Last updated: 18 October 2026
[LEGAL ENTITY NAME], ABN [ABN], trading as Santa Calls Back ("we", "us"), respects your family's privacy. This policy explains what we collect, why, and how long we keep it. It is written to meet the Australian Privacy Act 1988 (Australian Privacy Principles), with extra sections for the UK (UK GDPR and the ICO Children's Code), the EU (GDPR) and the US (COPPA).
Our service is booked by parents or legal guardians (18+). Children take part in the call only after a parent books and consents. Children cannot create accounts or book.
We sell three packages (prices in USD; local-currency totals shown at checkout; Australian customers see GST-inclusive AUD): 1. The Dasher (US$19) – live AI Santa video call only, plus the Christmas Eve / night "Santa on his way" sleigh video link. 2. The Comet (US$29) – the call, plus a personalised letter from Santa emailed and posted to you, plus the sleigh video link. 3. The Rudolph (US$49) – the call; an emailed recording of the call; and a Santa-with-the-family photo (uploaded high-res photo; family faces/bodies unaltered; original or Christmas background). All digital. Plus the sleigh video link. Whether the personalised letter is also included is [to be confirmed].
Recording and family-photo components only apply when you choose The Rudolph (or any future package that includes them). Each is confirmed with a separate unticked consent box at booking; nothing is recorded or photo-processed unless you tick it.
We treat recordings and photos of children as sensitive and collect them only with your opt-in consent. We do not use face recognition or create face templates; the photo cut-out is automated background removal only. During the live call your child's camera image stays on your device and is only shown in the self-view; it is not sent to us or to our providers. Your child's voice is streamed live to our video-call provider so Santa can hear and reply, and is not kept after the call.
To deliver the call, write and send the letter (where included), produce and deliver any recording or photo you've consented to, process payments and refunds, give support and meet legal obligations. - Recording and photo files are sent only to the parent email on the booking, through a private download link. - We do not sell data, and we do not use children's data for advertising, profiling or training AI models. Our AI and video providers do not use your data to train their models. - Marketing: nothing about your child (name, image, voice, recording or photo) is ever used in marketing, ads or social media without your separate, specific written consent, which is never a condition of booking and can be withdrawn at any time. Marketing emails go to parents only, by opt-in, with an unsubscribe link (Spam Act 2003 / UK PECR / CAN-SPAM).
| Data | Collected when | Kept until |
|---|---|---|
| Call transcript (text) | Every booking (used for letter where included) | Deleted once your letter has been sent, or after the call if no letter |
| Live camera / audio (no recording consent) | During call | Never stored |
| Call recording | The Rudolph with consent | Emailed within 2 hours of the call and deleted 24 hours after the call ends |
| Uploaded family photo (original) | The Rudolph with consent | Deleted 24 hours after the call ends |
| Finished family photo | The Rudolph with consent | Deleted 24 hours after the call ends |
| Postal address | Packages that include a letter | Deleted 30 days after posting (to handle returns/re-sends) |
| Child details (name, age, notes) | Every booking | Deleted 30 days after the letter is sent (or after the call if no letter) |
| Booking & payment records | Every booking | 7 years (tax law), with no child details beyond first name |
| Marketing consent record | If given | Until withdrawn, plus proof of consent for as long as we need to show it was given |
Please download your files before the link expires; we cannot recover them afterwards. You can ask us to delete any of these sooner.
Encrypted connections (HTTPS), encrypted storage for recording and photo files, private expiring download links, limited staff access and automatic deletion as set out above. If a data breach is likely to cause serious harm, we will notify you and the regulator as required (Notifiable Data Breaches scheme; UK/EU 72-hour rule).
You can ask to access, correct or delete your or your child's data at any time, or withdraw consent for a recording or photo before it is delivered, at hello@santacallsback.com. Complaints: contact us first; if unresolved, the Office of the Australian Information Commissioner (oaic.gov.au).
We collect children's information only from the parent. A child's photo, video or voice is personal information under COPPA, so we get verifiable parental consent before collecting it: the parent books, gives this notice-based consent with a separate tick box for recording and for the family photo where those components apply, and verifies by card payment. We keep children's data only as long as needed (section 5) and have a written data retention policy. Parents may review, delete or refuse further collection of their child's information at hello@santacallsback.com. California and other US state residents: you may ask to know what personal information we hold, to delete it, or to correct it, by emailing hello@santacallsback.com. We do not sell or share personal information for targeted advertising. We will not treat you differently for exercising these rights.
We'll post updates here with a new date. Contact: [LEGAL ENTITY NAME], [ADDRESS], hello@santacallsback.com.