Privacy Policy

Last updated: October 22, 2026

In short: we use your data and your children's data only so Santa can talk with them personally. We don't sell it and we don't use it for advertising. The children's details and the recordings are deleted on December 31st, 2026.

1. Who is responsible for the data

The data controller is MIKETOON STUDIO S.R.L., a company registered in Romania, tax ID (CUI) 48183590, with its registered office at Aleea Călărașilor no. 5, block G, floor 3, apt. 54, Sibiu, Sibiu County, postal code 550344, Romania. For any question about your data, write to us at [email protected].

2. What data we use and why

The order and payment

The name, email, country and billing details you enter on the Stripe payment page. The payment is processed by Stripe. We don't see or keep your card details.

Why: to conclude and perform the contract (Art. 6(1)(b) GDPR).

The invoice

Your name, email, billing address if you give it to us, and the amount and date of the payment.

Why: we are required by law to issue and keep invoices (Art. 6(1)(c) GDPR).

The account and the calls

You sign in to your account with your email and a one-time code sent to it. The account also uses:

• your email address, which you use to sign in;
• the details about the children that you give us (see section 3);
• the call log: date, duration and minutes used;
• the audio recording of every call, its transcript (what Santa and the child said to each other) and a short summary, so Santa can remember next time what they talked about. You can see them in your account too;
• the available minutes and their history (what you bought, what was used in calls).

Why: to perform the contract (Art. 6(1)(b) GDPR).

We don't ask for phone numbers: your child talks with Santa from your account, on any device where you are signed in.

Group offer requests

The name, phone or email, institution, approximate number of children and the message you write in the form for kindergartens, classes and events.

Why: to send you the offer you asked for (Art. 6(1)(b) GDPR). We keep it until the end of the season, December 31st, 2026, unless we become partners.

Messages about your order

We email you only what is strictly about your order: confirmations, reminders, the invoice, the deletion of recordings.

Why: to perform the contract. We don't send advertising messages without your separate consent.

News and offers by email, only with your consent

At checkout there is a separate, unticked box: “I'd like to receive news and offers by email from SantaPicksUp.com and from other services of MIKETOON STUDIO S.R.L. (for example Dedica.ro)”. The order works the same without it. If you tick it, we keep your email, the text you agreed to and the moment you agreed.

Why: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, free of charge, from the unsubscribe link in every email or by writing to us. Withdrawing doesn't affect the order. We don't give your address to other companies.

Ad measurement, only with your consent

If you press Accept in the cookie banner, the TikTok pixel tells us which ad brought you and whether you placed an order. At that moment, after payment, our server also confirms the payment to TikTok (the amount and the ad code), together with your email turned into an irreversible code (hash), so that the payment can be linked to the ad even if the confirmation page didn't load. If you decline, we send nothing to TikTok. Details are in the Cookie Policy.

Why: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time.

Calls from the browser (from your account)

When you talk with Santa from your account page, the browser asks your permission to use the microphone. If you don't allow it, the call doesn't start. Your voice goes from the browser to ElevenLabs, the provider of Santa's voice. The call is recorded, and the recording, transcript and summary appear in your account and are deleted on December 31st. For browser calls we also keep a technical record (the account, the time, the maximum length, which children Santa talked to), so we can deduct the minutes correctly and avoid the family talking on two lines at once. We don't save anything about your microphone or device.

The free test “Call Santa now”

When you start the test on the home page, you enter a child's first name, whether they are a girl or a boy, their age and, if you want, what they like. We use them only so Santa can speak personally for about a minute and a half. We don't link them to your account or payment. The test is for adults: a child can only talk with an adult next to them.

Your voice from the microphone goes directly from the browser to ElevenLabs, the voice provider. The conversation doesn't pass through our servers and we don't record it. The test agent is set not to keep the audio recording and to delete the conversation text within one day at most.

The free test can be used once from the same device and only a few times from the same network, in total, not per day; otherwise it would cost us endless tests. For this, when you press the button we save in your browser a random code (tsm_device) and a counter (tsm_try), and the server keeps only irreversible codes (hash, with a secret key) calculated from that code and from your network (the IP address; for IPv6, only the first half of the address), without a name and without a voice. The codes don't change from one day to the next, so that we recognise you on your next visit, and we delete them after 12 months. To show you whether you still have a free try, the page asks the server when it loads; the server then calculates, from the IP address (and your code, if you already have one), the same kind of irreversible code, only to count, and saves nothing.

After the test, the text of the conversation (what Santa said and what was understood of what you said, as written by ElevenLabs) is kept in your browser (tsm_talk) so you can reread it when you come back. It stays only on your device: we don't send it to us and can't see it. It disappears when you clear the site's data.

For statistics we keep only numbers, without codes, names or voice: how many tests were made per day, how many tries were refused by the limits, whether anyone spoke during the test and for how long.

If you have the DataFast cookie (traffic statistics), we keep its identifier for 7 days, together with the test (the limit codes above stay longer, but without it). If you talked with Santa, we send DataFast an event (“talked with Santa”, with the length of the conversation), so we can see how many visitors end up trying the test. We don't send the child's name or what was said.

To see whether the test helps orders, if after the test you press “Order” or open the payment page from the same browser, we note only the moment on the anonymous row of that test (without a name, voice or other details about you). For this the browser sends the random identifier of the test, the one kept next to your conversation. When you open the payment page, we also send DataFast the “checkout started” event, with the number of children, on the same visitor identifier it receives anyway for revenue statistics.

Why: your consent, ticked before the test, to use the microphone (Art. 6(1)(a) GDPR); counting the tests, our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). You can decline the test with no consequence.

Service security

Technical logs (IP address, time, errors), to prevent abuse and fix technical problems.

Why: our legitimate interest in keeping the service working and safe (Art. 6(1)(f) GDPR).

We don't make automated decisions that produce legal effects on you. Santa's conversation is generated automatically, but it doesn't decide anything about you or your child.

3. Children's data

The service is bought by adults. You give us the children's details, as a parent or guardian, and we use them only so Santa can talk personally with them:

• first name and nickname;
• age;
• a good deed;
• what they could work on;
• what they wished for;
• a few details about the family or something special, if you want.

Don't give us an address, school, health data, religion or other sensitive information. Santa doesn't ask for them either.

During the call, the child's voice and what they say reach the voice and technology providers below, so Santa can answer live. We keep the recording in a private space, accessible only from your account. After we download it, we delete the conversation from the voice provider.

We don't use children's details and voices for advertising and we don't sell them. We direct the service to parents and guardians, and we don't knowingly collect information from a child without a parent's or guardian's consent: by creating the account, ordering and starting a call, you, as the parent or guardian, consent to our collecting and using your child's details and voice as described here. You can ask at any time to see them, delete them or stop any further use, by writing to us.

4. How long we keep it

If you cancel the order, we keep only what is needed for the invoice and the refund.

5. Who we share it with

We work with providers that process the data only on our instructions and only for what is needed:

Besides providers, the data may also be received by:

• our accountant, for invoices;
• the authorities, only when the law requires us to.

6. Transfers outside the EU

Some providers (for example Stripe, ElevenLabs, TikTok and our hosting provider) may also process data outside the European Economic Area, including in the USA. In these cases the transfer is made on the basis of the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission. If you are outside the EU, your data is sent to and processed in the EU and in these countries, in order to provide you with the service.

7. How we protect it

Connections are encrypted (HTTPS). Every user has access only to their own account. The recordings are in a private space, and internal access is limited to those who need it to fix a problem.

8. Your rights

You have the right:

• to find out what data we hold about you and receive a copy;
• to correct it;
• to ask for it to be deleted. You can also delete the account yourself, from your account page;
• to restrict processing;
• to receive the data in an easy-to-use format (portability);
• to object to processing based on our legitimate interest;
• to withdraw your consent at any time, without affecting what was done before.

For any of these, write to us at [email protected]. We'll reply within one month. We apply these rights to everyone, wherever you live.

If you are not satisfied, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro) or with the data protection authority in your own country.

9. Changes

If we change something important in this policy, we'll tell you by email before it applies.