Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including:

• Email address (required to deliver your free letter and any paid products)

• Child information you enter into the letter form: first name, age, interests, and behaviour notes you choose to share

• Payment information processed securely through Stripe — we never store card details

• Shipping address when you order a physical letter (processed via Lob.com)

We also collect limited technical data automatically: IP address, browser type, and pages visited, used solely for security and performance purposes.

2. How We Use Your Information

We use the information we collect to:

• Generate and deliver your personalised Santa letter

• Send your purchased PDF or physical letter

• Send transactional emails related to your order

• Improve our service and troubleshoot issues

• Comply with legal obligations

We do not sell your data to third parties under any circumstances. We may use limited, anonymised data to measure the performance of advertising campaigns we run, as described in Section 8 (Cookies and Tracking Technologies) below.

3. Children's Privacy (COPPA)

SantasLetter.ai is designed for parents and guardians to create letters on behalf of children. We do not knowingly collect personal information directly from children under the age of 13.

All information about a child (name, age, interests) is entered by a parent or guardian and is used solely to generate that child's personalised letter. We do not store child information beyond what is necessary to fulfil your order.

If you believe we have inadvertently collected information from a child without parental consent, please contact us immediately at privacy@santasletter.ai and we will delete it promptly.

4. Data Sharing

We share your information only with trusted service providers necessary to operate our service:

• Stripe — payment processing

• Anthropic — AI letter generation (letter content only, no personal identifiers)

• Resend — transactional email delivery

• Lob.com — physical letter printing and mailing (shipping address only)

• Supabase — secure data storage

• Vercel — website hosting and analytics

• Meta (Facebook) — advertising measurement via the Meta Pixel, where applicable

All service providers are contractually required to protect your data and may not use it for their own purposes beyond the scope described.

5. Data Retention

We retain your email address and order history for as long as necessary to provide our service and comply with legal obligations. Letter content and child information is retained only as long as needed to fulfil your order.

You may request deletion of your data at any time by emailing privacy@santasletter.ai.

6. Your Rights (California Residents)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal information we collect and how it is used

• Request deletion of your personal information

• Opt out of the sale of personal information (we do not sell data)

• Non-discrimination for exercising these rights

To exercise any of these rights, contact us at privacy@santasletter.ai.

7. International Users (GDPR / UK GDPR)

If you access SantasLetter.ai from the European Union, United Kingdom, or other regions with data protection laws, the following additional rights apply to you:

• Right of access: you can request a copy of the personal information we hold about you

• Right to rectification: you can request that we correct inaccurate information

• Right to erasure: you can request that we delete your personal information ("right to be forgotten")

• Right to data portability: you can request your data in a portable format

• Right to object: you can object to our processing of your personal information

The lawful basis for our processing is the performance of our contract with you (delivering the letter you ordered) and your consent (for marketing communications, where applicable).

To exercise any of these rights, contact privacy@santasletter.ai. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Please note: SantasLetter.ai is operated from the United States. By using the service, you consent to the transfer of your information to the United States, which may have data protection laws different from those in your country.

8. Cookies and Tracking Technologies

We use a limited set of cookies and similar technologies:

• Session storage to remember your letter as you navigate between pages

• Vercel Analytics to measure aggregate website performance, page views, and traffic sources. This data is anonymised and is not used to identify individual users.

• Meta (Facebook) Pixel to measure the effectiveness of advertising campaigns we run on Facebook and Instagram. The Pixel records page visits and conversion events (such as completed purchases) and shares this data with Meta so we can understand which ads drive results. You can control how Meta uses this data through your Facebook ad preferences at facebook.com/adpreferences.

You can disable cookies in your browser settings. Disabling cookies may affect site functionality but you will still be able to use the core service.

9. Security

We implement industry-standard security measures to protect your information, including HTTPS encryption, secure payment processing via Stripe, and access controls on our databases. No method of transmission over the internet is 100% secure, but we take every reasonable precaution to protect your data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Continued use of our service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

privacy@santasletter.ai

SantasLetter.ai

California, United States