Privacy Policy

Who We Are & Contact

Santa Wishlist is operated by Tobias, acting as a sole proprietorship (Webbvavaren) based in Sweden. He is responsible for the processing described on this page.

For the purposes of the EU/UK General Data Protection Regulation, Webbvavaren (sole proprietorship, Sweden) is the data controller. As the controller is established in the EU, no Article 27 representative is required. A full postal address is provided on request by email.

We have not appointed a Data Protection Officer, as the scale and nature of the processing does not require one.

If you have any questions or requests regarding privacy, you can reach us at:

webbvavaren@gmail.com

Information We Process

We handle the following types of information:

• The wishlist text and the child's first name: Entered by the child to display the letter on the screen during the story. The first name is also included in the email copy if one is requested.
• Parent or guardian's email address: Collected solely when requested in the final step to send a copy of the wishlist.
• Technical request data: Standard information sent by web browsers (e.g., IP address, browser type, approximate country level). This may be processed by our infrastructure providers to serve the page and prevent abuse.
• Language preference: Saved locally in your own browser so the page opens in your selected language next time.

Children's Privacy (COPPA)

Santa Wishlist is a service designed to be used by children as an entertainment experience, with a parent or guardian generally expected to be involved. Because of this, we have designed the service with COPPA's requirements and children's privacy principles in mind.

• We do not create user accounts, profiles, or persistent identifiers for children.
• The wishlist text and the child's first name are processed only in memory to display the story and are never stored in our database.
• We do not use any information entered by the child to contact the child, market to the child, or build any profile about the child.
• We do not knowingly permit a child to submit contact information (such as an email address) — this step is restricted to a parent or legal guardian who is 18 years of age or older and who affirmatively confirms this status before proceeding.
• If you are a parent or guardian and believe your child has provided us with information beyond what is described here, please contact us immediately at webbvavaren@gmail.com and we will investigate and delete it to the extent technically possible.

Temporary Processing, Storage, and Statistics

It is important to distinguish between how data is handled across these three categories:

• Processed temporarily in memory: The wishlist text, child's first name, email address, and technical request data are processed only in memory while handling your request and are immediately discarded.
• Stored by us: Only aggregate counters. We do not store the wishlist text, child's name, or email address in our database.
• Aggregated statistics: Anonymized counters generated during analysis, engineered so they cannot be linked back to an individual child, letter, or user.

How the Wishlist Is Handled

When the letter reaches Santa in the story, the text is sent once to our server to be analyzed in memory.

The original text is never saved to our database or trend system; it exists temporarily for processing and is immediately discarded once completed. Our server application is not configured to log the text.

The analysis compares the text against a fixed list of known categories, products, and brands. Only structured matches from this list are saved as aggregate statistics. Unclear wishes are grouped into broad categories or ignored entirely.

Aggregated Trend Statistics

Based on structured matches, the system builds anonymous aggregate counters, including:

• Product categories, products, and brands
• Language of the letter
• Country (country-level only)
• Total letters processed per day and total letters with at least one match

What the Statistics Do NOT Contain

The statistics contain no names, email addresses, IP addresses, letter IDs, or session IDs. They are strictly aggregate metrics used to understand general Christmas wish trends.

Email Functionality

Entering an email address in the final step is completely voluntary; the story works fully without it.

The address must be entered by a parent or legal guardian aged 18 or over, who confirms this before sending. It is collected for a single, one-time transmission of the wishlist copy, which corresponds to the one-time contact exception under COPPA, and it is never used to contact the child.

We do not send newsletters, marketing materials, or follow-ups. We do not sell or rent email addresses.

We do not retain the email address in our database. The address and letter content are handed over to our email dispatch provider solely to deliver the message; that provider may keep short-lived technical delivery logs and may operate servers outside the EU/EEA, including in the United States.

The email from Santa Wishlist is a one-time copy. However, if the parent or guardian uses the recovery link inside the email to import the wishlist into wishlist4.com, the wishlist content is then sent to and may be stored persistently on wishlist4.com's servers under wishlist4.com's own storage policy: three (3) months from the latest access of the link, with an automatic extension of three (3) additional months each time the link is opened.

A parent or guardian may ask us to confirm deletion of anything connected to that email at any time by writing to webbvavaren@gmail.com.

Security & Abuse Prevention

To prevent automated abuse (such as bot attacks), technical request data is processed temporarily in memory on the server. This includes the IP address, which is an item of personal data under GDPR.

The IP address is never stored in plain form. It is combined with the approximate country and converted into a daily rotating, one-way hashed value that is used only to rate-limit requests from a single source, and it expires automatically. IP addresses are never linked to trend statistics, to a letter, or to an email address.

The approximate country derived from the network request (country level only, never city or precise location) is also used as a dimension in the anonymous trend statistics.

Local Storage & Share Links

Local Storage: The wishlist text is stored locally in your browser's localStorage so you can view it on /min-lista. This data remains on your device and is never sent to our database for storage. You can delete it at any time using the "Clear" button or by clearing browser data.

Share Links: If you generate a shareable link, the wishlist text is encoded within the URL itself. The link is not password protected and is not secret, so anyone who receives or forwards it, and anyone who can see it in a chat history, browser history or server log of the app you share it through, can read the wishlist. Share it only with people you trust, and avoid including sensitive information in the letter. The share-link feature is handled entirely within the browser; no wishlist content is transmitted to our server when a share link is created.

Email Backup Is Different: The optional email-backup feature sends the wishlist content to our server only to render and deliver the one-time email. If the recipient later imports the wishlist into wishlist4.com through the recovery link, the content is then sent to and may be stored on wishlist4.com's servers.

We cannot recall or deactivate a share link once it has been distributed, because the content lives in the link and not on our servers.

Service Providers

We rely on a minimal set of third-party service providers to deliver the service. They act as processors on our behalf and are bound by data processing terms:

• Lovable (lovable.dev): Hosts the website, executes server code, and provides backend functionality. Lovable also receives automatic technical error reports from the site (error message, technical stack details and the page path where the error occurred) so that faults can be fixed. These reports are not used to identify visitors.
• Supabase: Database technology behind the backend where aggregate counters are stored.
• Lovable Email Service: Used exclusively to deliver the one-time wishlist copy email; it processes the recipient address and message content for delivery and short-lived delivery logs.
• Cloudflare: Content delivery network (CDN) that serves the site, provides country-level routing and protects against attacks; it processes IP addresses as part of standard infrastructure logging.
• Some of these providers may process infrastructure logs or server requests outside your country of residence, including in the United States and the European Union, solely to operate the underlying hosting and delivery infrastructure. See "International Data Transfers" below.

Why We Process Data

We process data described above for the following purposes:

• Providing the story and displaying the letter: To deliver the interactive experience you've requested (data processed temporarily only).
• Sending an email copy: Based on the affirmative action and confirmation of a parent or guardian who enters their email address.
• Aggregated trend analysis: To understand general wish trends, applied with strict data minimization (original text is discarded instantly).
• Security & maintenance: To maintain website security and prevent abuse.

Legal Bases for Processing (EEA/UK)

For users in the EEA and the UK, we rely on the following legal bases under Article 6(1) GDPR:

• Performance of a service you request, Article 6(1)(b): displaying the story and the letter on screen, and sending the one-time email copy that a parent or guardian actively requests.
• Legitimate interests, Article 6(1)(f): protecting the service against automated abuse (temporary, in-memory processing of technical request data including IP address) and producing anonymous aggregate wish statistics with strict data minimisation. Our interest is keeping a free service available and understanding general gift trends; the impact on individuals is minimal because no identifiable data is retained.
• Legal obligation, Article 6(1)(c): where we must respond to a lawful request from a competent authority.
• You may object at any time to processing based on legitimate interests by contacting webbvavaren@gmail.com.

Retention Periods

We keep personal data for the shortest time technically possible:

• Wishlist text and the child's first name: processed in memory only during the request and discarded immediately, never written to our database.
• Parent/guardian email address: processed only for the one-time delivery and not stored by us. Our email provider may retain delivery logs for a short technical period on our behalf.
• Technical request data and rate-limiting values: kept in memory or as a short-lived, rotating hashed value for abuse prevention, typically for no more than 24 hours.
• Aggregate statistics: retained indefinitely, but they are anonymous counters that cannot be linked back to any individual.
• Data stored in your own browser (localStorage): remains until you clear it; we have no access to it.

International Data Transfers

We are established in Sweden, but some of our providers process data outside the EU/EEA, including in the United States.

Where that happens, transfers are made under an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework) or under the European Commission's Standard Contractual Clauses, combined with technical measures such as encryption in transit and the fact that we do not transfer wishlist text, names or email addresses for storage.

You may request further information about the safeguards in place by emailing webbvavaren@gmail.com.

Your Rights

Because we do not store wishlist text, names, or email addresses in our database, we generally do not hold any identifiable personal data about you or your child after a session ends.

Access, Correction & Deletion: You may contact us to ask whether we hold any identifiable data linked to you. In most cases, our response will be that we possess none, since data is discarded immediately after processing.

EEA/UK Residents (GDPR): You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and the right to object to processing based on legitimate interests (Article 21). Because we retain no identifiable data, these requests will usually be answered by confirming that no such data exists. We aim to respond within one month and never charge for a first request.

California Residents (CCPA/CPRA): If you are a California resident, you have the right to know, delete, and correct personal information we may hold about you. Given our minimal data retention, we generally have no personal information to provide, delete, or correct beyond a brief, one-time processing window. We do not sell or share personal information as those terms are defined under California law.

Complaints: You may contact the Federal Trade Commission (reportfraud.ftc.gov) or your state Attorney General's office with any privacy concerns. If you are in the EEA or the UK you may lodge a complaint with your local supervisory authority, for example the Swedish Authority for Privacy Protection (IMY, imy.se) or the UK ICO (ico.org.uk).

Affiliate Links & Third-Party Sites

The child-facing portion of wishlist4santa.com contains no commercial links, ads, or affiliate links.

Emails sent to parents/guardians may include links to our adult-oriented partner site, wishlist4.com, which features gift ideas and merchant links. Some of these merchant links are affiliate links (meaning wishlist4.com may receive a commission if a purchase is made).

No child's name is transferred to wishlist4.com when a wishlist is imported through the email recovery link. The recipient-name field is always cleared during import.

When following links to external online stores, those stores act as independent entities with their own privacy policies and cookie practices. We never receive your name, address, or payment details from these merchants.

Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be indicated by updating the "Last updated" date at the top of this page.

Contact Us

For privacy inquiries or to exercise your rights, please contact:

webbvavaren@gmail.com