Privacy policy
Last updated: 2 November 2026
Who we are
Santa Just Called (“we”, “us”), at santajustcalled.com, is run by Deadly Digital Studios Limited, a company registered in Northern Ireland (company number NI733066), registered office 76 Glen Road, Garvagh BT51 5DF. We are the data controller for the personal information described here. ICO registration number: [pending]. Contact: hello@santajustcalled.com.
The short version
- We use your photos and your children's details only to make and deliver your Santa video.
- We delete your photos and the video 30 days after delivery, or straight away when you ask.
- We never use your photos, your children's names or your video in advertising, on social media, or to train AI unless you separately and explicitly give us permission — and you can take that permission back at any time.
- We never sell your data.
What we collect
| Information | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Your name and email address | To deliver your video and contact you about your order | Contract (Art. 6(1)(b)) |
| Your children's first names, how to pronounce them, something to praise them for, and the other personalisation you choose (treat, place, behaviour line, who they should be good for) | To write and voice Santa's message | Contract |
| A photo of your room and photos of your children's letters or drawings | To place Santa in your room holding the letters | Contract |
| The video, still image and audio we make | To deliver it to you | Contract |
| Payment details | Handled entirely by Stripe — we never see or store your card number | Contract |
| IP address and basic request logs | Security, fraud and abuse prevention (e.g. rate limiting) | Legitimate interests (Art. 6(1)(f)) |
| Analytics and advertising cookies (Google Analytics, Meta Pixel) | To understand which adverts work | Consent — only if you click “Accept” |
| Marketing emails | Christmas offers, only if you ticked the box | Consent — unsubscribe any time |
Children's information
Our service is for parents and carers, not for children. Children do not use the site and we do not collect information from them directly. You give us your children's first names and photos of their letters so Santa can talk to them; please don't include surnames, addresses, school names or faces in any photo, and please make sure nobody is in the room photo. We collect the minimum needed, keep it for the shortest time, and a real person reviews every video before it's sent. We follow the spirit of the ICO's Age Appropriate Design Code even though our service is not aimed at children.
Automated processing and AI
We use AI services to create the voice, to place Santa in your room photo and to animate the video. These services process your photos and text only to produce your video, on our instructions, under data processing agreements. No decisions with legal or similarly significant effects are made about you by automated means. [verify: confirm in each provider's terms that customer inputs/outputs are not used to train their models, and record the setting used.]
Who we share it with
Only the service providers (processors) we need to make and deliver your video:
| Provider | What for | Location / transfer safeguard |
|---|---|---|
| Amazon Web Services (S3, SES) | Private storage of photos and videos; sending email | EU — Ireland (eu-west-1); no transfer outside the UK/EEA adequacy area for storage |
| Stripe | Payments | UK/EU and US — UK IDTA / SCCs [verify] |
| ElevenLabs | Santa's voice (text only — names and message) | US — UK IDTA / SCCs [verify] |
| fal.ai | Editing the room photo to add Santa | US — [verify DPA and transfer mechanism] |
| HeyGen | Animating the video | US — [verify DPA and transfer mechanism] |
| OpenAI (optional) | Automatic check that names/text are appropriate | US — [verify; only if enabled] |
| Google, Meta | Analytics/advertising cookies — only with your consent | US — [verify] |
We ask providers to keep your files only as long as needed to process them (for example, files we upload to fal.ai are set to expire after 24 hours).
How long we keep it
- Room photo, letter photos, video, still and audio: deleted automatically 30 days after delivery (7 days after a refund), or immediately when you use the “Delete my data” link in your email.
- Unfinished orders (you uploaded photos but didn't pay): deleted within 2 days. Photos uploaded but never attached to an order: deleted within 24 hours.
- Order record (your name, email, children's first names, amount paid — no photos or video): kept for 6 years for tax and accounting.
- Security logs: up to 30 days. Database backups (order records, no photos or video): 30 days.
Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent at any time. Email hello@santajustcalled.com — we'll reply within one month. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Cookies
Essential: none are needed to browse or order, apart from what Stripe sets on its own checkout page.
Analytics/advertising (Google Analytics, Meta Pixel): only after you click “Accept” on our banner; we remember your choice
in a sv_consent cookie for 180 days. Pages that show your video never load analytics.
To change your mind, clear cookies for this site and choose again.
Security
Photos and videos are stored privately and are only reachable through links that expire. Your video page and download links are signed and stop working after 14 days. Access to our admin tools is restricted.
Changes
If we change this policy we'll update the date above, and tell you by email if the change affects an order you've placed.