PRIVACY POLICY

AI Santa Video Generator - Privacy Policy

We collect as little as we can: your first and last name and e-mail address from the account you sign in with, and what you type while ordering. For the person the video is for we ask only for a first name — please type no more than that, because the box cannot stop you.

1. Who Is Responsible for Your Data

The controller of your personal data is: UPSIDE Dariusz Majewski ul. Św. Jadwigi Śląskiej 27, 43-300 Bielsko-Biała, Poland NIP (Polish tax ID): 5471980532 Questions: contact@aisanta.fun.

2. What We Hold About You, and Why

1. Your first and last name and your e-mail address come from the account you sign in with (Google, or Firebase's e-mail link). Payment information comes from Stripe.

2. Our legal bases:

•Performing the contract (art. 6(1)(b) GDPR): your account, payment, and generating the video.

•Legal obligation (art. 6(1)(c) GDPR): invoices and accounts, kept five years from the end of the year the tax fell due (art. 86 § 1 of the Tax Ordinance).

•Legitimate interest (art. 6(1)(f) GDPR): analytics, fraud prevention, security, and defending against complaints and payment disputes. You can object — see section 6.

3. The Person Your Video Is For

1. We ask for a first name and, optionally, general details such as age or interests. The Terms forbid entering anything identifying, but the box cannot enforce that: whatever you type is stored with your order and sent to our AI providers.

2. It is never used for profiling, analytics or advertising, and goes no further than the providers in section 5.

3. Your video is available from us for 7 days after it is ready — after that you lose access to it, and we delete the video files and the voice recording within 30 days at the latest. What you typed stays in our database for up to 90 days — that is how long we need it to handle a complaint or a payment dispute — and then we delete it for good. Providers hold working copies for a limited period on their own clock. Nothing can be done about a copy already downloaded, or taken from a share link you turned on — sharing is your decision.

4. To have it deleted sooner, write to contact@aisanta.fun.

4. Card Details

Stripe handles the payment. We never see your full card number or security code, and keep only whether the payment succeeded.

5. Who Else Sees Your Data, and Where

1. Three kinds of provider see your data: our hosting provider runs the servers, Stripe takes the payment, and our AI providers turn your message into a voice and a video. The AI providers get the information you typed about the person your video is for, and nothing about you. Each keeps a working copy for a limited period — 7 days at the video renderer.

2. Transfers outside the EEA, and what each rests on:

•Google and Stripe contract with us through their Irish companies. Data can still reach their US parents: Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023).

•Our text-to-speech provider, in the United States: Standard Contractual Clauses (Implementing Decision (EU) 2021/914).

•Our video rendering provider, in Singapore: no adequacy decision; we rely on art. 49(1)(b) and (c) GDPR.

6. Your Rights

1. You can ask us to:

•Give you access to your data and a copy of it (art. 15 GDPR).

•Correct anything inaccurate or incomplete (art. 16 GDPR).

•Erase your data (art. 17 GDPR).

•Restrict what we do with it (art. 18 GDPR).

•Send it to you or to another provider in a machine-readable format (art. 20 GDPR).

•Stop processing based on our legitimate interest, including analytics and fraud prevention (art. 21 GDPR).

•Withdraw consent at any time, without affecting what was lawful before (art. 7(3) GDPR). Analytics consent is in your profile, under Cookie Preferences.

2. Write to contact@aisanta.fun. We answer within one month (art. 12(3) GDPR).

3. You can complain to the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl (art. 77 GDPR).

4. Outside the European Union: we are established in Poland, so the GDPR governs everything we do with your data and the rights above are yours too. If your local law gives you a right we have not listed — under a US state privacy law, PIPEDA or the Australian Privacy Act — write to us and we will honour it. We do not sell personal information, share it for cross-context behavioural advertising, or use it for automated decision-making producing legal or similarly significant effects.

7. Cookies, and What We Keep in Your Browser

1. We set no cookies of our own. The only cookies on our domain are analytics cookies, and only if you consent.

2. Analytics is Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland). IP addresses are anonymised. Data may go to Google LLC in the USA under the EU-US Data Privacy Framework (see section 5).

3. No cookie is stored until you consent in the cookie banner; refuse it or ignore it and Analytics runs in "consent denied" mode. You can change this at any time in your profile, under Cookie Preferences. Legal basis: consent, art. 5(3) of the ePrivacy Directive and art. 6(1)(a) GDPR.

4. We use no advertising or remarketing cookies.

5. We use your browser's local storage instead, without consent, because the Service does not work without it:

•Your order in progress: a session ID, the current step, and the video request ID. We clear these when you sign in. What you typed is also saved on our side — see point 7.

•Your sign-in session, held by Firebase Authentication (Google Ireland Limited) and cleared when you sign out.

•Your language choice.

6. Legal basis for storage in your browser (point 5): art. 5(3) of the ePrivacy Directive (2002/58/EC as amended by 2009/136/EC) — storage strictly necessary for a service you requested. None of it feeds profiling or advertising.

7. We also save your order in progress on our server, so you can finish it after refreshing the page or coming back later. We save what you type and the step you got to. If you are signed in, an order you never pay for is deleted 90 days after your last change to it; if you are not signed in, we delete it after 24 hours. Legal basis: art. 6(1)(b) GDPR — without this we could not complete the order you asked for. We also count how many people did not reach the end, and at which step, but only in aggregate and never tied back to you (art. 5(1)(b) GDPR).

8. Children

1. The Service is intended for adults; we ask you to confirm this before payment.

2. We do not knowingly collect personal information from children. If a child has given us theirs, write to contact@aisanta.fun and we will delete it.

Last updated: August 14, 2026

Version: 1.3