages 13 through 17 for a material or optional processing change, Riley’s Way will also obtain that consent before the changed processing begins.

23. QUESTIONS, COMPLAINTS, AND CONTACT INFORMATION

Questions about this Privacy Policy, child information, parental consent, account access, correction, deletion, photo permissions, Community Photos, safety, or privacy rights may be directed to:

Riley’s Way, LLC
14029 W. McNichols
Detroit, Michigan 48235
United States

Email: customersupport@rileysway.com
Phone: 313-364-9409

Privacy requests may also be submitted at:

https://app.rileysway.com/privacy-request