Privacy Policy
Last updated: May 20, 2026
At Dreamsite SL (hereinafter, "FunPartyAI") we take the protection of personal data very seriously, especially when it comes to photographs of minors. This Privacy Policy explains how we collect, use, store and protect your personal data when you use our service at funpartyai.com.
1. Data controller
- Company name: Dreamsite SL
- Tax ID (NIF): B82940719
- Registered office: Avenida de la Industria 4, 28108 Alcobendas, Madrid (Spain)
- Contact email: privacidad@funpartyai.com
2. Personal data we collect
2.1. Data you provide directly
| Category | Specific data | Purpose |
|---|---|---|
| Photographs of minors | Up to 3 photographs of the child | Generation of the cartoon character for the invitation |
| Event details | Child's name, age, date, time and place | Personalization of the invitation |
| Contact details | Email address | Account verification and delivery of the result |
| Payment details | Processed by Stripe; FunPartyAI does not store card data | Payment processing |
2.2. Data collected automatically
| Category | Specific data | Purpose |
|---|---|---|
| Technical data | IP address, browser type, operating system | Rate limiting, security |
| Browsing data | Pages visited, time spent | Statistical analysis (Google Analytics) |
| Cookies | Technical and analytics identifiers | See our Cookie Policy |
2.3. Specially protected data
The minor's facial photographs, when processed by artificial intelligence systems that extract facial features, may constitute biometric data under article 9 of the GDPR. Processing takes place exclusively under the explicit consent of the parent or legal guardian, and the highest protection guarantees are applied.
3. Purposes of processing
a) Provision of the contracted service. Generating the personalized invitation. Legal basis: performance of contract (art. 6.1.b GDPR) and explicit consent for biometric data (art. 9.2.a GDPR).
b) Payment management. Processing payments through Stripe. Legal basis: performance of contract (art. 6.1.b GDPR).
c) Account verification. Sending a verification email. Legal basis: performance of contract (art. 6.1.b GDPR).
d) Security and abuse prevention. Per-IP rate limiting, Cloudflare Turnstile. Legal basis: legitimate interest (art. 6.1.f GDPR).
e) Analysis and service improvement. Statistical analysis via Google Analytics. Legal basis: consent (art. 6.1.a GDPR).
f) Compliance with legal obligations. Retention of billing data. Legal basis: legal obligation (art. 6.1.c GDPR).
4. Processing of minors' data
FunPartyAI processes photographs of minors. In accordance with article 8 of the GDPR and article 7 of the Spanish LOPDGDD:
- Minors under 14 cannot consent by themselves to the processing of their personal data.
- Consent must be given by the parent or legal guardian.
- By using the service, the user declares and warrants that they are the parent or legal guardian of the minor whose photographs they upload.
FunPartyAI requests explicit parental consent through an active acceptance mechanism (non-prechecked checkbox) before processing the photographs, accompanied by clear information about the processing, including the international transfer to providers in the United States.
5. Data recipients
5.1. Data processors
| Provider | Data shared | Purpose | Location |
|---|---|---|---|
| Replicate, Inc. | Photographs of the minor | Generative AI processing | United States |
| Stripe, Inc. | Payment data | Payment processing | USA / EU |
| Supabase, Inc. | Email, event details | Database and authentication | EU (Frankfurt) |
5.2. Other recipients
| Provider | Data shared | Purpose | Location |
|---|---|---|---|
| Google LLC | Anonymized browsing data | Statistical analysis | United States |
| Cloudflare, Inc. | IP, browser data | Anti-bot verification | Global (CDN) |
| AWS | All service data | Server hosting | EU (Frankfurt) |
We do not sell, rent or transfer your personal data to third parties for commercial or advertising purposes.
6. International data transfers
Processing the photographs with artificial intelligence involves transferring personal data to the United States, specifically to Replicate, Inc.
This transfer takes place under the following safeguards:
- EU-US Data Privacy Framework (DPF)
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Documented Transfer Impact Assessment (TIA)
Supplementary technical measures:
- Photographs are transmitted encrypted (TLS 1.3) and deleted from Replicate immediately after processing.
- No persistent facial embeddings are generated or stored.
- Replicate does not use the photographs to train AI models.
7. Retention periods
| Data | Period | Justification |
|---|---|---|
| Original photographs | 24 hours | Automatically deleted after generation |
| Generated invitation | 30 days | Period for download and sharing |
| Email address | Until deletion is requested | Needed to provide the service |
| Event details | 30 days | Deleted together with the invitation |
| Billing data | 4 years | Tax obligation (Spanish General Tax Law) |
| Browsing data | 14 months | Google Analytics |
| Security logs | 90 days | Security and abuse prevention |
8. Data subject rights
Under articles 15 to 22 of the GDPR, you have the right to:
- Access: Know what personal data we are processing.
- Rectification: Request the correction of inaccurate data.
- Erasure ("right to be forgotten"): Request the deletion of your data.
- Restriction of processing: Request that we limit the use of your data.
- Portability: Receive your data in a structured format.
- Objection: Object to processing in certain circumstances.
- Withdrawal of consent: Withdraw the consent given at any time.
How to exercise your rights
- By email: Sending a message to privacidad@funpartyai.com with the subject "GDPR rights request".
- Quick deletion from the website: "Delete my data" button available on the result page.
We will respond within a maximum of one month.
Right to lodge a complaint with the supervisory authority
You can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency): Web: www.aepd.es — C/ Jorge Juan, 6, 28001 Madrid — Tel: +34 901 100 099
9. Security measures
- Encryption in transit: HTTPS (TLS 1.3).
- Encryption at rest: Encrypted database.
- Access control: Authentication and least-privilege principle.
- Automatic deletion: Photos after 24h, invitations after 30 days.
- EU hosting: AWS EU (Frankfurt, Germany).
- Audit logs: Record of access to personal data.
10. Cookies
We use technical and analytics cookies. More information in our Cookie Policy.
11. Amendments
FunPartyAI reserves the right to amend this Privacy Policy. If substantial changes are made that affect the processing of minors' data, we will notify you by email.
12. Contact
For any questions: privacidad@funpartyai.com