Privacy Policy

Effective June 2026. Operator: Folsom Holdings, LLC (Maine), the wholly-owning entity of santacalls.live.

Santa Calls is a service that places a live, personalized phone call from a Santa character to a phone number a parent or guardian has verified. We take privacy seriously because the service handles information about children, household details, and a verified phone number — none of which we treat casually.

1. Who this policy covers

This policy applies to everyone who uses santacalls.live, including:

Account holders — the parent or guardian who creates an account and arranges calls.
Children referenced in a call — the child whose name, age band, and family details a parent enters so Santa can speak to them by name. Children do not interact with our website directly; we collect their information only from the parent who has authority over them.
Gift recipients — when a gift package is purchased, the recipient household's phone number is collected from the buyer and used only to deliver the gifted call after the recipient accepts.

2. Information we collect

From the parent or guardian (account holder)

Email address (required for sign-in via magic link).
Mobile phone number (required, verified by SMS one-time code).
Display name, if you choose to provide one.
Build drafts: any details you enter while preparing a call, optionally saved for resume-later via an email link.
When paid checkout opens: purchase records such as plan selected, amount paid, and Stripe customer and payment identifiers (we never see your full card number).

About the child you're arranging a call for

Child's name and an optional pronunciation guide.
Age band (toddler / young child / older child).
Family traditions, gift hints, and any other personalization details you choose to share.

We collect this child-specific information only from the parent or guardian who has authority over the child. We do not knowingly collect information directly from anyone under 13.

Automatic / technical information

IP address and user agent string at sign-up and at major actions, kept for security and abuse prevention.
Aggregate visit and funnel metrics via Google Analytics 4 (measurement ID G-RX7W83YJ17). GA4 is configured with IP anonymization where applicable.
Call status records: the time of the call, its duration, and whether it completed. We do not record the audio of the call by default. (See §5 below.)

3. How we use this information

To dial the verified phone with a personalized Santa call.
To send transactional emails: magic-link sign-in, build-draft recovery, call reminders, payment receipts, and the launch-list confirmation.
To send transactional SMS: the one-time verification code at sign-up.
To prevent abuse and to investigate fraud, harassment, or violations of the Terms of Service.
To meet legal obligations (tax records, lawful requests, etc.).

We do not sell or rent personal information. We do not use child-related information for advertising or profiling.

4. Children's privacy (COPPA)

Santa Calls is designed to be operated by a parent or legal guardian on behalf of a child. Children do not register, log in, or input data on our website. By creating an account and entering a child's information, you represent that you are the child's parent or legal guardian and you authorize us to use the information you provide solely to deliver the Santa call you've arranged.

You may at any time review, edit, or delete a child profile and all associated data via the dashboard, or by emailing us at info@santacalls.live. Account deletion removes all linked child profiles.

5. Recording and audio handling

We do not record the audio of Santa calls by default. The call is generated live, frame by frame, and the audio is discarded as it is played. A short transcript of speech-to-text events may be retained briefly for diagnostic purposes and then deleted; this transcript is not retained as a customer record.

If a future product feature offers opt-in call recording for keepsakes, it will be clearly labeled, off by default, and consented to per call before any audio is stored.

6. Sub-processors and service providers

We rely on the following third parties to operate the service. Each only receives the information they need to perform their function:

Cloudflare — website hosting, DNS, and edge security. Receives IP and request headers.
Twilio — places the outbound phone call and delivers the SMS verification code. Receives your phone number and a Santa-character voice stream.
xAI (Grok) — generates Santa's real-time voice and conversation. Receives the scenario prompt, child first name, selected personalization slots, and the live call audio (processed in real time so Santa can hear and respond during the conversation); does not receive your phone number or email.
Resend — delivers our transactional email (magic links, confirmations, reminders). Receives your email address and the message body.
Stripe — will process payments when paid checkout opens. It will receive billing information directly from your browser; we will not see full card numbers.
Google Analytics 4 — aggregate, anonymized funnel and traffic metrics. Configured to not enable advertising features.

7. How long we keep information

Account record: kept until you delete the account. Deletion removes login access and personal identifiers; a non-identifying record may remain where needed to preserve accounting records.
Child profiles: kept until you delete them or delete the account.
Build drafts: 30 days after creation, then auto-deleted.
Call records (metadata only): 90 days, then de-identified or deleted.
Payment records: as required by tax and accounting law (typically 7 years).
Diagnostic logs: short-lived operational logs are rotated by our hosting providers and are not retained as customer records.

8. Your rights

You may at any time:

Request a copy of the information we hold about you and your child profiles.
Correct or delete any account, child profile, or build draft.
Withdraw consent and close the account from Settings. This removes login access, child profiles, verified phones, drafts, and call history, and anonymizes retained accounting references.
Opt out of non-transactional email at any time (transactional email — sign-in, receipts, call reminders — cannot be opted out of while the account is active).

Reach us at info@santacalls.live for any of the above.

9. Security

We use industry-standard practices: TLS for all traffic, secrets stored in server-side encrypted secret stores, peppered hashes for sensitive tokens, narrow access for the operations team. No system is perfectly secure, and we will notify affected account holders without undue delay if a confirmed breach affects them.

10. Location of data

Our infrastructure is hosted in the United States. We do not currently offer the service to residents of the European Union, the United Kingdom, or other regions whose data-protection regimes would require additional disclosures and transfer mechanisms.

11. Changes to this policy

If we materially change this policy, we will post the updated version here with a new effective date and notify active account holders by email.

12. Contact

Folsom Holdings, LLC
Maine, United States
info@santacalls.live