Privacy Policy

Who is responsible

Santa Wishlist is run by Tobias, operating as a sole proprietorship (Webbvavaren) in Sweden. He is the controller for the processing described on this page.

You can reach us at webbvavaren@gmail.com.

What information is handled

• The wishlist text and the first name the child types, used to show the letter in the story on the screen.
• The child's first name also appears in the email copy when a copy is requested, because it is part of the letter itself.
• A parent's or guardian's email address, only when a copy of the wishlist is requested at the last step.
• Technical information that your browser sends to any website, such as IP address, browser type and an approximate country. This may be processed by our technical providers to deliver the site and to protect it against automated abuse.
• Your chosen language, kept in your own browser so the site opens in the same language next time.

Temporary handling, storage and statistics

It matters which of these three a piece of information belongs to:

• Handled temporarily: the wishlist text, the child's first name, the email address and technical information from the request. These are used to make the service work at that moment and are then released.
• Actually stored by Santa Wishlist: aggregated counters only. We do not store the wishlist text, the child's name or the email address in our own database.
• Aggregated statistics: counters built from the analysis, designed so that they are not connectable to a single letter or child.

The wishlist

When the letter reaches Santa in the story, the wishlist text can be sent once to our server so it can be analysed automatically. The analysis does not happen in your browser — the text is sent to the server for that moment.

The original text is not saved in Santa Wishlist's database, is not written to the trend database, is used only temporarily for the analysis, and is released when the analysis is finished. Our application is not written to log the text.

The analysis compares the text against a fixed list of known categories, products and brands, and only matches from that list are kept. If a wish is unclear, it is recorded as a broad category only, or ignored.

Aggregated trend statistics

From those matches the system can build aggregated counters, for example:

• Product category.
• Product.
• Brand.
• The language the letter was written in.
• Country, at country level only.
• The number of letters per day.
• The number of letters where at least one match was found.

What the statistics do not contain

The original letter is not stored together with the statistics. The trend statistics contain no names, email addresses, IP addresses, letter IDs or session IDs.

The statistics are designed so that they cannot be linked to a single letter or a single child. They are indicative aggregates used to understand general trends — nothing more.

Security and protection against abuse

To prevent automated abuse, technical information from the request can be processed temporarily on the server, for example to limit how many letters are accepted from the same source during a day. This happens while the request is being handled.

The IP address is not stored in the trend statistics, and the trend data contains no identifier pointing back to a visitor.

The email function

At the last step a parent or guardian can voluntarily enter an email address to receive a copy of the wishlist. It is optional, and the story works without it.

The address is needed for one single purpose: to deliver that one message. The email contains the wishlist text and the first name written in the letter.

The email address is not used as an identifier in the trend statistics and is not connected to it in any way. We do not send newsletters, advertising or reminders, and we do not sell or share addresses.

Santa Wishlist does not store the address in its own database. The address and the letter are passed to the email service that delivers the message. That service keeps its own delivery records under its own rules; we cannot verify an exact retention period for them and therefore do not state one here.

Providers

Only providers that are actually used are listed here:

• Lovable (lovable.dev) — hosts the website, runs our server code and provides the backend.
• Supabase — the database technology behind that backend, where the aggregated counters are stored.
• Lovable's email service — used only to deliver the single copy email when one is requested.
• Cloudflare — delivers the site to your browser and provides an approximate country code.

About the providers

We do not claim to have a signed data processing agreement with a provider unless that has been verified, and we do not state a retention period for a provider's own logs when we cannot verify it.

Purposes and legal bases

• To show the letter and run the story: our legitimate interest in delivering the function the visitor asked for. The text is only handled temporarily.
• To send a copy of the wishlist by email: consent, given by the parent or guardian who enters the address and confirms the checkbox.
• To analyse the letter and build aggregated counters: our legitimate interest in understanding what children generally wish for, applied with data minimisation — the text is not stored and the result contains no personal data.
• To keep the site running and prevent automated abuse: our legitimate interest in security and stable operation.

Children

• Santa Wishlist is designed as a Christmas activity for children. No account is created for the child, and we never ask a child for an email address of their own.
• The email function is intended to be used by a parent or guardian, who confirms this with a checkbox before a copy is sent.
• The trend statistics do not store the child's identity or the original letter.
• If a child has entered an email address without permission, write to us and we will help as far as we can.

Storage

• Handled temporarily and then released: the wishlist text and the child's first name on the server during the analysis, and technical information used for abuse protection.
• Kept in your own browser: your language choice, and the letter while you are playing. The letter disappears when you close or reload the page.
• Stored by Santa Wishlist: aggregated counters. They are kept without a set time limit because they contain no personal data.
• Stored by providers: hosting, network and email providers keep their own technical and delivery logs under their own rules. We have not verified an exact retention period for those logs and therefore do not state one here.

Your rights under GDPR

Which rights apply depends on the legal basis and on whether we actually hold any information about you. Because the letter, the name and the email address are not stored in our own database, and the statistics contain no personal data, there is often nothing we can find that is linked to you — and then we cannot correct or delete it either.

• Access: you can ask what information we hold about you. In most cases the answer will be that we hold nothing that can be linked to you.
• Rectification: applies to information we actually hold about you.
• Erasure: applies to information we hold. It does not apply to the aggregated statistics, because they are not personal data.
• Restriction and objection: you can object to processing based on legitimate interest, and we then assess whether the processing can continue.
• Data portability: applies to information you have provided where the processing is based on consent or a contract, and only where we still hold it in a structured form.
• Withdrawing consent: applies to the email function. Consent can be withdrawn for future sends, but an email that has already been delivered cannot be recalled.
• Complaint: you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or to the data protection authority in your own country.

Contact

Questions about privacy, and requests concerning your rights, can be sent to webbvavaren@gmail.com. We answer as quickly as we can, and at the latest within one month.