Privacy policy

1. Who we are

Present Picker Ltd (“we”) is the controller of your personal data. Registered office: 4 College Gardens, Enfield, EN2 0QF, United Kingdom. Company no. 14448250. Data protection contact: privacy@pleasesanta.com.

This policy covers pleasesanta.com and the PleaseSanta app, which are offered in the United Kingdom. It applies under the UK GDPR and the Data Protection Act 2018.

2. What we collect, why, and for how long

• Account: first name, email, password hash, optional passkeys and two-step secret
  Run your account and sign you in securely
  Contract (Art. 6(1)(b))While your account is open; deleted when it closes (see “When an account closes”)
• Family profiles: first names (or nicknames or initials), child flag, colour, spending plans
  Create the grown-up and child views
  ContractWhile your account is open; deleted when it closes (see “When an account closes”)
• Lists, notes and plans grown-ups add
  Provide the grown-ups’ planner
  ContractWhile your account is open; deleted when it closes (see “When an account closes”)
• Letters to Santa (text and photos)
  Deliver letters, keep a copy for your family and tell you one has arrived
  Contract; your consent as parent/guardian for your child’s content (Art. 6(1)(a), Art. 8), and your explicit consent for anything sensitive a letter may mention (Art. 9(2)(a))Until you delete the letter or the account closes, whichever comes first
• Nornometer™ scores and log
  Show the dial to your child
  ContractScore: while your account is open. Each log entry: 12 months from when it was made
• Billing in our app: plan, country, currency, Stripe customer reference
  Take payment and manage your subscription
  ContractWhile your account is open; deleted when it closes (see “When an account closes”)
• Payment and invoice records (held in Stripe)
  Keep the accounting and tax records the law requires
  Legal obligation (Art. 6(1)(c))6 years from the end of the financial year the payment falls in (HMRC record-keeping rules), including after the account closes
• Referrals: your share code, which member’s link you joined through, and whether that member was given credit for you
  Run the referral scheme and give the right member their credit
  Contract (the scheme’s terms)While your account is open; deleted when it closes (see “When an account closes”)
• Referral checks: whether two accounts use the same payment card, using a card fingerprint from Stripe (never the card number)
  Stop people rewarding themselves
  Legitimate interests (Art. 6(1)(f))Not stored: checked once, when credit is due
• Consent records (what you agreed to or asked for, when, and which version)
  Prove valid consent and your choices
  Legal obligation (Art. 7(1))While your account is open, then until 3 years after the date of each record. Cookie choices: 12 months from the choice
• Sign-in sessions, one-time email codes, password-reset links and invitations
  Sign you in and verify it’s you
  ContractSessions: 12 hours, or 30 days if you stay logged in. Codes: valid 15 minutes. Reset links: 30 minutes. Invitations: 7 days. Each is deleted within a day of expiring
• Remembered devices (only if you choose): device type, last used, last child page opened
  Open the children’s page without logging in
  Contract (you ask for it)Until you forget the device or log out, or 12 months after it was last used
• Data downloads you ask for (an encrypted copy of your data)
  Give you a copy of your data
  Legal obligation (Arts. 15 and 20)7 days from when it’s made, then the file is deleted
• Security log: event, time, browser type, keyed hash of IP address
  Protect accounts from misuse
  Legitimate interests (Art. 6(1)(f))90 days from each event
• Cancellation and withdrawal notices
  Handle and evidence your contract decisions
  Legal obligation3 years from the date of the notice
• Data protection requests and our replies
  Handle your rights and show we did so
  Legal obligation (Arts. 12–22)3 years after we close the request
• Emails you send us and our replies
  Answer your questions
  Legitimate interests (Art. 6(1)(f))2 years after our last message in the conversation
• Marketing email preferences
  Send countdown nudges or offers only if you opt in
  ConsentUntil you change them. Your contact details are deleted from our email provider when the account closes
• Analytics (only if you accept): page path and date
  See which public pages are useful
  ConsentNo personal data is kept: only a count of views per page per day

When an account closes

An account closes, and everything kept “while your account is open” is deleted, at the first of these:

• You delete it in Account & data: straight away.
• Your subscription ends: the account stays read-only for 90 days so you can rejoin or download your data, then it is deleted.
• A sign-up never completes payment: 7 days after signing up.
• A free account (no card) never starts a subscription: 30 days after its 7-day free letter period ends. We email you a week before.

Deleted data also disappears from our encrypted backups within 30 days.

We collect this data from you directly. We don’t buy data, combine it with other sources, or make automated decisions with legal or similarly significant effects.

3. Children’s data

Children cannot sign up, pay, or contact anyone. A parent or guardian aged 18+ creates child profiles and acts on their behalf. We ask only for a first name, and a nickname or initial works just as well. When you add a child, you confirm you hold parental responsibility and consent to us storing their letters and Nornometer™ score (GDPR Art. 8). Children write freely, so a letter might mention things like health, faith or family life; your consent covers that too (Art. 9(2)(a)). We never read, analyse or share letters, and you can delete any letter at any time. No letter can be sent until a parent or guardian has agreed.

Children’s content is never used for marketing, profiling, advertising or training AI, and is never shown to anyone outside your account. The child view has no ads, no links out, no chat and no in-app purchases. Our design follows the ICO’s Age Appropriate Design Code (the Children’s Code).

Emails about a child go only to the grown-ups you choose for that child. A letter-arrival note contains the child’s first name. Santa’s reply also contains a short, gentle sentence about their Nornometer™ reading, or none if you hide the dial from them. Neither email ever includes the letter itself. Children can send up to three letters each Christmas (a grown-up can add up to three more).

In plain terms: letters are stored securely in your account on our servers in the EU. About a day after a letter arrives, a reply from Santa is sent by email to those same grown-ups (or to the account holder if none are chosen), never to a child. On the children’s screens we describe all this as letters travelling to the North Pole, to keep the magic.

4. Who we share it with

Only the service providers below, under contracts (Art. 28 data processing agreements) that bind them to our instructions. We never sell or rent personal data.

When you paste a shop link, our server fetches the public product page to read its name and price. The shop sees our server, not you, and we add no tracking or affiliate parameters. We may also disclose data where the law requires it.

When you scan or type a barcode, the camera image never leaves your device. If the gift isn’t already on one of your lists, our server looks the number up with UPCitemdb (a product database in the USA) to suggest its name, price and shop. Only the barcode number is sent, never anything about you, your family or your device, and we keep the product details for up to 90 days so the same item isn’t looked up twice.

5. International transfers

Stored in the EU. Our database and email provider are in the European Economic Area. UK law has an adequacy regulation for the EEA (it recognises the EEA as protecting personal data to UK standards), so that transfer needs no extra safeguard.

Stripe in the US. Where Stripe processes payment data in the United States, the transfer is covered by the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework, for which Stripe is certified). Where that doesn’t apply, Stripe uses the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the ICO (the “UK Addendum”).

Anyone else. If one of our providers, or a provider they use, processes your data outside the UK and EEA in a country without a UK adequacy regulation, we require the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to be in place. Barcode look-ups (section 4) send only a product number to the USA, which isn’t personal data.

You can ask for a copy of the safeguards at privacy@pleasesanta.com.

6. Where it’s stored and how it’s protected

Data is encrypted in transit (TLS 1.2+). Letters, letter photos, two-step secrets and data exports are additionally encrypted with AES-256-GCM before they reach the database. Passwords and PINs are hashed with Argon2id. The grown-ups area locks after 2 idle minutes. Staff access is limited, logged and requires multi-factor authentication. We will tell you and the regulator about any serious breach without undue delay (within 72 hours for the regulator).

7. Your rights

You also have the right to:

• access your data and get a copy of it;
• rectification: have inaccurate data corrected or incomplete data completed;
• erasure: have your data deleted;
• restriction: ask us to pause using your data while a concern is looked into;
• portability: receive the data you gave us in a machine-readable format;
• withdraw consent at any time, without affecting processing before you withdrew it; and
• not be subject to decisions made solely by automated means that have legal or similarly significant effects. We make no such decisions.

Most of this is self-service in Account & data (download, correct, delete, email choices). Otherwise email privacy@pleasesanta.com; we’ll reply within one month, and tell you if we need longer for a complex request.

8. What you must provide

A first name, email address, password and country are needed to open an account, and a payment method to start a subscription; without them we can’t provide the service. Everything else — family names beyond the first, letters, marketing emails, analytics — is optional.

9. Cookies

See our cookie policy. Non-essential cookies and analytics are off unless you switch them on.

10. Complaints

Please contact us first at privacy@pleasesanta.com: we’ll acknowledge your complaint within 30 days and tell you what we’re doing about it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection, at any time. You don’t have to contact us first.

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. Changes

We’ll email account holders at least 30 days before any material change. Previous versions are available on request.