Privacy Policy

Summary

• You upload a photo of a room and type your child's first name so we can make a video of Santa in that room. We use them for that and nothing else.
• You never upload photos of your children. The only thing we know about your child is the first name (and, if you add it, how to pronounce it) and the good deed you pick.
• Room photos are deleted after 7 days. Videos are deleted after 30 days. Shared links stop working when the video is deleted.
• Your videos are private unless you choose to share one.
• We never sell your data, and we don't use your photos or videos to train AI models.

Santa Caught on Camera ("we", "us") runs this website. This policy explains what personal data we handle when you use it. For questions or requests, use the Contact support button on any page.

What we collect

Account details. Your email address and name. If you sign in with Google, we also receive your Google profile picture. We store a hashed password if you sign up with email and password.

Your room photo. The photo you add to the generator. Before upload, your browser shrinks it to at most 2048 pixels. Please take it with nobody in the picture.

What Santa says. Your child's first name, the optional pronunciation you type, and the good deed you choose. We put them into the instructions for the video so Santa can say them.

What we make. The free preview image of Santa in your room, the finished video, and, if you share a video, a preview image made from one of its frames.

Purchases. Which pack you bought, the amount, and when. Card details go straight to Stripe; we never see or store your card number.

Usage and device data. Your IP address and browser type for each sign-in session. To limit free previews we keep a one-way hash of your IP address, never the address itself. When you sign up: the page that referred you, the first page you opened on this site, any campaign tags in the link, your device type, operating system and browser, and the country, region and city your connection comes from. Steps you take in the product, such as asking for a preview, pressing Make the video or opening checkout. We use these to keep accounts secure, prevent abuse and see which parts of the site work.

The free Nice List checker runs entirely in your browser. The name you type there is not sent to us.

Cookies. A sign-in cookie that keeps you logged in. If we turn on Google Analytics or Plausible, they may set their own cookies, and where the law requires consent we ask first.

How we use it

• To make your preview and video, show them to you, and email you when a video is ready or couldn't be made.
• To run your account: sign-in, credit balance, purchase history, and automatic credit refunds when a video fails.
• To take payments and prevent fraud and abuse.
• To answer support requests, including free redos when a name sounds wrong.
• To understand and improve the product, using aggregated statistics.

Our legal bases, where the GDPR or similar laws apply: performing our contract with you, our legitimate interests (security, abuse prevention, improving the service), your consent (optional analytics cookies), and legal obligations (tax and accounting records).

Who processes your data

We use these providers to run the service. They receive only what they need for their part.

• Cloudflare: hosting, database, file storage and email delivery. Receives: everything stored by the service.
• Kie AI (kie.ai): makes the free preview image. Receives: your room photo.
• Metaso (metaso.cn), running the MiniMax video model: makes the video. Receives: your room photo, and the script with your child's first name, the pronunciation and the good deed.
• Stripe: payments. Receives: your email, purchase and payment details.
• Google: Google sign-in, and Google Analytics if enabled. Receives: sign-in data; anonymous usage statistics.
• Plausible (if enabled): privacy-friendly site statistics. Receives: anonymous usage statistics.

Some of these providers process data outside your country. Metaso is in mainland China, and other providers may process data in the United States or elsewhere. Each provider handles the data under its own terms and safeguards. The AI providers receive your photo and script only to return a result to us.

We may also disclose data when the law requires it, to protect people from harm, or as part of a sale or merger of the business. We do not sell personal data or share it for advertising.

How long we keep it

• Room photos and preview images: 7 days, then deleted automatically.
• Finished videos and their share preview images: 30 days, then deleted automatically. Save the videos you want to keep.
• Your child's first name, pronunciation and good deed: kept with the video's record in your account, so you can tell your videos apart, until you delete your account.
• Share links: until you turn sharing off, or the video is deleted.
• "Send to phone" links: expire after 24 hours.
• Account details, credits and purchase history: while your account exists. Purchase records are kept as long as tax and accounting laws require.

Sharing your videos

Videos are private by default. If you press Create share link, anyone with the link can watch that video, including the "Santa is calling" version. Share pages are marked so search engines don't index them. You can turn sharing off at any time, and the link stops working right away. Once someone has downloaded or re-posted a video, we can't remove those copies.

Children

The service is for parents and other adults 18 and older. Children don't use it, and you never upload photos of them. If you think a child has created an account or appears in an uploaded photo, contact us and we'll delete it.

Your rights

Depending on where you live, you can ask us to access, correct, delete or export your personal data. You can also object to some processing, or withdraw consent you gave. Contact us from the address on your account and we'll respond within 30 days. You can also complain to your local data protection authority.

Security

Data travels over HTTPS, and access to our systems is restricted. No service is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires.

Changes

If we change this policy, we'll update the date at the top. For significant changes, we'll tell you on the site or by email before they take effect.