🛡️ COPPA Compliant

Privacy Policy

Let's Call Santa by Supply NY, LLC

Effective Date: December 1, 2025

Last Updated: December 1, 2025

      🎯 Quick Summary: We collect minimal data to power your child's conversation with Santa. 
      We require parental consent before any call. Audio is transcribed then deleted. 
      You can delete all data anytime.
    

1. Introduction

Let's Call Santa ("Service," "we," "us," or "our") provides an interactive AI experience where children can speak with a virtual Santa Claus character. This Privacy Policy explains how we collect, use, and protect information, with special attention to children's privacy.

We take children's privacy seriously. Our Service is designed for children under 13 and complies with the Children's Online Privacy Protection Act (COPPA).

2. Information We Collect

From Parents/Guardians:

Email address — To verify consent and send the wish list
Consent records — Timestamp, IP address, and consent selections

From Children (with parental consent):

First name only — So Santa can greet them personally
Age — To tailor the conversation appropriately
Voice audio — Temporarily, during the live conversation
Transcript — Text version of the conversation
Wish list items — Gifts mentioned during the conversation

We do NOT collect:

Last names
Home addresses
School names
Phone numbers
Photos or videos
Persistent identifiers for tracking across sites

3. How We Use Information

Data	Purpose
Child's first name	Santa greets them personally during the call
Child's age	Tailor Santa's conversation style
Voice audio	Enable real-time conversation with Santa AI
Transcript	Generate personalized letter from Santa, shareable replay
Wish list items	Create wish list with product links for parents
Parent email	Verify consent, deliver wish list and letter

4. Parental Consent

We require verifiable parental consent before any child uses our Service.

Our consent process:

Parent provides their email address
Parent checks boxes confirming they are the guardian and consent to recording
We send a verification email to the parent
Parent clicks the verification link
Only then can the child's call with Santa begin

This "Email Plus" method is recognized by the FTC as an acceptable form of verifiable parental consent.

5. Data Retention & Deletion

      Audio is NOT stored. Voice audio is processed in real-time, transcribed, 
      and immediately deleted. We never retain audio recordings.
    

Data Type	Retention Period
Voice audio	Deleted immediately after transcription
Transcript	30 days, then auto-deleted
Wish list	90 days, then auto-deleted
Child's name	30 days, then auto-deleted
Parent email	Until deletion requested or 1 year
Consent records	3 years (for legal compliance)

Your Right to Delete

Parents can request deletion of all their child's data at any time by emailing [email protected]. We will delete all associated data within 48 hours.

6. Third-Party Services

We use the following third-party services to operate:

Google Cloud / Vertex AI — Powers the Santa AI conversation. Audio is processed but not stored. Google Cloud Privacy
Amazon Associates — Wish list links may include affiliate links. We do not share child data with Amazon. Amazon Privacy
SendGrid/Resend — Sends emails to parents. Only parent email addresses are shared.
DigitalOcean — Hosts our service. DigitalOcean Privacy

7. Data Security

We protect your data with:

HTTPS encryption for all data in transit
Encrypted storage for data at rest
Access controls limiting who can view data
Regular security audits
Minimal data collection and retention

8. Affiliate Disclosure

The wish list we generate may contain links to products on Amazon.com. These are affiliate links, meaning we may earn a small commission if you make a purchase. This does not affect the price you pay.

We select products based on what your child mentions during the conversation, not based on affiliate commission rates.

9. Your Rights

Parents have the right to:

Review — Request a copy of any data we have about your child
Delete — Request deletion of all data at any time
Refuse — Decline consent and not use the Service
Withdraw — Withdraw consent and end data collection

To exercise any of these rights, email [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify parents via email before the changes take effect. The "Effective Date" at the top of this page indicates when the policy was last updated.

11. Contact Us

Privacy Questions or Concerns?

Email: [email protected]
Company: Supply NY, LLC
Address: 923 Kelley Court, Lafayette, CA 94549

We respond to all privacy inquiries within 48 hours.

12. For California Residents

California residents have additional rights under the California Consumer Privacy Act (CCPA). You may request to know what personal information we collect, request deletion, and opt out of any sale of personal information (we do not sell personal information).

13. For EU/UK Residents

If you are located in the European Union or United Kingdom, you have additional rights under GDPR including the right to access, rectify, erase, restrict processing, data portability, and to lodge a complaint with a supervisory authority.