Privacy and personal data

Your data stays under your control

This policy explains which data is used on santaclaus-official.com, why, and how to exercise your rights. When a service concerns a child, it must be used by their parent or legal guardian.

1. 1. Data Controller

   The santaclaus-official.com website is published by GPTPro Limited (C114704), the data controller for the personal data collected on the site.

   For any questions about your data: [email protected].

2. 2. Data Collected

   We collect only the data necessary for our services:

   • the parent account holder's data: last name, first name, email address, encrypted password, and subscription history;
   • payment information, processed directly by our secure payment provider and never stored on our servers;
   • information about the child entered by the parent: first name, age or date of birth, interests, good deeds, toy list, and letter to Santa Claus;
   • the photos you choose to send to the Christmas Photos and Costumes services, and the pictures created from them (see “Photos and AI creations”);
   • technical browsing data (IP address, device type, pages visited), under the conditions described in our Cookie Policy.

3. 3. Children's Data

   Our services are designed for children, but they are used by their parents. Only an adult with parental authority can create an account: a child never has an account or an email address registered with us.

   • information about the child is provided by the parent, who decides what to share;
   • we limit this information to what is needed to personalize the video, the letter, and the toy list;
   • this data is never used for targeted advertising or profiling, and is never sold;
   • the parent can view, correct, or delete it at any time from their account or upon simple request.

4. 4. Photos and AI creations

   The Christmas Photos and Costumes services let a subscribed parent send a photo (of their child, themselves or their family) to create a Christmas picture. No photo is collected if you do not use these services.

   • the photo you send is transmitted securely to our artificial intelligence provider (OpenRouter, which passes it to Google’s image generation model), only to create the requested picture;
   • this provider may process the photo outside the European Union;
   • we do not keep the photo you send: it is neither stored on our servers nor published;
   • the created picture is kept in your parent space (My memories), visible only to you, until you delete it or your account is deleted;
   • these photos and creations are never used for advertising or profiling, and are never sold.

5. 5. Purposes and Legal Bases

   • contract performance: account creation, personalized videos, toy lists, letters, Santa Claus messages, and subscription management;
   • compliance with our legal obligations: billing and accounting;
   • our legitimate interest: site security, fraud prevention, and improvement of our services;
   • your consent: audience measurement and optional communications, which you may withdraw at any time.

6. 6. Data Recipients

   Your data is accessible only to authorised members of our team and to our technical subcontractors (hosting, payment, email delivery, AI image generation), who are bound by confidentiality and subject to the GDPR. It is hosted in the European Union, except for the photos sent to the AI creation services described above, and is never sold or rented.

7. 7. Retention Period

   Account and child data is kept as long as the account is active, then deleted no later than three years after the last activity. AI creations are kept until you delete them from your parent space, and at the latest until the account is deleted; the photo sent to create them is never kept. Billing data is kept for the period required by law.

8. 8. Security

   We implement appropriate technical and organizational measures (encrypted communications, encrypted passwords, restricted access) to protect your data against any loss, alteration, or unauthorized access.

9. 9. Your Rights

   In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data and your child's data, as well as the right to withdraw your consent at any time.

   To exercise these rights, write to us at [email protected] or use our data deletion form. You may also file a complaint with the CNIL.

10. 10. Changes to This Policy

    We may update this policy. If there is a significant change, we will inform you. The current version is always available on this page.