Care Bears Jellybean Privacy Policy

1. Scope

Applies to all Care Bears Jellybean digital touchpoints (post-purchase QR unlocks, microsites, open-access content). Global coverage with GDPR and COPPA compliance.

2. Information We Collect (13+ users)

• Contact: email, display name.
• Engagement: unlocks, achievements, analytics events, timestamps, referral channel.
• Purchase data: product codes, proof of purchase, SKU, eligibility details.
• Geolocation: derived from IP/device for localization/legal compliance.
• Device/technical: identifiers, browser/OS, cookie IDs, language, diagnostics.
• User-generated content: uploads, feedback, surveys, support messages.

No intentional sensitive data collection; request deletion if supplied inadvertently.

3. How We Use Data

• Deliver Experience features and personalization.
• Authenticate via Magic Link.
• Measure engagement/performance, debug issues.
• Communicate updates/support.
• Enforce eligibility and comply with laws (GDPR, COPPA, consumer protection, export).
• Prevent fraud/abuse/security threats.
• Produce aggregated/de-identified insights for Jellybean and Care Bears stakeholders.

4. Legal Bases (GDPR)

• Contract necessity (core services).
• Legitimate interests (analytics, security, improvement, limited marketing).
• Consent (optional comms, location-specific personalization).
• Legal compliance obligations.

5. Children's Privacy (COPPA)

• Intended for users 13+.
• No knowing collection from under 13; delete on discovery. Parents can reach out via legal@jellybean.xyz.

6. How We Share Information

• Service providers (hosting, analytics, Magic Link auth, blockchain infrastructure, support, security) under contract.
• Brand partners (Care Bears) receive aggregated/de-identified data only unless legally required/authorized.
• Legal authorities when required.
• Corporate transactions (subject to confidentiality).

No sale of personal information.

7. International Transfers

• Processing may occur in Canada, US, EU, or other jurisdictions.
• Use adequacy decisions, SCCs, or other lawful mechanisms for cross-border transfers.

8. Data Retention

Kept as long as needed for the Experience, legal obligations, dispute resolution, and contract enforcement; de-identified/deleted when no longer needed.

9. Your Rights

• Access, correct, delete, object, restrict processing, portability, consent withdrawal, and marketing opt-out (depending on jurisdiction).
• Contact legal@jellybean.xyz; identity verification may be required.
• Additional rights for California/other regions per local law.

10. Security

• Encryption in transit, access controls, logging, regular assessments.
• Users should still exercise caution online.

11. Cookies/Tracking

Functional and analytics cookies; consent banners/preferences where required. Blocking cookies may impact functionality.

12. Changes to Policy

Updates posted with new "Last updated" date; material updates announced via the Experience or email.

13. Contact

BOP Labs Inc., Attn: Privacy – Care Bears Jellybean, legal@jellybean.xyz, Toronto, ON, Canada. Users may also contact their local data protection authority, though we encourage contacting us first.