Privacy Policy — House of Wonder

This Privacy Policy explains how HOW ARRIS GRAND, LLC ("House of Wonder", "we", "us", or "our"), located at 988 Fulton Street, Brooklyn, NY 11238, collects, uses, and protects your information when you use our website, our mobile app, and our family portal (together, the "Services"). This Policy describes our information practices and your choices.

1. Information We Collect

Account information. When you create an account or log in, we collect your name, email address, phone number, and sign-in credentials. Registration also offers a ZIP code field and asks you to set a check-in PIN. We associate this information with your family account identifier.

Family and child information. To provide our play cafe services, we collect information you choose to give us about your family, which may include your child's first name, date of birth, and an optional profile photo where that feature is offered. This information is provided by a parent or guardian.

Visits, bookings, and membership. We keep records of your check-ins, booking dates and times, selected children, accompanying adult and child counts, booking notes, event registrations, cancellations, and membership status so we can provide the Services.

Payment information. Membership and other payments are processed by our payment provider, Stripe. Payment card details are entered directly with Stripe and are not collected or stored by us. We receive limited information such as whether a payment succeeded and your subscription status.

Registration and preferences. We keep waiver acceptance records and communication preferences you provide during registration. If you opt in to marketing emails, we use your contact details to send them; you can unsubscribe using the link in those emails.

Technical information. Our app uses secure device storage for your sign-in session. Registration pages use browser storage to preserve progress. Online requests include network information such as an IP address, which hosting providers may process to deliver and protect the Services.

Support communications. If you contact us, we keep your messages and contact details so we can respond.

2. How We Use Information

To provide and operate the Services, including logins, bookings, check-ins, events, and membership.
To show live space availability and manage capacity at the cafe.
To process membership payments through Stripe.
To communicate with you about your account, visits, and events, and to send marketing communications when you opt in.
To keep the Services safe and secure and to comply with our legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising or cross-app tracking.

3. Children's Information

Our Services are intended for parents and guardians, not for use by children. Any information about a child is provided by a parent or guardian and is used only to provide our in-person play cafe services (for example, check-in and age-appropriate events). We do not knowingly allow children to create accounts or provide their own information. If you believe a child has provided us information directly, please contact us and we will delete it.

4. How We Share Information

We share information only as needed to run the Services:

Service providers. We use trusted providers to operate the Services, including Supabase for account, child, visit, and booking data; Stripe for payment processing; GiftUp for gift cards; Twilio for text messages; Brevo for opted-in marketing contact details and membership status; and providers that deliver our account and service emails. They may access information only to perform services for us.
Legal reasons. We may disclose information if required by law or to protect the rights, safety, and property of our members, staff, or the public.

5. Data Retention

We keep your information while your account is active and as needed to provide the Services and meet applicable legal, accounting, dispute-resolution, and security obligations.

When your account deletion request is accepted, your account closes immediately. It is kept for 30 days so staff can restore it if the request was a mistake. After that period, a scheduled process permanently removes the family account, children's records, plans, visits, bookings, invoices held in our system, sessions, and saved payment link from our database. Stripe retains its own records of past payments and invoices for accounting and tax purposes.

Children's uploaded photos are also permanently removed from our storage when the account is permanently deleted after the 30-day recovery period. We do not retain those photos after permanent deletion.

Our database is backed up daily, and the seven most recent daily backups are retained. After account data is removed from the active database, copies may remain in these backups for up to seven additional days until the backups expire. Uploaded files, such as photos, are not included in these database backups.

6. Your Choices and Rights

Account deletion. In the mobile app, go to Me > Account settings > Delete account and re-enter your password. Any unpaid invoices must be settled first. When the request is accepted, active memberships and upcoming visits and event registrations are cancelled, you are signed out on all devices, and a confirmation email is sent. You can also contact us for help with deletion.

During the 30-day recovery period, you can ask staff to restore an account deleted by mistake. Restoring an account does not restart cancelled memberships or bookings. Signing out alone does not delete your account.

Access and updates. You can review and update your account information through the app or portal, or by contacting us.

Depending on where you live, you may have additional rights over your personal information. To exercise any of these, contact us using the details below.

7. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections and secure credential storage. No system is perfectly secure, but we work to protect your data and to address issues promptly.

8. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the effective date above and, where appropriate, notify you.

9. Contact Us

If you have questions about this Policy or your information, contact us at hi@houseofwonder.co or by mail at HOW ARRIS GRAND, LLC, 988 Fulton Street, Brooklyn, NY 11238.