Privacy Policy

Stormlight Kids LLC dba Candeeland Kids Downey | Effective Date: September 16, 2026

This Privacy Policy describes how Stormlight Kids LLC, doing business as Candeeland Kids Downey (“Candeeland Kids Downey,” “Candeeland,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit our website at www.candeelanddowney.com (also reachable at downey.candeeland.com) (the “Site”), book tickets, passes, or parties, visit our indoor playground located at 462 Stonewood St, Unit G33A, Downey, CA 90241 (the “Venue”), or enroll in our text messaging program (collectively, the “Services”). It also explains the privacy rights available to you, including rights under California law.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

1. Who We Are

The business responsible for your personal information under this Privacy Policy is:

Legal entity: Stormlight Kids LLC, a California limited liability company
Doing business as: Candeeland Kids Downey
Venue address: 462 Stonewood St, Unit G33A, Downey, CA 90241
Privacy contact: candeelanddowney@gmail.com | (562) 966-0700

References to “Candeeland Kids Downey” in this Privacy Policy include Stormlight Kids LLC. Stormlight Kids LLC is the registered brand for our text messaging program.

2. Information We Collect

We collect personal information in three ways: information you provide to us directly, information collected automatically when you use the Site, and information we receive from our service providers and business partners. The categories below track the categories defined in the California Consumer Privacy Act (“CCPA”).

2.1 Information You Provide Directly

Identifiers and contact information — your name, email address, mailing address, and telephone number when you book tickets or passes, reserve a birthday party or private event, sign a participation waiver, join our text messaging program, subscribe to our email list, enter a promotion, or contact us.
Commercial and transaction information — records of tickets, passes, memberships, parties, add-ons, and merchandise you purchase; booking dates and times; party guest counts and preferences; and your purchase history with us.
Payment information — payment card details are collected and processed by our PCI-compliant payment processors. We receive confirmation of payment, the last four digits of the card, card type, and billing name and ZIP code; we do not store full payment card numbers on our systems.
Information about your children and guests — when you book, sign a waiver, or check in, we collect the first and last name and age or date of birth of each child in your party and the name of the responsible adult. Where you choose to provide it, we may also collect emergency contact information and any information you voluntarily share to help us keep your child safe at the Venue (for example, an allergy note for a party cake). We treat this information as sensitive and use it only to operate the Venue safely.
Waiver and check-in records — the participation waiver and release you sign on behalf of yourself and your minor children, including the date, time, and method of signature.
Communications — the content of emails, text messages, web form submissions, chat conversations (including conversations with our automated booking assistant), reviews, and survey responses you send to us.
Photos and videos you share — images you submit to us, tag us in, or authorize us to use, for example party photos you share on social media using our hashtags.

2.2 Information Collected Automatically

Device and usage information — IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, links clicked, time spent on pages, and the dates and times of your visits.
Approximate location — general location inferred from your IP address (city or region level). We do not collect precise geolocation from your device.
Cookies and similar technologies — as described in Section 8 below.

2.3 Information Collected at the Venue

Video surveillance — for the safety and security of children, families, and staff, the Venue is monitored by closed-circuit video cameras in common areas. Recordings are retained for a limited period and reviewed only for safety, security, incident investigation, and loss-prevention purposes.
Photography at events — with the permission of the hosting parent or guardian, our staff may take photographs at birthday parties and events for delivery to the host. We will not use images of your child in our marketing without your separate written consent.
Incident and first-aid records — if an injury or incident occurs at the Venue, we record the details necessary to respond appropriately and to meet our legal and insurance obligations.

2.4 Information From Other Sources

Service providers — our booking and point-of-sale platform, payment processors, waiver platform, messaging providers, and email marketing platform return information about your transactions and interactions with our communications (for example, whether an email was opened or a text message was delivered).
Social media platforms — if you interact with our pages or content on platforms such as Instagram, Facebook, TikTok, or Google, we may receive information consistent with your settings on those platforms.
Advertising and analytics partners — companies such as Meta and Google provide us with aggregated campaign performance data and, through cookies and pixels on the Site, collect identifiers and internet activity as described in Sections 6.2 and 8.

Candeeland Kids Downey is independently owned and operated by Stormlight Kids LLC. Other Candeeland locations are separately owned and operated and are not covered by this Privacy Policy; we do not exchange guest data with other Candeeland locations except where you ask us to (for example, to transfer a booking).

3. How We Use Your Information

We use personal information for the following business and commercial purposes:

Providing the Services — processing bookings, reservations, passes, and purchases; delivering confirmations and receipts; checking in guests; hosting parties and events; and providing customer support.
Safety and security — verifying that a responsible adult accompanies each child, administering waivers, responding to injuries or incidents, monitoring the Venue, and protecting children, guests, staff, and property.
Communicating with you — sending transactional and service communications (booking confirmations, reminders, waiver links, schedule or closure notices, and responses to your inquiries) by email, text message, or telephone.
Marketing — with your consent where required, sending promotional emails and text messages about events, offers, new attractions, and news from Candeeland Kids Downey; you may opt out at any time as described in Sections 5 and 9.
Improving the Services — analyzing how the Site and Venue are used, testing new features, understanding guest preferences, and improving our attractions, programming, and customer experience.
Legal, compliance, and protection — complying with applicable law, responding to lawful requests, enforcing our Terms & Conditions and waivers, managing insurance claims, and detecting and preventing fraud, abuse, or unsafe conduct.
Business operations — internal reporting, accounting, auditing, and in connection with a financing, merger, acquisition, or sale of all or part of our business, subject to Section 6.

We do not use personal information for purposes that are incompatible with the purposes described above without first notifying you and, where required, obtaining your consent. We do not use automated decision-making that produces legal or similarly significant effects about you.

4. Children’s Privacy

Candeeland Kids Downey is a family venue, but our Site and text messaging program are directed to parents, guardians, and adults age 18 and older. We do not knowingly collect personal information online directly from children under 13, and children under 13 are not permitted to create accounts, submit web forms, or enroll in our text messaging program. If you believe a child under 13 has provided personal information to us online, please contact us at candeelanddowney@gmail.com and we will delete it promptly.

Information about children that we do collect (such as a child’s name and age on a booking or waiver) is provided to us by a parent or legal guardian and is used only to operate the Venue safely, administer bookings and parties, and comply with our legal obligations. We do not use children’s information for marketing, do not sell or share it, and do not disclose it to third parties other than the service providers necessary to deliver the Services. Parents and guardians may review, correct, or request deletion of their child’s information by contacting us using the details in Section 13.

5. Text Messaging (SMS/MMS) Program Privacy

This section applies to the Candeeland Kids Downey text messaging program (the “Messaging Program”), operated by Stormlight Kids LLC dba Candeeland Kids Downey. The full terms governing the Messaging Program are set out in our Terms & Conditions at downey.candeeland.com/terms.

5.1 What We Collect When You Opt In

When you opt in to the Messaging Program by texting a keyword to our number, checking an opt-in box on a web form, or providing your mobile number to us in person, we collect your mobile telephone number, the date, time, and method of your opt-in, the keyword or form used, your IP address (for web opt-ins), and a record of your consent. We also collect the content of the messages you send us, delivery and engagement data (for example, whether a message was delivered or a link was clicked), and your opt-out status.

5.2 How We Use Messaging Data

We use your mobile number and related opt-in data solely to (a) deliver the messages you have consented to receive, such as booking confirmations, reminders, waiver links, party and event updates, and, if you have opted in to marketing messages, promotions and news from Candeeland Kids Downey; (b) respond to your inquiries; (c) maintain records of your consent and opt-out preferences as required by law and industry guidelines; and (d) comply with legal obligations.

5.3 No Sharing of Mobile Information for Marketing

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

Your mobile telephone number, your consent to receive text messages, and any other information collected in connection with the Messaging Program will not be shared with, sold to, rented to, or otherwise disclosed to any third party or affiliate for their own marketing or promotional purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

5.4 Messaging Service Providers

We use third-party messaging platforms and telecommunications providers (for example, Twilio) to transmit text messages on our behalf. These providers act as our service providers, are permitted to use your mobile number only to deliver our messages and provide related support, and are contractually prohibited from using it for their own purposes.

5.5 Device Verification and Fraud Prevention

When you opt in, you authorize your wireless carrier, Candeeland Kids Downey, and our messaging service providers to use and disclose information about your account and wireless device, where available, to identify you and your device, to confirm that the number you provided is yours, and to detect and prevent fraud. We may send a one-time passcode or confirmation message for this purpose. We may treat you as a resident of the state associated with the area code of your mobile number for legal-compliance and time-zone purposes unless you notify us otherwise in writing.

5.6 Do-Not-Call Records

We maintain an internal Do-Not-Call list of numbers that have opted out. Our Do-Not-Call Policy is published as Appendix A to our Terms & Conditions.

5.7 Opting Out

You may opt out of the Messaging Program at any time by replying STOP to any message from us. For help, reply HELP or contact us at (562) 966-0700 or candeelanddowney@gmail.com. After you opt out, we retain your mobile number on an internal do-not-contact list solely to ensure that we honor your opt-out.

6. How We Disclose Personal Information

We disclose personal information to the following categories of recipients for the business purposes described in Section 3:

Service providers — companies that perform services on our behalf and are contractually restricted from using your information for any other purpose, including: booking, ticketing, and point-of-sale platforms; payment processors; electronic waiver platforms; text messaging and telecommunications providers; email marketing platforms; website hosting, analytics, and security providers; customer support and automated booking assistant providers; and professional advisors such as accountants, insurers, and attorneys.
Affiliates — entities under common ownership or control with Stormlight Kids LLC, for internal administrative, accounting, and business-continuity purposes consistent with this Privacy Policy. Affiliates do not receive Messaging Program opt-in data for marketing purposes.
Advertising partners — as described in Section 6.2, advertising platforms that place cookies or pixels on the Site. These partners receive identifiers and internet activity information only; they never receive Messaging Program opt-in data, children’s information, or waiver information.
Legal and safety — law enforcement, regulators, courts, or other parties when we believe in good faith that disclosure is required by law, subpoena, or legal process; is necessary to protect the safety of children, guests, staff, or the public; or is necessary to investigate or prevent fraud, abuse, or violations of our Terms & Conditions.
Insurance and claims — our insurers, claims administrators, and legal counsel in connection with an incident, injury, or claim at the Venue.
Business transfers — a successor or acquirer in connection with a financing, merger, acquisition, reorganization, sale of assets, or similar transaction, or in the event of bankruptcy, provided that the recipient agrees to honor this Privacy Policy with respect to previously collected information.
With your consent — any other party when you direct us to share your information or otherwise consent to the disclosure.

6.1 No Sale of Personal Information

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age.

6.2 Sharing for Cross-Context Behavioral Advertising

We allow advertising partners, including Meta (Facebook and Instagram) and Google, to place cookies, pixels, and similar tags on the Site that collect identifiers (such as cookie IDs, device identifiers, and hashed email addresses) and internet activity information (such as pages viewed and bookings started or completed) in order to deliver and measure advertising for Candeeland Kids Downey on other websites and platforms. Under California law this may constitute “sharing” of personal information for cross-context behavioral advertising. You may opt out at any time by clicking the “Do Not Sell or Share My Personal Information” link in the footer of the Site, by adjusting your cookie preferences, or by enabling a Global Privacy Control signal in your browser. Messaging Program opt-in data, mobile telephone numbers, children’s information, and waiver information are never used for this purpose, and we do not knowingly share the personal information of consumers under 16.

7. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including to satisfy legal, accounting, insurance, and reporting requirements, and to resolve disputes and enforce our agreements. As general guidelines:

Booking, transaction, and accounting records are retained for seven (7) years to meet tax and financial record-keeping requirements.
Signed participation waivers are retained for at least three (3) years after the last visit of the participant, or longer where a minor participant’s claim could be brought after reaching the age of majority, consistent with California statutes of limitation.
Video surveillance recordings are retained for approximately thirty (30) days unless preserved for an incident, claim, or legal hold.
Messaging Program opt-in and opt-out records are retained for at least five (5) years after opt-out, consistent with the Telephone Consumer Protection Act (TCPA), FCC do-not-call record-keeping rules, and industry best practice.
Marketing email and text preferences are retained until you unsubscribe, after which we retain your contact detail on a suppression list only.
Website analytics and advertising cookie data is retained by us and our analytics providers for no more than twenty-six (26) months; server logs are retained for approximately twelve (12) months.
Incident and first-aid records are retained for the longer of seven (7) years or the period during which a related claim could be brought under California law.
Customer support communications are retained for approximately three (3) years after the inquiry is resolved.

8. Cookies, Analytics, and Tracking Technologies

The Site uses cookies, pixels, local storage, and similar technologies to operate the Site, remember your preferences, understand how the Site is used, and, where enabled, measure the effectiveness of our advertising.

Strictly necessary — required for the Site to function, including our booking and checkout flow and security features. These cannot be disabled.
Functional — remember your choices, such as your preferred location or language.
Analytics — help us understand Site traffic and usage (for example, Google Analytics). Learn how Google uses data at policies.google.com/technologies/partner-sites.
Advertising — set by advertising partners such as Meta (Meta Pixel) and Google (Google Ads and Google Tag) to deliver and measure ads for Candeeland Kids Downey on other sites and platforms and to build audiences of people similar to our guests. You can opt out of these cookies through our cookie preference tool, the “Do Not Sell or Share My Personal Information” link, a Global Privacy Control signal, or the platforms’ own controls at facebook.com/ads/preferences and adssettings.google.com.

You can control cookies through your browser settings and, where we display one, through our cookie preference banner. Disabling certain cookies may affect Site functionality.

8.1 Global Privacy Control and Do Not Track

We honor Global Privacy Control (“GPC”) browser signals as a valid request to opt out of the sale or sharing of personal information for the browser or device that sends the signal. Because there is not yet a common industry standard for “Do Not Track” (“DNT”) signals, the Site does not currently respond to DNT signals; we will update this Privacy Policy if that changes. This disclosure is provided in accordance with the California Online Privacy Protection Act.

9. Your Choices

Marketing emails — click the “unsubscribe” link at the bottom of any marketing email or contact us. You will continue to receive transactional emails (such as booking confirmations) even after unsubscribing from marketing.
Text messages — reply STOP to any text message to opt out; reply HELP for assistance. See Section 5 and our Terms & Conditions.
Cookies and advertising — use our cookie preference tool, the “Do Not Sell or Share My Personal Information” link in the Site footer, a Global Privacy Control signal, or your browser settings, as described in Sections 6.2 and 8.
Account and booking information — update or correct your information by contacting us or through your booking confirmation link.

10. Your California Privacy Rights

If you are a California resident, the CCPA, as amended by the California Privacy Rights Act, provides you with the following rights with respect to personal information we collect, subject to certain exceptions:

Right to know — to request that we disclose the categories and specific pieces of personal information we have collected about you; the categories of sources; the business or commercial purposes for collecting, selling, or sharing it; and the categories of third parties to whom we disclose it.
Right to delete — to request that we delete personal information we have collected from you, subject to exceptions (for example, information we must retain to complete a transaction, comply with a legal obligation, or defend legal claims, including signed waivers).
Right to correct — to request that we correct inaccurate personal information we maintain about you.
Right to opt out of sale or sharing — to direct us not to sell or share your personal information. We do not sell personal information; see Section 6.2 regarding sharing for advertising.
Right to limit use of sensitive personal information — where we collect sensitive personal information (for example, precise geolocation or health-related notes), we use it only for the purposes permitted by the CCPA, such as providing the Services and ensuring safety; we do not use or disclose it to infer characteristics about you.
Right to non-discrimination — we will not deny you services, charge you a different price, or provide a different level of service because you exercised any of these rights.

10.1 How to Exercise Your Rights

You may submit a request by emailing candeelanddowney@gmail.com, calling (562) 966-0700. We will verify your identity by matching the information you provide to information we already hold (for example, the name, email, and mobile number on a booking) and may request additional information where necessary. We will respond within 45 days, extendable once by an additional 45 days with notice. You may designate an authorized agent to make a request on your behalf; we may require the agent to provide proof of authorization and may require you to verify your identity directly with us. Parents and guardians may exercise these rights on behalf of their minor children.

10.2 Categories Collected, Disclosed, and Shared (Preceding 12 Months)

In the preceding 12 months we collected the categories of personal information listed in Section 2, from the sources listed in Section 2, for the purposes listed in Section 3, and disclosed them for business purposes to the categories of recipients listed in Section 6. We did not sell any category of personal information. We shared identifiers and internet or other electronic network activity information with advertising partners for cross-context behavioral advertising, as described in Section 6.2; California residents may opt out of that sharing as described in that Section.

10.3 California “Shine the Light”

California Civil Code Section 1798.83 permits California residents to request certain information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

10.4 Applicability

Stormlight Kids LLC is a single-location business that, as of the Effective Date above, does not meet the revenue or data-volume thresholds that make the CCPA mandatory. We nonetheless voluntarily extend the rights described in this Section 10 to all California residents as a matter of policy and will honor requests in the manner described here. If we become subject to the CCPA in the future, we will update this Privacy Policy accordingly. Providing these rights voluntarily does not constitute an admission that the CCPA applies to us.

11. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure, including transport-layer encryption on the Site, use of PCI-DSS compliant payment processors, role-based access to guest data, and staff training. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by California Civil Code Section 1798.82 and other applicable law.

12. Third-Party Sites and Services

The Site may contain links to, or integrate with, third-party websites and services, including our booking platform, social media platforms, and map services. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party service you use.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, please contact us:

Stormlight Kids LLC dba Candeeland Kids Downey
462 Stonewood St, Unit G33A, Downey, CA 90241
Email: candeelanddowney@gmail.com
Phone: (562) 966-0700
Text messaging program support: reply HELP to any message, or email candeelanddowney@gmail.com

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will revise the Effective Date at the top of this page and, for material changes, provide additional notice such as a notice on the Site or an email to the address on file. Your continued use of the Services after the effective date of any update constitutes your acceptance of the revised Privacy Policy. This Privacy Policy is reviewed at least once every 12 months.