PRIVACY POLICY

Effective Date: May 29, 2026

Woander World LLC and its wholly-owned subsidiary Wylding Woods LLC ("Woander World," "we," "our," or "us") operate wyldingwoods.com and the Lexi Magic Mirror experience at mirror.wyldingwoods.com. This Privacy Policy explains how we collect, use, and protect your information across both services.

If you are a parent or guardian whose child is using the Lexi Magic Mirror experience, please read Section 4 carefully. The Lexi experience is a child-directed service fully subject to the Children's Online Privacy Protection Act (COPPA), with its own data practices described in detail below.

---

1. TWO SERVICES, TWO DATA ENVIRONMENTS

wyldingwoods.com is our public marketing website, hosted by Squarespace. It is not directed at children and is used for show information, ticket sales, newsletter sign-ups, and general inquiries.

mirror.wyldingwoods.com is the Lexi Magic Mirror experience — a child-directed, AI-powered interactive storytelling service presented at live Wylding Woods events. It operates on separate infrastructure from our marketing website and requires verified parental consent before any child's personal information is collected.

---

2. INFORMATION WE COLLECT

From all users of wyldingwoods.com

  • Newsletter sign-ups: name and email address (with your consent)

  • Show tickets: handled by our ticketing provider, TicketSpice

  • Website usage data: collected through Google Analytics and Meta Pixel (see Section 5)

  • Contact form submissions: information submitted through JotForm-powered contact forms

From parents and guardians of the Lexi Magic Mirror experience

  • First and last name

  • Email address (verified)

  • Digital consent signature

  • Marketing opt-in preference (optional)

  • A parent/guardian account is created in our system upon form completion (email and name only)

From children under 13 — only with verified parental consent

No personal information is collected from a child under 13 until a parent or guardian has completed our consent process and provided a verified digital signature.

  • Child's name or chosen story name (used to personalize the experience and post-session story email)

  • Favorite color, animal, and activity (used to generate a personalized story)

  • Voice input during conversation with Lexi (processed in real time by Groq, Inc.; voice recordings are not retained after processing)

  • Conversation and session data (used to generate the story summary and illustration)

  • Generated story summary and AI illustration (stored and sent to the parent via email after the session)

---

3. HOW WE USE YOUR INFORMATION

We use information we collect to:

  • Process event registrations and ticket sales

  • Obtain and record parental consent

  • Create a parent/guardian account associated with the experience

  • Operate and personalize the Lexi Magic Mirror experience

  • Generate and deliver a post-session story summary and AI illustration to the parent or guardian

  • Send newsletters and updates (only if you opt in)

  • Provide customer support

  • Comply with legal obligations

  • We do not sell your personal information to third parties.

---

4. CHILDREN'S PRIVACY (COPPA)

We take children's privacy seriously. Here is exactly what we collect from children, how it is used, and how you stay in control as a parent.

Who operates this service

The Lexi Magic Mirror experience is operated by Woander World LLC and its wholly-owned subsidiary Wylding Woods LLC, 73 Throckmorton Ave, Mill Valley, CA 94941 | privacy@woanderworld.com | 628-257-6621.

How we obtain parental consent

The Lexi experience is presented at live Wylding Woods events. Parents and guardians complete our intake form on their own device before their child begins the experience. The consent process works as follows:

  1. We confirm you are 13 or older

  2. We collect your name and email address only — no child information is collected at this stage

  3. We verify your email address with a confirmation code

  4. We present a summary of what data we intend to collect from your child, how it will be used, and which service providers may process it

  5. You provide a digital signature confirming consent

  6. Only after your consent is recorded does the child's information get collected

You will receive a confirmation email immediately after submitting the form. This email summarizes what you consented to, what data was collected, which service providers may process it, and how to revoke consent or request deletion.

You have the right to consent to our collection and use of your child's personal information without consenting to disclosure of that information to third parties, except where such disclosure is integral to providing the service. Contact privacy@woanderworld.com before completing the form if you would like to discuss this.

We will not condition your child's participation on the disclosure of more personal information than is reasonably necessary to participate in the experience.

What personal information we collect from children

  • Child's name or chosen story name (used to personalize the experience and story email)

  • Favorite color, animal, and activity (used to generate a personalized story)

  • Voice input during conversation (processed in real time by Groq, Inc. using the Whisper model; voice recordings are not retained after processing)

  • Conversation and session data (used to generate story summary and illustration)

  • Generated story summary and AI illustration (stored and sent to parent via email after the session)

Voice data

When your child speaks to Lexi, their voice input is processed in real time by Groq, Inc. (using the Whisper speech-to-text model) to enable conversation. Voice recordings are not retained after processing. Lexi's voice responses are generated by ElevenLabs, Inc. Voice data is classified as a biometric identifier under current COPPA rules and is treated with heightened care.

Post-session story email

After your child's session, we generate a story summary and AI illustration from the session content and send it to the parent or guardian email address provided during consent. This email is sent to all parents by default and includes your child's name and story summary. Your child's story content and conversation data are stored securely and will be deleted upon request. To opt out of story emails or request deletion, contact privacy@woanderworld.com.

5. THIRD-PARTY SERVICES (wyldingwoods.com only)

The following providers may receive your child's personal information solely to perform services for us. They are not permitted to use children's data for their own independent purposes.

Provider | Role | Contact

  • JotForm, Inc. | Intake form and consent collection | 4 Embarcadero Center, Suite 780, San Francisco, CA 94111 | contact@jotform.com

  • Groq, Inc. | Voice-to-text processing of child voice input (Whisper model); recordings not retained | P.O. Box 1778, Mountain View, CA 94042 | privacy@groq.com

  • Anthropic, Inc. | AI conversation powering Lexi's responses | 1460 Mission St, San Francisco, CA 94103 | support@anthropic.com

  • OpenAI, L.L.C. | AI illustration generation from story content | 3180 18th St, San Francisco, CA 94110 | privacy@openai.com

  • ElevenLabs, Inc. | Lexi's voice output (text-to-speech) | 169 Madison Ave #2484, New York, NY | team@elevenlabs.io

  • Supabase | Parent/guardian account storage (email and name only; no child data) | 970 Toa Payoh North, #07-04, Singapore 318992 | support@supabase.io

  • Resend | Post-session story email delivery to parent | support@resend.com

  • Fly.io | Secure application hosting (US) | support@fly.io

The Lexi Magic Mirror experience does not use third-party analytics or advertising trackers. No persistent identifiers are set on devices during the Lexi experience.

Parental rights

At any time, you may:

  • Review the personal information and story content we have collected from your child

  • Correct any inaccurate information

  • Delete your child's information and story content

  • Revoke consent and stop further collection or use of your child's information

  • Opt out of story emails at any time

To exercise any of these rights, contact us at privacy@woanderworld.com. Deletion requests will be fulfilled within 30 days.

Our information security program

Woander World maintains a written information security program covering the Lexi experience. Our service providers use encrypted connections, encryption at rest, access controls, and maintain compliance programs such as SOC 2. At the application level, we control who has access to production systems and children's data, minimize what personal data is transmitted to AI providers, secure our intake and webhook flows, and maintain defined deletion practices for children's data. We are finalizing a written retention schedule for each category of data we collect.

---

5. THIRD-PARTY SERVICES
(wyldingwoods.com only)

The following providers operate on our public marketing website only. These providers do not receive data from the Lexi Magic Mirror experience.

  • Squarespace — website hosting and infrastructure. Squarespace may collect standard web data from visitors to wyldingwoods.com on its own behalf. It does not receive Lexi experience data.

  • Google Analytics — site analytics on wyldingwoods.com only

  • Meta Pixel — advertising on wyldingwoods.com only

  • TicketSpice — ticket sales for Wylding Woods shows

  • JotForm, Inc. — contact and inquiry forms on wyldingwoods.com

---

6. DATA RETENTION

We retain personal information only as long as reasonably necessary to fulfill the purpose for which it was collected.

  • Newsletter data: retained until you unsubscribe

  • Ticket purchase data: retained as required by TicketSpice's policies

  • Parent/guardian account data: retained for the duration of the account

  • Child story content and conversation data: stored securely and deleted upon verified parental request within 30 days. We are implementing automated deletion and will update this policy when a defined retention window is in place.

  • Voice recordings: not retained after real-time processing

  • Consent records: retained as required by law

  • Deletion requests: fulfilled within 30 days of verified parental request

---

7. DATA SECURITY

We implement reasonable technical and organizational measures to protect personal information from unauthorized access, disclosure, or loss. Our service providers maintain standard security controls including encryption in transit, encryption at rest, and access controls. We maintain a written information security program governing access to production systems, data minimization practices, and retention and deletion procedures. No method of transmission over the internet is 100% secure.

---

8. YOUR RIGHTS

You may request to access, correct, or delete your personal information at any time by contacting us at privacy@woanderworld.com. Deletion requests will be fulfilled within 30 days.

California Residents (CCPA): You have the right to know what personal information we collect and how it is used, request deletion of your personal information, and opt out of the sale of your personal information. We do not sell your personal information.

---

9. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised Effective Date. For material changes affecting the Lexi experience, we will notify parents by email.

---

10. CONTACT US

Woander World LLC and its wholly-owned subsidiary Wylding Woods LLC

73 Throckmorton Ave, Mill Valley, CA 94941

privacy@woanderworld.com

628-257-6621