Privacy policy

Last updated: 13 September 2026

In plain terms

To make your kit we need two things: your email, so you can come back to it, and the child’s first name and town, because they are printed on the letter. We do not sell any of it, we do not build advertising profiles from it, and you can delete it yourself at any time from the editor.

Who is responsible

The data controller is Emma Priddey, trading as Santa Letter Studio, of 8 Kinevor Close, Mortehoe, Devon EX34 7EE, United Kingdom. For any privacy question, or to exercise the rights below, email hello@santaletterstudio.com.

What we collect, and why

• Your email address, and first name if you give it. To open the builder, to send you your order and a link back to your kit. Lawful basis: performance of our contract with you.
• The details you type into a kit: the child’s first name, town, age as a word, a kind deed and a hoped-for gift. These are printed on the pieces you buy. Lawful basis: performance of our contract with you.
• Order information: what you bought, the amount, and a Stripe reference. Kept for accounting and tax. Lawful basis: our legal obligation.
• Marketing emails: only if you tick the box. Lawful basis: your consent, which you can withdraw at any time.

We do not ask for a date of birth, a surname, an address, or a photograph, and we do not need them. Payment card details are handled entirely by Stripe and never reach us.

Children’s information

This service is sold to adults. A child is not our customer and does not create an account or use the builder. A parent or guardian enters the child’s first name and town so we can print them on a letter.

We treat that information carefully:

• We ask for the least we can: a first name and a town, nothing more.
• It is never used for marketing, advertising, profiling or analytics.
• It is never sold or shared for anyone else’s purposes.
• It is never written into our activity logs.
• It can be deleted at any moment, by you, from the editor. See “Deleting your kit” below.

How long we keep things

• Your kit: saved to our database as you type, so you can come back to it on any device. A kit you have bought is kept until you delete it. A kit you never bought is deleted automatically 90 days after you last changed it. Deleting is immediate and also destroys every PDF we generated from it.
• Generated PDFs: cached for up to 90 days so you can re-download quickly, then removed automatically. They can be regenerated from your kit at any time.
• Order records: kept as long as tax law requires (currently six years). These hold your email and the amount paid. They do not contain the child’s details, so deleting your kit does not disturb them.
• Your email and first name: kept so you can get back to your kits, until you ask us to delete them.
• Sign-in links: a link works once and expires after 15 minutes, or 7 days for the link in your order confirmation. We store only a scrambled fingerprint of the link and your email address, never the link itself, and delete that record 30 days after the link expires.
• Backups: we keep a daily copy of our database for 14 days so we can recover from a fault. After that, older copies are deleted automatically, so anything you delete is gone from our backups within 14 days.

Deleting your kit

In the editor there is a button marked “Delete this kit and its files”. It removes the kit from your device and from our database, and purges every PDF made from it. Nothing is retained afterwards except the order record described above, and daily backups that expire within 14 days. You can also email hello@santaletterstudio.com and ask us to do it for you.

Who else touches your data

We use a small number of providers, each only for what it does:

• Stripe: payments. They receive your email and payment details, never the child’s details.
• Supabase: our database, stored in London, UK.
• Hostinger: runs the site and the PDF renderer, on a server in the UK.
• Resend: sends your order confirmation and sign-in links, from servers in the EU. It receives your email address, never the child’s details.

Where a provider stores data outside the UK, that transfer relies on an adequacy decision or standard contractual clauses.

Cookies and analytics

We use only what the site needs to work, and nothing for advertising:

• A sign-in cookie (sls_session), so you stay signed in to your kits after buying or following a sign-in link. It lasts up to 90 days, or until you sign out.
• Your browser’s own storage, holding a copy of your kit and the email and first name you entered, so your work is there when you come back.

Visitor statistics: we count visits using Umami, which runs on our own server, so this information is never shared with anyone. It sets no cookies and stores nothing on your device. It records the page viewed, the website that sent you, your browser, operating system, device type, screen size and language, and your approximate location (country, region and city), and a few steps on the site: starting a kit, going to checkout, buying (with the price paid) and downloading. Your IP address is used, together with your browser details, to work out that location and to make a scrambled visitor code that changes every month; the IP address itself is never stored. Page addresses are recorded without anything after the “?”, so sign-in links are never captured, and nothing you type into your kit is ever sent. We use these statistics, on the basis of our legitimate interest in improving the site, to see which pages help people. They are deleted after two years.

Because the cookie and storage above are strictly necessary, and our statistics use neither, we do not ask for cookie consent.

Your rights

You may ask for a copy of your data, correct it, delete it, restrict or object to how we use it, or ask for it in a portable form. Where we rely on consent, you may withdraw it at any time. Email hello@santaletterstudio.com and we will respond within one month.

If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If we change this policy we will update the date above and, for anything significant, tell you by email.

See also our Terms of Sale and Refunds policy.