Privacy Policy

DRAFT, last updated October 29, 2026 (partner program / Rewardful added). Not legal advice. Have a US privacy attorney review this before launch, especially the COPPA analysis in section 9.

Dear Santa ("we", "us") is operated by Work And Play LLC, based in California ("Dear Santa"). We make personalized video messages, letters, and certificates "from Santa." Our website and services are intended for and directed to adults (for example parents, grandparents, and other gift-givers). They are not directed to children, and we do not knowingly collect personal information directly from children.

1. The short version

• The adult placing the order gives us the minimum Santa needs: your email, the child's first name, age, one good deed, one wish, and optionally a sibling's first name, your town or city (city level only), a favorite treat, and pet names. If you add extra children to your order, we collect the same details for each of them.
• We never ask for last names, photos, voice recordings, street addresses, zip codes, schools, or birthdays.
• As soon as your order is delivered, we delete your child's details and your email from our order records.
• The finished files are deleted automatically 14 days after delivery, or earlier if you click "Delete my files now."
• We do not sell personal information. We use the Meta Pixel to measure our advertising (for example, whether an ad led to a purchase), which may count as "sharing" personal information for advertising under California law. You can opt out with the "Your Privacy Choices" link at the bottom of every page or with Global Privacy Control (see section 7).
• Your child's details are never shared with Meta or anyone else for advertising, and we never use them to train AI models.

2. Information we collect

From you (the adult purchaser), when you order:

• Your email address (to deliver your order and contact you about it)
• Your child's first name and age
• A short description of a good deed and a wish (we automatically remove emails, phone numbers, web addresses, and street addresses from these fields)
• Optionally, a sibling's first name
• Optionally, your town or city (city level only, such as "Pasadena, CA"; we reject street addresses, zip codes, and school names), a favorite treat, and pet names (with the kind of pet, if you tell us)
• If you add extra children to your order (our sibling add-on), the same details for each extra child
• Your confirmation that you are 18 or older and that the details you share are yours to share

Payment information is entered directly on our payment processor's (Stripe's) secure page. We never see or store your full card number. Stripe shares with us your email, the amount paid, and a payment reference.

Technical information: our hosting provider keeps standard server logs (IP address, browser type, pages requested) for security and troubleshooting, for up to 30 days. We use the Meta Pixel on our website, which collects information about your visit and purchase as described in section 6. We never send your child's information to advertising platforms.

3. How we use it

We use the information only to:

1. Write a personalized script, then produce the video, letter, and certificate you ordered
2. Email you a private download link and contact you about your order
3. Handle refunds, support requests, fraud prevention, and legal obligations
4. Measure our advertising, using purchase events only, with no child data

4. Service providers ("subprocessors")

We share the minimum information needed with these providers, who process it on our behalf under their terms:

• Stripe (payments): your email, payment details, and what you bought (for example "Extra child: own personalized Santa video"). Child details are never sent to Stripe.
• ElevenLabs (AI voice): the script text, which includes your child's first name, the good deed, and the wish (and any optional town or city, favorite treat, or pet names you gave us), to create Santa's voice. No email or other identifiers are sent.
• HeyGen (AI video generation): Santa's narration audio and the script text, which includes your child's first name, age-appropriate wording, the good deed, and the wish (and any optional town or city, favorite treat, or pet names). No email or other identifiers are sent; we tag the job with an internal order number only. We delete the rendered video from HeyGen through its API as soon as we have downloaded it, and we delete the uploaded narration audio at the same time.
• Our email delivery provider: your email address and the delivery email, which includes your child's first name.
• Fly.io (hosting and file storage): hosts the website and stores your files until they are deleted.
• Rewardful (partner referral tracking): if you arrive through a partner's referral link, Rewardful records the visit and, if you order, links your Stripe customer record (your email and the amount paid) to that partner so we can pay their commission and apply your friend discount. Child details are never sent to Rewardful. If you join our partner program, Rewardful also holds your partner account details, such as your name, email, and PayPal address for payouts.
• Meta (advertising measurement, through the Meta Pixel): page visits, checkout starts, and purchases (the amount paid and a payment reference), without child data. If we add Google Ads measurement later, it will work the same way.

5. Retention and deletion

You can ask us to delete anything sooner by emailing help@dearsanta.si.

6. Cookies and advertising

We use essential cookies or local storage to make checkout work. Our partner program uses a Rewardful cookie (`rewardful.referral`) for 30 days after you click a partner's referral link, so the partner gets credit and you get the friend discount; it is not used for advertising. We also use the Meta Pixel, a small piece of code from Meta Platforms that sets cookies (such as `_fbp`) and sends Meta information about your visit: the page you viewed, your browser and device, your IP address, and, if you buy, that a checkout started and a purchase happened, with the amount and a payment reference. We use it to learn whether our ads led to a purchase and to show our ads to people likely to be interested. We never send Meta your child's name or any other details you typed into the order form, and the pixel does not run on your private download page. We serve customers in the United States and do not show a cookie consent banner. Instead, you can opt out at any time: use the "Your Privacy Choices / Do Not Share My Personal Information" link at the bottom of every page, or turn on Global Privacy Control in your browser. Either way, we do not load the Meta Pixel at all (see section 7). You can also control Meta ad settings at https://www.facebook.com/adpreferences.

7. Your choices and rights

Wherever you live, you can ask us to access, correct, or delete your information, or your child's, by emailing help@dearsanta.si. We will respond within 30 days, usually much sooner. Residents of California and other US states with privacy laws have the rights those laws provide, including the right to know, delete, correct, and opt out of "sale" or "sharing." We do not sell personal information. We will not discriminate against you for exercising your rights.

Your Privacy Choices / Do Not Share My Personal Information

Our use of the Meta Pixel may count as "sharing" personal information for cross-context behavioral advertising under California law. To opt out, click "Your Privacy Choices / Do Not Share My Personal Information" at the bottom of any page, or use the button below. We save your choice in your browser (a `ds_optout` cookie and local storage), and from then on we do not load the Meta Pixel on our site in that browser. Because the choice is stored in your browser, repeat it on each browser or device you use, and again if you clear your cookies. If your browser sends a Global Privacy Control signal, we treat it as the same opt-out automatically, with no click needed. Opting out does not affect your order, and your child's details are never shared for advertising either way.

8. Security

Download links use long random tokens and expire. Data is encrypted in transit (HTTPS). Access to systems is limited to the people operating Dear Santa. No method is 100% secure, but we limit risk mainly by keeping very little and deleting it quickly.

9. Children's privacy (COPPA)

Dear Santa is a general-audience service for adults. Children should not use this website or submit orders. We collect information about a child only from the adult placing the order, who confirms they are 18 or older and that the details are theirs to share. We collect only a first name and the few details needed to personalize the message. We use it only to fulfill that order, and we delete it promptly as described in section 5. We do not contact children, create profiles of children, or show children ads.

If you believe a child has submitted information to us directly, email help@dearsanta.si and we will delete it.

Attorney review note: confirm whether any element (for example, an age plus first name in an emailed video) could be "personal information" collected "from a child" under the amended COPPA Rule (16 CFR Part 312, as amended in 2025), and whether ad targeting or creative could make the site "directed to children." Current design: adult-directed site and ads, adult-only data entry, and data minimization plus deletion.

10. International users

We operate in the United States and sell to US customers. If you order from elsewhere, your information is processed in the US.

11. Changes

We'll post any changes here and update the date above. Material changes will not apply to orders already placed.

12. Contact

Work And Play LLC. Contact us by email at help@dearsanta.si.