DRAFT – to be reviewed by a lawyer. Everything in
[...]still has to be confirmed or filled in.
Privacy Policy and Children's Privacy Notice – Call with Santa
Last updated: [November 11, 2026]
In short: we use your child's information only to make that one call (and the letter, if you order it). The call is not recorded. Everything about your child and your phone number is deleted automatically within 7 days after the call, and within 24 hours if you don't complete payment. We don't sell or share personal information, we show no targeted advertising, we don't use children's conversations to train AI, and information about your child never goes to analytics or advertising companies.
1. Who we are (the operator)
Talentoso BV, Louizalaan 367, 1050 Brussels, Belgium · email [privacy@domain.com] · phone [US phone number]. We are the only operator collecting personal information through Call with Santa. [Lawyer: confirm whether any provider must be listed as a co-operator under COPPA.]
2. Children's privacy (COPPA notice)
Call with Santa is booked by parents. The call itself is a conversation with a child, usually under 13, so we follow the Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312).
What we collect about and from your child
| Information | Where it comes from | Why |
|---|---|---|
| First name and age | You, in the booking form | So Santa knows who he's talking to |
| Optional details: grade, hobbies, wish list, something to praise, something to work on, first names of brothers/sisters, a note for Santa | You, in the form or in Santa's Big Book | So the conversation feels personal |
| What your child says during the call | Your child, by voice | Your child's speech is turned into text in real time so the AI can answer. No audio recording is kept. The text transcript is kept by our voice-technology provider for at most 7 days, then deleted. |
| Name on the envelope and mailing address (letter only) | You | To print and mail the letter |
We do not ask your child for a last name, address, phone number, school name, photos or any other contact information, and Santa is instructed not to follow up if a child volunteers it. We do not create a voiceprint or any other biometric identifier, and we don't collect persistent identifiers (such as cookies or device IDs) from children. Children can't post or share anything publicly through our service. We don't require a child to give more information than is reasonably necessary for the call.
How we use it
Only to prepare and make the call (and its automatic retry or rescheduled call), and to create and mail the letter. Never for advertising, profiling, selling, or training AI models.
Who receives it
Only service providers who are integral to making the call and who may use it solely on our behalf:
- our voice-technology (AI) provider, which turns speech into text and creates Santa's voice;
- an AI language-model provider, used through that voice-technology provider, which generates Santa's answers;
- our telecom provider, which connects the call;
- our hosting provider (booking system) and print-and-mail service (letter only).
We have contracts requiring them to keep the information confidential and secure, not to use it for their own purposes (including AI training), and to delete it [to confirm with each provider]. We do not disclose children's information to any other third party, so we don't ask for separate consent for that. If that ever changes, we will ask for your separate consent first.
Parental consent
Before we collect anything from your child, we give you a direct notice (on the booking form and in your confirmation email, see the text at the end of this policy). You give verifiable parental consent by paying with a credit or debit card (or a wallet linked to one) in your name, which notifies the account holder of the transaction (16 CFR 312.5(b)(2)(ii)). If you don't complete payment, we don't make the call, we delete your child's information within 24 hours and your contact information within [7] days.
Your rights as a parent
At any time you can:
- review the information we hold about your child: open your booking page (link in your confirmation email); for what your child said during the call, email us within 7 days of the call and we'll send you the transcript;
- delete it: use "Delete my child's information now" on your booking page, or email [privacy@domain.com]. Deleting before the call means Santa can no longer make it personal (or the call is cancelled – see our Terms for refunds);
- refuse further collection or use: cancel the call and we will delete everything about your child.
To protect your child, we only act on requests made through your private booking link or from the email address used for the booking. We respond promptly and within [10 business days].
Retention policy (written policy under 16 CFR 312.10)
| Information | Deleted |
|---|---|
| Child's details (form and Big Book), your mobile number, mailing address | Automatically within 7 days after the call (mailing address after the letter is mailed, at the latest together with the rest) |
| Transcript at the voice-technology provider | Within 7 days after the call |
| Child's details from an unpaid booking | Within 24 hours |
| Audio | Never stored |
We keep children's information only as long as reasonably necessary for the call, and never indefinitely. Deletion is automatic and permanent.
Security
We keep a written information security program for children's information: encrypted connections (HTTPS), access limited to the few people who need it with strong authentication, private links with secret codes, contracts with our providers, and automatic deletion. [Lawyer: confirm program document, named responsible person and annual review per amended Rule.]
3. Information about you (the parent)
| Category | Examples | Why | Kept |
|---|---|---|---|
| Identifiers | first name, email address, mobile number | make the call, confirm, reschedule, help you | mobile number: 7 days after the call; email: as long as needed for support and records |
| Commercial information | what you booked, price, payment status (card details are handled by Stripe; we never see them) | payment, refunds, accounting | as required by tax and accounting law ([7–10] years) |
| Technical call data | time, length, answered or not, cost | retries, quality, costs | [up to 2 years, without child details] |
| Unfinished booking | name, email | at most 2 reminder emails (unsubscribe in one click) | up to [7] days |
| Feedback | rating, comment (without name, email or phone) | improving the service; shown on our site only with your explicit permission | up to 1 year |
| Messages | contact form, replies to our emails | helping you | 1 year after the last message |
4. We don't sell or share your personal information
We do not sell personal information and we do not share it for cross-context behavioral advertising or targeted advertising, as those terms are defined in California and other state privacy laws. We don't profile you or your child. We have no actual knowledge of selling or sharing information of anyone under 16. Because we don't do these things, there is nothing to opt out of; we still honor Global Privacy Control signals.
5. Your state privacy rights
Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and other states), you may have the right to: know/access the personal information we have about you, correct it, delete it, get a portable copy, and opt out of sale, sharing, targeted advertising and profiling (we don't do any of these). We give these rights to all US customers, whether or not your state's law applies to us. We will not treat you differently for using them.
How: email [privacy@domain.com] or use your booking page. We verify requests by matching them to your booking email or private link. An authorized agent may make a request for you with your signed permission. We respond within 45 days. If we decline, you can appeal by replying to our answer with "Appeal"; we'll respond within [45/60] days, and if you're still not satisfied you can contact your state attorney general.
Children's information is treated as sensitive information and processed only with parental consent under COPPA.
6. Website, cookies and tracking
- We count visits without cookies: per day and per source (for example "from Google"), without storing IP addresses, cookies or click IDs.
- During payment Stripe uses cookies needed to prevent fraud.
- No advertising pixels or third-party analytics cookies are used on this site. [Confirm before launch. If added later: only on parent-facing pages, never on children's pages (stories, coloring pages, crafts), and this policy and section 4 must be updated first.]
- Fonts are loaded [from our own server – to confirm].
- Our pages for children (stories, coloring pages, crafts, recipes) collect no personal information at all.
7. Where your data is processed
We are based in Belgium (EU). Our booking system is hosted in the EU (Frankfurt, Germany); some providers process data in the US. EU data-protection law (GDPR) also applies to how we handle your data.
8. Changes
We'll update this policy when our practices change. If we make a material change to how we handle children's information, we'll notify parents and ask for consent again where COPPA requires it.
9. Contact
Talentoso BV, Louizalaan 367, 1050 Brussels, Belgium · [privacy@domain.com] · [US phone number].
Direct notice to parents (shown on the booking form before payment and repeated in the confirmation email)
Notice to parents about your child's information (COPPA) Call with Santa is operated by Talentoso BV, Louizalaan 367, 1050 Brussels, Belgium, [privacy@domain.com], [phone].
- We have collected your email address and phone number to make this booking and to obtain your consent.
- Your consent is needed before we collect, use or disclose your child's information. We will not make the call or collect anything from your child without it.
- If you consent, we will use: your child's first name, age and any optional details you add (grade, hobbies, wish list, something to praise or work on, siblings' first names, a note), and what your child says during the call, which is turned into text in real time so our AI Santa can answer. The call is not recorded. For the letter by mail we also use the name on the envelope and the mailing address.
- We disclose this only to the service providers needed to make the call and the letter (voice-AI provider, AI language-model provider, telecom provider, hosting, print-and-mail service), who may use it only for us. We never use it for advertising and never sell or share it.
- Everything about your child is deleted within 7 days after the call.
- You can review or delete your child's information, or refuse further use, at any time via your booking page or by email.
- How to consent: complete payment with a credit or debit card (or a wallet linked to one) in your name. By paying you confirm you are the child's parent or legal guardian and consent as described in our Privacy Policy.
- If you don't complete payment, we delete your child's information within 24 hours and your contact information within [7] days.