Dreammire StudiosA Yumeru Studios Division

Legal

Privacy Policy

1. Data controller

The controller for personal data processed via Dreammire Studios is:

  • Vexoris Holdings OÜ
  • Operating brand: Dreammire Studios, a Yumeru Studios division
  • Registered address: [Registered office address for Vexoris Holdings OÜ — to be confirmed]
  • Privacy contact: privacy@dreammire.yumerustudios.com

2. What we collect

Depending on how you use the site, we may process:

  • Account data: username (public-facing), email, password hash (never stored in plaintext), optional legal first and last name (collected at registration for purchases/billing only — not shown on public pages or to other members), case-file ID, role (member/staff/admin), account active flag, optional staff/admin title, sound preference, and timestamps.
  • Career applications: role applied for, answers to screening questions, optional portfolio URL, optional skills-exercise response, application status, optional interview time, and submission date. Linked to your account while the account exists.
  • Discord (optional): if you connect Discord, we store Discord user id, display username, avatar URL, and link time — used for identity linking on your account, not for Discord bot/role sync.
  • Sessions: a random session token (httpOnly cookie dm_session), approximate user-agent string, created/last-seen/expiry times.
  • Contact form: name, email, and message you submit.
  • Operational logs: server-side security/block events may record reason, IP, and time (not full form bodies or passwords). Admin/staff action audit entries record who changed another person's records.

We do not currently run third-party advertising or analytics cookies on this site.

3. Legal bases (provisional)

The following categorization is a product-aligned draft and must be confirmed by counsel:

  • Account creation, login, session management, and settings — performance of a contract / steps prior to a contract (providing the member area you request).
  • Career applications — steps prior to a possible contract and/or legitimate interest in evaluating candidates (or consent, if counsel prefers that framing for applications).
  • Contact messages — legitimate interest in responding to inquiries, or consent via voluntary submission.
  • Security rate-limits, bot checks, and audit logs — legitimate interest in protecting the service and users.
  • Transactional email (verification codes, account notices) — contract / service delivery.

4. 4. Third-party processors

We use a small number of trusted service providers to run the site. Each only processes the data needed for their specific role, and none of them use your data for their own purposes:

  • Hosting provider — runs and delivers the application.
  • Database provider — stores account data, sessions, applications, and contact submissions.
  • Cloud storage/CDN provider — hosts game and studio media assets (not used as a general user-upload vault in the current product).
  • Email service provider — sends transactional email from our configured addresses.
  • Authentication provider — handles optional account linking via OAuth (identify-level access only).

5. Retention

What the product does today:

  • Sessions: expire after about 30 days; you can revoke them earlier in Settings. Expired or revoked session rows are removed or become unusable.
  • Account deletion: deletes your user row and sessions. Career applications you submitted are anonymized (detached from your user id) and retained for hiring history — they are no longer tied to your account identity in the database.
  • Login / email codes: short-lived, hashed, and consumed or invalidated after use or expiry.

Open decision — retention schedule: We have not yet fixed published maximum retention periods for (a) active accounts, (b) anonymized application archives, (c) contact form messages, or (d) security/audit logs. Until counsel and operations set those periods, data is kept as long as needed for the purposes above and product operation. This section will be updated when those decisions are made.

6. Your rights

Subject to applicable law (including GDPR where it applies), you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability.

  • Access / portability: signed-in users can download a JSON export of their account data from Settings → Danger zone (“Download my data”).
  • Rectification: update username, email, password, Discord link, and preferences in Profile / Settings.
  • Erasure: delete your account in Settings → Danger zone (applications anonymized as described above).
  • Other requests (objection, restriction, complaints): email privacy@dreammire.yumerustudios.com. You may also lodge a complaint with a supervisory authority.

7. Cookies

We use a single essential session cookie named dm_session: httpOnly, SameSite=Lax, Secure in production. It holds a random session identifier so we can keep you signed in. We do not set advertising or analytics cookies. Preferential ambient/sound mute for guests may use in-browser memory only; signed-in sound preference is stored on the account — not as a cookie.

A cookie preference banner and preference center are available for transparency and for future optional categories. Strictly necessary session cookies do not require consent under typical GDPR/ePrivacy readings, but confirm with counsel. Full detail: Cookie policy.

8. Children

Open decision — age policy: The careers and account features are aimed at collaborators and applicants, not children. A specific minimum age (e.g. 16 or 18) has not been finalized in product policy. Until then: the service is not directed at children, and we do not knowingly collect data from children for accounts. Counsel should define the binding age rule before production hiring/account use.

9. Open decisions checklist

  • Registered office address for Vexoris Holdings OÜ (currently placeholder).
  • Precise retention periods for accounts, applications, contact messages, and logs beyond what the product already implements (see Retention).
  • Whether career applicants / account holders must be 18+, and the exact age restriction for the service.
  • Final legal bases (contract vs legitimate interest vs consent) for each processing purpose — provisional wording below needs lawyer review.

Privacy·Cookies·Terms·Impressum