Santa.Talk Privacy Policy

1. Our promise to families

Santa.Talk lets children chat with an AI character of Santa Claus or one of his friends. Children's privacy comes first, so here is the short version:

• Santa.Talk is for children, but parents are in control. A parent or guardian must set up and manage the app.
• We do not show ads and we do not sell personal information.
• We do not use cookies or advertising or tracking identifiers.
• We do not ask for camera access for calls. Santa is shown to the child; the child is never filmed.
• We do not ask for or collect names, email addresses, phone numbers or home addresses from children.
• Conversations are stored on your device. Parents choose how long any copy is kept by the AI services that help generate Santa's replies.
• Parents can export or delete their data at any time in the app.

The rest of this policy explains the details. Please read it together with the in-app parental settings.

2. Important: Santa is an AI

Santa and his friends are artificial intelligence characters. They are not real people, and conversations are generated automatically. We use safety guardrails designed to keep conversations child-appropriate, but no AI system is perfect. We encourage parents to supervise use, especially for younger children. Please remind children not to share private information such as full names, addresses or school names.

3. Information we collect and why

4. Why we are allowed to use this information (legal bases)

Where UK or EU data protection law applies, we rely on:

• Parental consent, given by the parent or guardian when setting up the app and enabling features such as the microphone, camera or photo access. Consent can be withdrawn at any time in the app or by contacting us.
• Contract, to provide the services and tokens a parent purchases.
• Legitimate interests, to keep the service secure, prevent fraud and abuse and improve safety, balanced against children's rights and interests.
• Legal obligation, such as tax, accounting and responding to lawful requests.

5. Children's privacy and parental consent

Santa.Talk is designed for children, but it must be set up and managed by a parent or legal guardian. By setting up the app, enabling features and allowing children to use it, you confirm that you are the child's parent or legal guardian and that you consent to the collection and use of your child's information as described in this policy.

• We collect only the information needed for the features described above.
• We do not require a child to provide more information than is necessary to take part.
• We do not knowingly collect personal information from children for advertising, and we never sell it or share it for advertising.
• Parents can review, export and delete their child's data in the app, and can contact us at [email protected] to refuse further collection or ask us to delete data.
• If you believe a child has given us personal information without parental consent, please contact us and we will delete it.

6. Who we share information with (service providers)

We do not sell personal information. We share information only with service providers who process it on our behalf, under written agreements that limit what they may do with it:

[CHECK AND AMEND THIS TABLE so it lists every provider that receives data in your live app.]

We may also disclose information if required by law, to protect the safety of children or others, to enforce our terms, or in connection with a business sale or merger (in which case we will require the new owner to honour this policy).

Retention instructions to providers: we configure our providers to delete conversation data in line with the retention period the parent has chosen. [CONFIRM with each provider that this is technically true.]

7. International transfers

Our servers are located in London, UK. Some of our service providers are located in, or process data in, other countries including the United States. Where we transfer personal data out of the UK or EEA, we use appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, or adequacy decisions (including the UK-US Data Bridge and EU-US Data Privacy Framework where a provider is certified).

8. How long we keep information

When the retention period ends, we delete the information or make it anonymous. Backups are overwritten on a regular cycle.

9. Parental controls and your choices

In the app, a parent can:

• choose how long service providers may keep conversation data (immediate, 24 hours, or 7 days);
• choose automatic deletion of on-device conversations;
• export their data;
• delete conversations, Santa Delivery Photos and the data we hold about them;
• switch purchasing on or off;
• withdraw permission for the microphone, camera or photo library at any time in the device settings.

If the app is deleted, data stored locally on the device is removed with it. Data held on our servers (such as Santa Delivery Photos and purchase records) is deleted using the in-app deletion option or by contacting us.

10. Your privacy rights

UK and EU/EEA. You have the right to be informed, to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time. You also have the right to complain to your data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

United States. Under the Children's Online Privacy Protection Act (COPPA), parents may review the personal information collected from their child, ask us to delete it, and refuse further collection. Residents of California and other US states with privacy laws may have additional rights to know, access, delete and correct personal information and to opt out of its sale or sharing. We do not sell or share personal information for cross-context behavioural advertising, and we do not knowingly sell or share the personal information of anyone under 16.

Other regions. If you live elsewhere, you may have similar rights under local law. Contact us and we will help.

To exercise a right, use the in-app controls or email [email protected]. We may need to verify that you are the parent or guardian before acting on a request. We will respond within one month (or the period required by law). Exercising your rights will not result in worse treatment.

11. Security

We use appropriate technical and organisational measures to protect information, including encryption of data in transit (TLS), network protection and access controls on our servers, restricted staff access, and regular security reviews. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach affects your information, we will notify you and the relevant authorities as required by law.

12. Automated decisions

We do not make decisions about people that have legal or similarly significant effects based solely on automated processing. AI is used to generate Santa's replies and images and to apply safety filters.

13. Third-party links and the app stores

Any link that leaves the app (for example to this policy or our website) is behind a parental gate. Apple and Google have their own privacy policies for purchases and store accounts, and we are not responsible for their practices.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify parents in the app before the changes take effect and, where required, ask for fresh consent. The "Last updated" date at the top shows the latest version.

15. Contact us

If you are not satisfied with our response, you can complain to your local data protection authority (in the UK, the Information Commissioner's Office).