Privacy Policy
DRAFT, last updated [DATE]. Not legal advice. Have a US privacy attorney review this before launch, especially the COPPA analysis in section 9.
DearSanta.si ("we", "us") is operated by [LEGAL ENTITY NAME], [STATE] ("DearSanta.si"). We make personalized video messages, letters, and certificates "from Santa." Our website and services are intended for and directed to adults (parents and legal guardians). They are not directed to children, and we do not knowingly collect personal information directly from children.
1. The short version
- A parent or guardian gives us the minimum Santa needs: your email, your child's first name, age, one good deed, one wish, and optionally a sibling's first name.
- We never ask for last names, photos, voice recordings, addresses, schools, or birthdays.
- As soon as your order is delivered, we delete your child's details and your email from our order records.
- The finished files are deleted automatically 14 days after delivery, or earlier if you click "Delete my files now."
- We do not sell or share personal information for advertising, and we never use your child's details to train AI models.
2. Information we collect
From you (the adult purchaser), when you order:
- Your email address (to deliver your order and contact you about it)
- Your child's first name and age
- A short description of a good deed and a wish (we automatically remove emails, phone numbers, web addresses, and street addresses from these fields)
- Optionally, a sibling's first name
- Your confirmation that you are the child's parent or legal guardian and are 18 or older
Payment information is entered directly on our payment processor's (Stripe's) secure page. We never see or store your full card number. Stripe shares with us your email, the amount paid, and a payment reference.
Technical information: our hosting provider keeps standard server logs (IP address, browser type, pages requested) for security and troubleshooting, for up to [30] days. If we use advertising pixels (for example Meta Pixel or Google Ads conversion tags), they collect information about your visit and purchase as described in section 6. We never send your child's information to advertising platforms.
3. How we use it
We use the information only to:
- Write a personalized script, then produce the video, letter, and certificate you ordered
- Email you a private download link and contact you about your order
- Handle refunds, support requests, fraud prevention, and legal obligations
- Measure our advertising, using purchase events only, with no child data
4. Service providers ("subprocessors")
We share the minimum information needed with these providers, who process it on our behalf under their terms:
- Stripe (payments): your email and payment details. Child details are never sent to Stripe.
- HeyGen (AI video generation): the script text, which includes your child's first name, age-appropriate wording, the good deed, and the wish. No email or other identifiers are sent; we tag the job with an internal order number only. We delete the rendered video from HeyGen through its API as soon as we have downloaded it [confirm HeyGen's backup and log retention before launch].
- [Postmark / Resend] (email delivery): your email address and the delivery email, which includes your child's first name.
- [Render] (hosting) and [Cloudflare R2 / AWS S3] (file storage): host the website and store your files until they are deleted.
- Meta and Google (advertising measurement, only if you accept these cookies where required): page visits and purchase events, without child data.
5. Retention and deletion
| Data | Deleted |
|---|---|
| Unpaid or abandoned order details | Within 24 hours |
| Child's first name, age, deed, wish, sibling name, and your email (order record) | Immediately after successful delivery |
| Orders that could not be delivered | No later than 7 days after ordering (we'll refund you) |
| Your video, letter, and certificate files | 14 days after delivery, or immediately when you click "Delete my files now" |
| Payment records at Stripe | Kept by Stripe as required for tax, accounting, and fraud law |
| Support emails you send us | Up to 12 months, then deleted |
You can ask us to delete anything sooner by emailing help@dearsanta.si.
6. Cookies and advertising
We use essential cookies or local storage only to make checkout work. If we run ads on Meta or Google, we may use their pixels or tags to learn whether an ad led to a purchase. Where the law requires it, we will ask for consent first. You can opt out through your browser settings, at https://www.aboutads.info/choices, or by using Global Privacy Control, which we honor.
7. Your choices and rights
Wherever you live, you can ask us to access, correct, or delete your information, or your child's, by emailing help@dearsanta.si. We will respond within 30 days, usually much sooner. Residents of California and other US states with privacy laws have the rights those laws provide, including the right to know, delete, correct, and opt out of "sale" or "sharing." We do not sell personal information. We will not discriminate against you for exercising your rights.
8. Security
Download links use long random tokens and expire. Data is encrypted in transit (HTTPS). Access to systems is limited to the people operating DearSanta.si. No method is 100% secure, but we limit risk mainly by keeping very little and deleting it quickly.
9. Children's privacy (COPPA)
DearSanta.si is a general-audience service for adults. Children should not use this website or submit orders. We collect information about a child only from the child's parent or legal guardian, who must confirm their status before ordering. We collect only a first name and the few details needed to personalize the message. We use it only to fulfill that parent's order, and we delete it promptly as described in section 5. We do not contact children, create profiles of children, or show children ads.
If you believe a child has submitted information to us directly, email help@dearsanta.si and we will delete it.
Attorney review note: confirm whether any element (for example, an age plus first name in an emailed video) could be "personal information" collected "from a child" under the amended COPPA Rule (16 CFR Part 312, as amended in 2025), and whether ad targeting or creative could make the site "directed to children." Current design: adult-directed site and ads, parent-only data entry, and data minimization plus deletion.
10. International users
We operate in the United States and sell to US customers. If you order from elsewhere, your information is processed in the US.
11. Changes
We'll post any changes here and update the date above. Material changes will not apply to orders already placed.
12. Contact
[LEGAL ENTITY NAME], [MAILING ADDRESS], help@dearsanta.si