Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including:

• Email address (required to send you a link to your free letter and to deliver any paid products)

• Child information you enter into the letter form: first name, age, interests, and behavior notes you choose to share

• Payment information processed securely through Stripe (we never store card details)

• Shipping address when you order a physical letter (processed via Stannp)

• Letter content, which is sent to PDFShift to render the PDF version of your letter

We also collect limited technical data automatically: IP address, browser type, and pages visited, used solely for security and performance purposes.

2. How We Use Your Information

We use the information we collect to:

• Generate and deliver your personalized Santa letter

• Send your purchased PDF or physical letter

• Send transactional emails related to your order

• Send marketing emails about our products, only if you opt in, whether by ticking the checkbox when you create a letter or by signing up for one of our email lists. You can unsubscribe at any time using the link in any email.

• Improve our service and troubleshoot issues

• Comply with legal obligations

We do not sell your data to third parties under any circumstances. We may use limited, anonymised data to measure the performance of advertising campaigns we run, as described in Section 8 (Cookies and Tracking Technologies) below.

3. Children's Privacy (COPPA)

SantasLetter.ai is designed for parents and guardians to create letters on behalf of children. We do not knowingly collect personal information directly from children under the age of 13.

All information about a child (name, age, interests) is entered by a parent or guardian and is used solely to generate that child's personalized letter. We store child information for as long as your letters remain available, or until you request deletion.

If you believe we have inadvertently collected information from a child without parental consent, please contact us immediately at privacy@santasletter.ai and we will delete it promptly.

4. Data Sharing

We share your information only with trusted service providers necessary to operate our service:

• Stripe: payment processing

• Anthropic: AI letter generation (receives the child's first name, age, behavior rating and notes, wishes, and any private note you add, in order to write the letter)

• Resend: transactional and marketing email delivery

• Stannp: physical letter printing and mailing (receives the full letter content and the mailing address)

• PDFShift: PDF rendering (receives the letter content and the child's name, and for physical orders also the mailing address)

• Supabase: secure data storage

• Sentry: error monitoring (receives technical error reports, which may occasionally include an order's name or mailing address)

• Upstash: rate limiting (receives a hashed version of your email address and your IP address)

• Vercel: website hosting and analytics

• Meta (Facebook): advertising measurement via the Meta Pixel, where applicable

All service providers are contractually required to protect your data and may not use it for their own purposes beyond the scope described.

5. Data Retention

We retain your email address and order history for as long as necessary to provide our service and comply with legal obligations. Letter content and child information may be retained for longer than the immediate order, including to support the free tier and for as long as your letters remain available, and we are working toward a defined deletion schedule. You may request deletion of your data at any time by emailing privacy@santasletter.ai, and we will delete it promptly upon request.

6. Your Rights (California Residents)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal information we collect and how it is used

• Request deletion of your personal information

• Opt out of the sale of personal information (we do not sell data)

• Non-discrimination for exercising these rights

To exercise any of these rights, contact us at privacy@santasletter.ai.

7. International Users (GDPR / UK GDPR)

If you access SantasLetter.ai from the European Union, United Kingdom, or other regions with data protection laws, the following additional rights apply to you:

• Right of access: you can request a copy of the personal information we hold about you

• Right to rectification: you can request that we correct inaccurate information

• Right to erasure: you can request that we delete your personal information ("right to be forgotten")

• Right to data portability: you can request your data in a portable format

• Right to object: you can object to our processing of your personal information

The lawful basis for our processing is the performance of our contract with you (delivering the letter you ordered). For marketing emails, the lawful basis is your consent: we send them only if you opt in, whether by ticking the checkbox when you create a letter or by signing up for one of our email lists, and you can withdraw that consent at any time using the unsubscribe link in any email we send.

To exercise any of these rights, contact privacy@santasletter.ai. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Please note: SantasLetter.ai is operated from the United States. By using the service, you consent to the transfer of your information to the United States, which may have data protection laws different from those in your country.

8. Cookies and Tracking Technologies

We use a limited set of cookies and similar technologies:

• Session storage to remember your letter as you navigate between pages

• Local storage to remember a referral code from a friend's referral link, kept for 30 days so the friend can be credited if you create a letter later

• A consent cookie, kept for one year, recording whether you accepted or declined optional tracking

• Vercel Analytics to measure aggregate website performance, page views, and traffic sources. This data is anonymised and is not used to identify individual users.

• Meta (Facebook) Pixel, loaded only if you accept the consent banner, to measure the effectiveness of advertising campaigns we run on Facebook and Instagram. The Pixel records page visits and conversion events (such as completed purchases) and shares this data with Meta so we can understand which ads drive results. You can control how Meta uses this data through your Facebook ad preferences at facebook.com/adpreferences.

• Sentry, to log technical errors so we can fix problems quickly. Sentry does not receive letter content, prompts, or session recordings. Error reports may occasionally include an order's name or mailing address.

• Upstash (Redis), to apply rate limits based on a hashed version of your email address (kept up to 24 hours) and your IP address (kept up to 1 hour).

You choose whether to allow optional cookies using the consent banner shown on your first visit. You can change that choice at any time with the "Cookie settings" link at the bottom of every page: it reopens the banner and shows your current choice. If you switch from accepting to declining, the Meta Pixel stops for the rest of your visit (the page reloads once) and we delete the cookies it set on our site. You can also block or clear cookies in your browser settings. Declining may affect some site functionality but you will still be able to use the core service.

9. Security

We implement industry-standard security measures to protect your information, including HTTPS encryption, secure payment processing via Stripe, and access controls on our databases. No method of transmission over the internet is 100% secure, but we take every reasonable precaution to protect your data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Continued use of our service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

privacy@santasletter.ai

SantasLetter.ai

California, United States