Your child's details, handled gently

1.Who we are

A Little Santa Magic (alittlesantamagic.com) is operated by Traffic Kings Holding Co., 7500 W Lake Mead Blvd #9-463, Las Vegas, NV 89128 ("we", "us"). This policy explains what we collect, why, who helps us, how long we keep it, and the choices you have. Questions: help@alittlesantamagic.com.

2.Information we collect

From you, the grown-up buyer

• Contact and order details: your name (if given), email address, any delivery email address, order history and messages you send us.
• Payment details: Stripe processes card payments. We receive limited information such as card brand, last four digits, expiry, billing postal code and payment status. We never receive or store your full card number. If you choose to save your card for one-tap extras, Stripe stores it.
• For the Santa call: the phone number, time window and time zone you choose, and a record of your consent (what you agreed to, when, and from which device and IP address).
• For texts (optional): your mobile number and a record of your texting consent, if you choose to get Santa reminders and offers by text.
• Support conversations with our AI support assistant or our team.

About the child, provided by you

• First name, and how to pronounce it.
• An age range (for example, "5 to 6"), never a date of birth.
• Five happy details about your child, what's on their Christmas list (up to five items), and an optional note of anything else Santa should know (like a pet's name or a good report card). Please don't include last names, addresses, schools or health information.
• Who it's from (for example, "Mom and Dad").

Please don't give us a child's last name, home address, school, photos or sensitive information such as health details. Our forms ask you not to, and we may remove such information if it's entered.

During the Santa call

Santa's call system listens to the call in real time only, so Santa can reply. We do not record calls, and we keep no audio, transcript or anything your child says after the call ends. We keep only call logistics: the time, the number called, whether it connected, how long it lasted and whether someone asked us not to call again.

Automatically, when you browse the Site

• Device and visit data: IP address, browser type, pages viewed, referring page and timestamps, collected through cookies and similar tools (section 6).
• Page test data: which version of a page you saw and whether you started checkout.

3.How we use information

• To make and deliver your order: write the letter, voice it, produce the video, place the call, show everything on your private Santa page, and email you links and receipts.
• To support you: find your order, resend files, remake items under the Santa Promise, reschedule calls and handle refunds.
• To keep things safe and working: prevent fraud, secure our systems and fix problems.
• To keep records the law requires, such as payment and consent records.
• To email you, the grown-up buyer, about future offers, only as the law allows and never using your child's details. Every marketing email has a one-click unsubscribe.
• To measure and improve our pages and ads, using visit and purchase information only (never your child's details), as described in section 6.

We do not use children's details for advertising, profiling or training AI models, and we don't combine them with data from other sources.

4.Who we share information with

We share information only with service providers who help us run A Little Santa Magic, under terms that limit their use to providing services to us, require security, and prohibit selling it or using it to train their own AI models. They include providers for:

• Payments (Stripe): payments, saved cards, fraud prevention and refunds.
• Santa's voice (ElevenLabs): turning the letter or script text into Santa's voice, and, if you press "Hear Santa say" on our pages, the first name you typed, to make a short sample clip. We keep that clip privately for up to 30 days and do not store the name with it.
• Santa's video (HeyGen): lip-syncing the Santa video from the script and voice audio.
• Santa's call (Bland AI, which also provides the phone number): placing the call with an AI voice agent.
• AI writing (Anthropic Claude): writing the letter and scripts from your child's first name, age range and the details you share, with no-training settings.
• Email: sending receipts, links and support replies.
• Email marketing (Klaviyo): our email list for Santa updates and offers, for buyers who ticked the box and free letter signups. We send it your email, first name, what you bought and when, your consent choice and your child's age range only (for example, "5 to 6"), so we can send age-appropriate Santa updates. We never send it your child's name or any other details about your child.
• Text messaging (Klaviyo): sending the texts you agreed to, using your mobile number, first name and consent record only.
• Hosting and storage (Cloudflare): running the Site, your private Santa page and your files.
• Bot protection (Cloudflare Turnstile): checking that a real person, not an automated bot, is using the free letter form (section 6).
• Help desk: support tickets and chat.
• Analytics and advertising (including our advertising partners TikTok and Meta, for Facebook and Instagram): device and visit data only, and only as section 6 describes, never children's details.
• Analytics and session replay (Microsoft Clarity): how visitors use our public pages, with everything typed or shown on the page masked, and only after you accept analytics cookies (section 6).

We may also share information if the law requires it, to protect someone's safety, to prevent fraud, or as part of a sale or transfer of our business, in which case this policy continues to apply.

Partner keepsake sites. When you click a link to a partner, the partner and its affiliate network know you came from us so we can earn a commission. We never send your child's name or details to partners, and we never put them in partner links. If you type information into a partner's site, that partner's privacy policy applies.

We do not sell personal information, and we never share children's information for advertising.

5.How long we keep information

• Your child's details (first name, pronunciation, age range, happy details, Christmas list and notes): deleted 60 days after your last item is delivered, or sooner on request.
• Files made for your child (letter PDF, MP3, video): deleted at the same time, 60 days after delivery. Please download anything you want to keep.
• Call logistics: kept for 60 days after the call.
• Consent records and do-not-call requests: kept for 5 years, without your child's details, so we can show we had permission to call and keep honoring requests not to call.
• Order and payment records: kept as long as tax and accounting rules require (generally 7 years), without your child's details.
• Support conversations: kept for 12 months, with any child details removed after 60 days.
• Saved cards: removed from Stripe on January 31, 2027, or sooner if you ask.
• Backups are overwritten on a rolling basis within 30 days.

6.Cookies, pixels and analytics

• Essential cookies run checkout, keep you signed in to the help center and protect against fraud. These are always on. They include fld, a strictly necessary abuse-control cookie set when you ask for a free letter: it holds a random device id (nothing about you or your child) so each device gets one free letter, and it expires after 400 days.
• Cloudflare Turnstile is a strictly necessary security check on the free letter form that stops bots and abuse. It loads from challenges.cloudflare.com and reads technical signals from your browser and device to tell people from bots. It sets no cookies, or only minimal ones needed for that check, and Cloudflare does not use it for advertising. See Cloudflare's privacy policy.
• Analytics help us understand how our pages perform. We use Microsoft Clarity, an analytics and session replay tool, which records clicks, taps, scrolling and mouse movement on our public pages so we can see where a page is confusing, and builds heatmaps from them. Clarity is set to mask all text and everything typed into forms, so it never sees your child's name or details, your name or your email. We never send it your identity or any personal tags. It loads only after you accept analytics cookies, and never on the free letter form. Microsoft processes this data as described in the Microsoft Privacy Statement.
• Advertising tags help us measure whether our ads work and show our ads to people who visited the Site. Our advertising partners are Google, Microsoft, TikTok and Meta (Facebook and Instagram).

Analytics and advertising tags load only after you agree in our cookie banner, and you can change your choice at any time with the cookie settings link. We also honor a Global Privacy Control (GPC) signal as a request to opt out of targeted advertising and "sharing" for that browser.

Do Not Track. We honor it. If your browser sends a Do Not Track or GPC signal, our advertising pixels (Google Ads, TikTok and Meta) do not load in that browser, even if you accepted advertising cookies, and we don't send your email, IP address, browser details or ad cookies to advertising partners for your visit or order. If you arrived from an ad and then buy, the partner is told only that a sale happened (the ad click id, order value and time, with no personal details) so we can count the ad, and a free letter signup is not reported at all. GPC also turns off analytics; Do Not Track on its own does not change other analytics, but Microsoft Clarity session replay does not load under GPC or Do Not Track.

7.Children's privacy

• A Little Santa Magic is for grown-ups. We don't knowingly collect personal information directly from children under 13 through our website, forms or support assistant. If we learn a child has contacted us directly, we delete that information.
• Information about a child comes from the parent or family member who orders. We treat it as sensitive: we collect the minimum, use it only for the order, protect it and delete it on schedule.
• The Santa call: your child hears Santa and may talk to him. What your child says is processed only in real time so Santa can reply, and nothing is recorded or kept. Santa is instructed never to ask for personal information like last names, addresses or schools.
• Calls on a grandparent's or other family member's order happen only after the child's parent confirms by email.
• Parents' rights: a parent or guardian can review the child's details we hold, ask us to delete them and stop any further use, by emailing help@alittlesantamagic.com or using "Delete my child's details" on the Santa page. If details are deleted before delivery, we can't complete the order, and we refund anything not yet made.

8.Security

We use encryption in transit, access controls, and private, hard-to-guess links marked so search engines don't list them. No system is perfectly secure, so please keep your Santa page link private. If we learn of a security incident affecting your information, we'll notify you as the law requires.

9.Your privacy rights

Everyone. You can ask us to access, correct or delete your information, or your child's details, at any time by emailing help@alittlesantamagic.com. We verify requests through the email on the order, respond within 30 days and won't treat you differently for asking.

State privacy rights. Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws), you may have the right to:

• know what personal information we collect and how we use and disclose it;
• access and get a copy of it;
• correct it;
• delete it;
• opt out of the sale of personal information, targeted advertising or "sharing" for cross-context behavioral advertising (we don't sell; use cookie settings or GPC to opt out of the rest);
• limit the use of sensitive personal information (we use it only to provide what you asked for); and
• appeal our decision on your request by replying to our response with "Appeal".

You can use an authorized agent; we may ask the agent for proof of permission.

California. We collect these categories of personal information: identifiers (name, email, phone, IP address); commercial information (orders); internet activity (site use); limited payment information; and information about a child provided by the parent. Sources: you, your device and our service providers. Purposes: those in section 3. We disclose these categories to the service providers in section 4. We do not sell personal information. With your cookie consent, we may "share" identifiers and internet activity with advertising partners; you can opt out as described above. We do not sell or share the personal information of consumers we know are under 16. We keep information as described in section 5. We don't disclose personal information to third parties for their own direct marketing.

Nevada. We do not sell covered information as defined in Nevada law. You may still send a request to opt out of any future sale to help@alittlesantamagic.com.

10.Emails and texts

• Order emails (receipts, delivery links, call reminders) are part of your order.
• Marketing emails go to the grown-up buyer only, never to a parent address a grandparent gave us. Each one includes a one-click unsubscribe, and we honor it promptly.
• Free letter signups are added to our email list (through Klaviyo) to receive Santa updates and offers, as the form says. Unsubscribe any time.
• Text messages (SMS): if you tick the texting box and give us your mobile number, we send recurring automated marketing texts with reminders and offers from A Little Santa Magic, through our texting provider Klaviyo. Consent is not a condition of any purchase or of getting the free letter. Message frequency varies, up to 4 messages a month. Message and data rates may apply. Reply STOP to cancel at any time, or HELP for help, or email help@alittlesantamagic.com. We keep a record of your texting consent (the words you agreed to, when, and from which page and IP address).
• We do not sell, rent or share your mobile number or texting consent with third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data and consent are never shared with any third party, except the texting provider that sends our messages for us. Texts never include your child's details.

11.Changes to this policy

We'll post any changes here and update the date at the top. If we make a material change to how we use children's details, we'll ask for your consent first.

12.Contact us

A Little Santa Magic, operated by Traffic Kings Holding Co.
7500 W Lake Mead Blvd #9-463, Las Vegas, NV 89128
help@alittlesantamagic.com