Privacy Policy

Effective October 2026. Operator: Folsom Holdings LLC (Maine), the wholly-owning entity of santacalls.live.

Santa Calls is a service that places a live, personalized phone call from a Santa character to a phone number a parent or guardian has verified. We take privacy seriously because the service handles information about children, household details, and a verified phone number — none of which we treat casually.

1. Who this policy covers

This policy applies to everyone who uses santacalls.live, including:

• Account holders — the parent or guardian who creates an account and arranges calls.
• Children referenced in a call — the child whose name, age, and family details a parent enters so Santa can speak to them by name. Children do not interact with our website directly; we collect their information only from the parent who has authority over them.
• Gift recipients — when a gift package is purchased, the recipient household's phone number is collected from the buyer and used only to deliver the gifted call after the recipient accepts.

2. Information we collect

From the parent or guardian (account holder)

• Email address (required for sign-in via magic link).
• Mobile phone number (required, verified by SMS one-time code).
• Display name, if you choose to provide one.
• Build drafts: any details you enter while preparing a call, optionally saved for resume-later via an email link.
• Your family's visiting elf (optional): if you arrange a call from Head Elf Tinsel, you can tell us your elf's name, whether the elf is a she, he or they, what the elf is like, and what the elf has been up to. We save these to your account so you don't have to retype them for the next call. They are free-text notes that you write. Please describe the elf, not your child; anything you type here is treated with the same care as the rest of your call details.
• When paid checkout opens: purchase records such as plan selected, amount paid, and Stripe customer and payment identifiers (we never see your full card number).

About the child you're arranging a call for

• Child's name and an optional pronunciation guide.
• Age in whole years (1 to 16, or 16+). We do not collect birthdates.
• Family traditions, gift hints, and any other personalization details you choose to share.

Child profiles and personalization are entered by the parent or guardian who has authority over the child. Children do not create accounts or enter profiles on our website. During a supervised call, the service processes the child's live speech so the selected character can hear and respond; see §5 and the providers in §6.

Automatic / technical information

• IP address and user agent string at sign-up and at major actions, kept for security and abuse prevention.
• Aggregate visit metrics via Google Analytics 4 (measurement ID G-RX7W83YJ17) on our public pages only. GA4 is not loaded on the build flow, dashboard, or any page where a child's information is entered, and advertising features (Google Signals and ad personalization) are disabled. IP anonymization applies where relevant.
• Call status records: the time of the call, its duration, and whether it completed. We do not record the audio of the call by default. (See §5 below.)
• An account-level count of completed calls, used to show your calls-made total without keeping older call details.

3. How we use this information

• To dial the verified phone with a personalized Santa call.
• To send transactional emails: magic-link sign-in, build-draft recovery, call reminders, payment receipts, and the launch-list confirmation.
• To send requested transactional SMS: phone verification codes and, where text-based parent verification is available, a later parental-consent confirmation text. No marketing texts.
• To prevent abuse and to investigate fraud, harassment, or violations of the Terms of Service.
• To meet legal obligations (tax records, lawful requests, etc.).

We do not sell or rent personal information. We do not use child-related information for advertising or profiling.

SMS and mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties. Your phone number is shared only with the service providers that deliver our messages and calls (see §6), solely to provide the service. We send requested verification codes, a later parent-consent confirmation text where that method is available, and appropriate opt-out or review acknowledgements, never marketing texts. Reply STOP to stop messages or HELP for help; message and data rates may apply.

4. Children's privacy (COPPA)

Santa Calls is designed to be operated by a parent or legal guardian on behalf of a child. Children do not register, log in, or input data on our website. We distinguish information an adult provides about a child from the child’s live speech during a call. Before a child participates, their parent or legal guardian must receive our direct privacy notice, affirm permission, and complete parental verification. Phone verification and authorization to receive AI-voice calls are separate requirements. A checkbox, free credit or a gift buyer’s payment does not by itself verify the recipient parent’s consent.

You may at any time review, edit, or delete a child profile and all associated data via the dashboard, or by emailing us at info@santacalls.live. Account deletion removes all linked child profiles.

For a parent buying calls for their own selected children, verification is tied to a successful card transaction after the notice and affirmation. Enabled free-test accounts may use the same text method as eligible gifted-call recipients. With this method, the requested code is followed by a confirmation text no sooner than 15 minutes later; calls remain locked until the parent replies YES. Text-based verification is offered only after review of the applicable provider processing arrangements. You can withdraw permission from Settings without closing your account; replying STOP also blocks texts and calls. Changes to the covered children may require fresh consent.

5. Recording and audio handling

We do not record the audio of Santa calls by default. Audio is processed live, and Santa Calls does not save production call transcripts. Controlled staging tests may temporarily enable transcript diagnostics for consenting test participants; these are separate from customer call records and are deleted after review. An hourly cleanup removes staging diagnostic files older than seven days. Provider-side processing and retention are separate from what Santa Calls stores.

If a future product feature offers opt-in call recording for keepsakes, it will be clearly labeled, off by default, and consented to per call before any audio is stored.

Support calls are not recorded or transcribed. Our public support number plays a message directing you to info@santacalls.live and then hangs up. It does not accept voicemail messages.

6. Sub-processors and service providers

We rely on the following third parties to operate the service. Each only receives the information they need to perform their function:

• Cloudflare — website hosting, DNS, and edge security. Receives IP and request headers.
• Twilio — places the outbound phone call and delivers the SMS verification code. Receives your phone number and the live two-way call audio, including your child’s speech, to carry the call.
• xAI (Grok) — generates Santa's real-time voice and conversation. Receives the scenario prompt, child first name, selected personalization slots (including any saved elf details), limited saved family names and pronunciation guides from the verified phone owner's account to help understand references to other children, and the live call audio (processed in real time so Santa can hear and respond during the conversation); does not receive your phone number or email. Background family names do not add those children as call participants or identify who is speaking. For gifts, this context comes from the receiving household, not the purchaser's family.
• Resend — delivers our transactional email (magic links, confirmations, reminders). Receives your email address and the message body.
• Stripe — will process payments when paid checkout opens. It will receive billing information directly from your browser; we will not see full card numbers.
• Google Analytics 4 — aggregate, anonymized traffic metrics on our public pages only. Not loaded on the build flow, dashboard, or other family/account pages; advertising features (Google Signals and ad personalization) are disabled.

7. How long we keep information

• Account record: kept until you delete the account. Deletion removes login access and personal identifiers; a non-identifying record may remain where needed to preserve accounting records.
• Child profiles: kept until you delete them or delete the account.
• Family elf details: kept until you clear the elf fields in the call builder or delete your account. Deleting your account removes them.
• Build drafts: 30 days after creation, then auto-deleted.
• Call personalization (your child's name and the details for a scheduled call): cleared 30 days after the call takes place.
• Gift details (child's name, personal message, call details): cleared 30 days after the gift's acceptance window closes, unless the gift was accepted and can still be used, in which case they're kept until it's used up or expires.
• Your child's voice during a call: not recorded or stored by Santa Calls. It passes live through Twilio and xAI only so Santa can hear and respond.
• Call records (metadata only): 90 days, then de-identified or deleted.
• Completed-call count: the account-level total is kept until account deletion; it contains no speech, recording or child-specific call details.
• Parental verification evidence: uncompleted requests are deleted after 30 days; verified records are valid for one year and deleted one year after expiry. IP and browser metadata are cleared after 30 days. Account deletion removes these records.
• Payment records: as required by tax and accounting law (typically 7 years).
• Staging transcript diagnostics: consenting test participants only, deleted after review; an hourly job removes files older than seven days. Production call transcripts are not saved by Santa Calls.
• Operational logs: kept separately from customer call records; provider processing and retention follow each provider's terms.

8. Your rights

You may at any time:

• Request a copy of the information we hold about you and your child profiles.
• Correct or delete any account, child profile, saved elf details, or build draft.
• Withdraw parental consent in Settings without closing the account, or close the account from Settings. This removes login access, child profiles, verified phones, drafts, and call history, and anonymizes retained accounting references.
• Opt out of non-transactional email at any time (transactional email — sign-in, receipts, call reminders — cannot be opted out of while the account is active).

Reach us at info@santacalls.live for any of the above.

9. Security

We use industry-standard practices: TLS for all traffic, secrets stored in server-side encrypted secret stores, peppered hashes for sensitive tokens, narrow access for the operations team. No system is perfectly secure, and we will notify affected account holders without undue delay if a confirmed breach affects them.

10. Location of data

Our infrastructure is hosted in the United States. We do not currently offer the service to residents of the European Union, the United Kingdom, or other regions whose data-protection regimes would require additional disclosures and transfer mechanisms.

11. Changes to this policy

If we materially change this policy, we will post the updated version here with a new effective date and notify active account holders by email.

12. Contact

Folsom Holdings LLC
P.O. Box 117
Shapleigh, ME 04076
info@santacalls.live