Privacy Policy

1. Who We Are

SantaBook is operated by SantaBook LLC, located in Christmas, FL 32820, United States. SantaBook is a booking and payments service for professional Santa portrayers: portrayers publish a booking page, and families and event hosts use it to request, confirm, and pay for an appearance.

This policy covers santabook.app and the information collected when you book through a portrayer's SantaBook page. Portrayers who hold a SantaBook account should also read the Service Privacy Policy, which covers the data inside the app.

For privacy-related questions, contact us at mark@santabook.app.

2. What We Collect

When you book an appearance

• Contact details: your name, email address, and mailing or event address, so the portrayer can confirm and deliver the appearance.
• Event details: the date, time, location, and any notes you add about the visit.
• Payment: handled by Stripe. Card numbers go directly to Stripe and are never seen or stored by SantaBook. We keep the amount, date, and payment status.
• Mobile number: only if you choose to opt in to text messages about your appearance. See section 9.

When you use forms on santabook.app

• Contact form: your name, email address, and message.
• Free business checkup: your name, email address, and the business details you choose to enter.
• Early access list and referrals: your email address, name, an optional phone number, and a referral code stored in your browser's localStorage (key: santabook_referral_code). That code never leaves your device except as part of your signup.

Automatically

• Aggregate, cookieless page view and event counts through our self-hosted analytics.
• Server logs (request paths, timestamps, status codes, approximate location from IP) retained up to 90 days for security and diagnostics.

We do not collect sensitive personal data, and we do not collect any information about children beyond what an adult enters in a booking note.

3. How We Use Your Data

We use the information you provide to:

• Deliver the appearance you booked: pass your request to the portrayer, confirm it, and send reminders and schedule changes.
• Process payments through Stripe and keep the records tax law requires.
• Send transactional text messages about your appearance, only if you opted in.
• Respond to contact form and business checkup submissions.
• Run the early access list and track referral credits as described in our Terms of Service.
• Keep the site and service secure and diagnose problems.

We will not sell, rent, or share your personal data with third parties for their marketing purposes.

4. Third-Party Services

Stripe (Payments)

Payments made through a SantaBook booking page run through Stripe, Inc. Card details go directly to Stripe under PCI DSS; SantaBook never sees the full card number. See Stripe's Privacy Policy.

Twilio (Text Messaging)

Text messages about your appearance are delivered through Twilio, Inc. Your mobile number and the message body are transmitted to Twilio for delivery only. Twilio does not use them for its own marketing. See Twilio's Privacy Notice.

Mailgun (Email Delivery)

We use Mailgun (by Sinch) to deliver booking confirmations and other transactional email. Mailgun acts as a data processor on our behalf and may store your email address on servers in the United States and European Union. See Mailgun's Privacy Policy.

Umami Analytics (Cookieless)

We use Umami, a self-hosted, cookieless analytics platform. It does not use cookies, does not track individuals across sessions, and shares nothing with any third party. It records aggregate page views and event counts only. Our instance is hosted at analytics.santabook.app.

Google Fonts

Our site loads fonts (Playfair Display, DM Sans, JetBrains Mono) from Google Fonts. When your browser requests these font files, Google receives your IP address. This is governed by Google's Privacy Policy. We do not control this data transfer.

Browser localStorage

If you arrive through a referral link we store a referral code in your browser's localStorage. It stays on your device, is used only to associate a signup with a referral, and can be cleared at any time through your browser settings.

5. Data Retention

• Booking and payment records are kept for as long as the portrayer needs them to run their business, and invoice and payment records for up to 7 years to satisfy tax law.
• Text message consent records (the number, the date and time, and the page where you opted in) are kept for as long as you remain opted in and for 4 years afterward, as telemarketing law requires.
• Contact form and business checkup submissions are kept for up to 24 months.
• Early access list entries are kept until you unsubscribe or request deletion.
• Backups are encrypted and expire on a 35-day rolling window.

6. Your Rights

Depending on your location, you may have the following rights:

• GDPR (EU/EEA/UK residents): Right to access, rectify, erase, restrict processing, data portability, and object to processing.
• CCPA (California residents): Right to know what personal information is collected, right to delete, right to opt out of sale (we do not sell data), and right to non-discrimination.

To exercise any of these rights, email us at mark@santabook.app. We will respond within 30 days. Because your booking record also belongs to the portrayer you hired, we may need to coordinate with them to complete a deletion.

7. Children's Privacy (COPPA)

SantaBook is not directed to children under 13 years of age, and only adults may book an appearance. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at mark@santabook.app and we will delete it promptly.

Where a portrayer records a child's details inside the service (for example a gift list for a personalized letter), that is covered by our Children's Privacy Policy.

8. Data Security & Breach Notification

We implement reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS), access controls, hashed credentials, and encrypted backups. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant authorities as required by applicable law, without undue delay and generally within 72 hours of becoming aware of the breach.

9. Text Messaging

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Mobile phone numbers collected for text messaging are used solely by SantaBook LLC and the individual Santa portrayer you booked with, to send you messages about your appearance. Message frequency varies. Message and data rates may apply. Reply STOP to opt out, or HELP for help.

You opt in to appearance text messages in one of two ways: by ticking the consent checkbox on a Santa portrayer's public booking page, or by submitting our dedicated opt-in page at app.santabook.app/opt-in. That box is never ticked for you, and consent is not required to book. We record the date, time, and page of each opt-in. To stop messages, reply STOP to any message; to get help, reply HELP or contact support@santabook.app.

10. International Transfers

We are based in the United States. If you are visiting from the EU, EEA, UK, or other regions with laws governing data collection and use, your information will be transferred to the United States, where data protection laws may differ from your jurisdiction. By using this site or booking through SantaBook, you consent to such transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post a notice on this page with an updated effective date, and notify account holders and early access list members by email. Continued use of our site or service after changes become effective constitutes your acceptance of the revised policy.

12. Contact

For questions, concerns, or requests regarding this Privacy Policy, contact: