Privacy Policy

1. Controller and contact

The company above, represented by Dave Ardito, is responsible for the processing described here. This notice covers the Darukai website and its account features. When you visit external platforms, their own privacy notices also apply.

2. Website access and hosting

We use Cloudflare for hosting, content delivery, database services and protection against attacks. Accessing the website involves processing technical information, including your IP address, requested address, time, and browser, device and connection information. This supports delivery, troubleshooting and security.

The legal basis is Article 6(1)(f) GDPR: our legitimate interests in reliable operation and preventing abuse. Article 6(1)(b) GDPR also applies where processing is necessary to perform a contract with you. The provider is Cloudflare, Inc., USA. See Cloudflare’s Privacy Policy.

3. Registration, sign-in and security

Registration involves your username, display name, email address, password hash, email-verification and account-creation times, and a record of your agreement to the terms. Your password is not stored as plain text in our account database. Sign-in and account recovery involve session identifiers, temporary verification data and security-event information. We limit requests to prevent abuse, using, among other things, verification values derived from IP or email addresses.

If you register a passkey, we store its public key and technical credential information. Biometric data such as your fingerprint is not sent to us.

The legal bases are Article 6(1)(b) GDPR for your requested account and Article 6(1)(f) GDPR for abuse prevention. We cannot create an account without the required registration details. A free account does not require payment.

4. Profile and saved activity

We process your chosen avatar, profile preferences and account features you use. These may include your watchlist, playlists you create, saved video identifiers, playback positions, language and playback preferences. We use this information to provide those features and restore your choices on later visits, under Article 6(1)(b) GDPR.

Account administration and security

The studio owner can view account registration, email verification, membership and team-access records to operate the requested service (Article 6(1)(b) GDPR), and limited sign-in and security events to prevent and investigate misuse (Article 6(1)(f) GDPR). These records are processed automatically for those purposes, without a separate activity-sharing preference. Administration is restricted to the designated owner account.

The account-event log contains the account identifier, event type, event time and, where relevant, a team-access record identifier. It does not record a personal page-by-page browsing or video-viewing history. Playback positions, watchlists and other requested account features are described separately above. Passwords, verification codes, payment-card details, IP addresses and device fingerprints are not included in this administration log.

The owner dashboard shows a rolling 30-day event window. Older detail events are deleted when an event is recorded or the log is opened; if the site is inactive, cleanup takes place on the next such operation. Any records from the discontinued optional browsing-analytics feature are removed during the same cleanup. Account deletion also removes these detail events. Hosting backup retention is controlled separately by the provider; a restored database must be cleaned and current deletions reapplied before it is used. The rights described below continue to apply.

5. Account emails and optional updates

We send verification and security emails through Resend (Plus Five Five, Inc.), USA. This involves the recipient address, message contents and technical delivery information. Our configured sending region is Ireland. Resend states that stored data may nevertheless be processed in the USA. Necessary account emails are processed under Article 6(1)(b) GDPR; Article 6(1)(f) GDPR also applies to security measures. See Resend’s Privacy Policy and its security and privacy information.

Consent to optional email updates is separate from registration and is recorded with its time. The legal basis for advertising relying on that consent is Article 6(1)(a) GDPR. You may withdraw it at any time for the future by emailing [email protected]. Necessary account and security messages are independent of marketing consent.

6. Cookies and device storage

Darukai uses necessary cookies for sign-in and associated security functions that you request. The session cookie __Host-darukai-member lasts up to 30 days; __Host-darukai-flow lasts up to 5 minutes for an authentication flow; and __Host-darukai-email lasts up to 10 minutes for email verification. They may end earlier, for example on sign-out or expiry of the relevant flow.

Where necessary for a feature you expressly request, playback preferences and local choices may also be saved in browser storage. The basis for necessary device access is Section 25(2), point 2, TDDDG. Further personal-data processing is based on Article 6(1)(b) or (f) GDPR for the requested service or its security. Blocking necessary cookies may prevent sign-in and account features from working.

External video providers may use their own cookies or similar technologies. The following section gives additional information. The rules for our necessary sign-in cookies do not replace any consent required for external services.

7. YouTube and external content

The website embeds YouTube videos and links to external platforms. Loading an embedded YouTube player may send your IP address, device and browser information, the page visited and interactions to Google. Depending on the page, the player may load when the page is opened. Google may associate this activity with a Google account, particularly if you are signed in.

For users in the European Economic Area, the provider is Google Ireland Limited, Ireland. Further processing by Google companies outside the EEA may occur. See Google’s Privacy Policy. For integrations and device access requiring consent, the applicable basis is Article 6(1)(a) GDPR together with Section 25(1) TDDDG. Agreement to our account terms is not consent to Google’s advertising or tracking activities.

Social-media links take you to external websites. Following a link allows the relevant platform to process data according to its own privacy notice.

8. Separate payments

If you order a paid offer, order, payment and subscription information needed to fulfil that contract is processed. Where Stripe is used at checkout, Stripe directly receives the payment details entered there. Darukai processes associated customer and transaction identifiers, payment status and contract periods; full card details are not stored in our membership database.

The legal bases are Article 6(1)(b) GDPR for fulfilment, point (c) for legal retention duties and point (f) for fraud prevention. The Stripe entity identified at checkout acts as a processor or an independent controller depending on its activity. See Stripe’s Privacy Policy. Free registration does not send payment information to Stripe.

9. Contact requests

When you contact us, we process your contact information, message and any attachments you choose to send to handle your request. The basis is Article 6(1)(b) GDPR for contract-related requests, or Article 6(1)(f) GDPR for our legitimate interest in responding to other enquiries. Please send only information needed for your request.

10. Recipients and international processing

Data is made available to providers needed for the relevant purpose, particularly Cloudflare for operation, Resend for email and, where used, providers identified in the payment or video flow. Disclosure to authorities or professional advisers may be required by law or necessary to establish, exercise or defend legal claims.

Providers outside the EEA may operate under different data-protection standards. Their published safeguards include adequacy decisions where applicable and EU Standard Contractual Clauses. You can request information about the safeguards used for a specific transfer at [email protected]. See also the Cloudflare Data Processing Addendum and Resend’s information.

11. Retention

Account information is processed for as long as it is needed to provide your account. Verification codes are valid for 10 minutes. Expired verification and session records are removed when those flows are cleaned up. Watchlists, playlists and profile preferences remain stored while needed for the requested account feature or until their deletion is arranged.

Retention of support messages depends on handling the request and any subsequent need for evidence. Legal retention duties, outstanding contractual claims and necessary security records may prevent immediate complete deletion. In that case, processing is restricted to those purposes. External providers also apply their own retention rules. You can request deletion or details of the retention period relevant to your data.

12. Your rights

Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent for future processing at any time without affecting the lawfulness of earlier processing.

You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to processing for direct marketing at any time.

Contact [email protected] to exercise these rights. You may also complain to a data-protection authority, particularly in the member state of your habitual residence, workplace or the suspected infringement. The account features described here do not involve solely automated decisions producing legal or similarly significant effects under Article 22 GDPR.