Privacy Policy

We take the protection of your personal data seriously and process it only in accordance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act (TKG 2021). This policy explains what we collect when you use santapixy.com (“SantaPixy”), why, and what rights you have.

1. Controller

The controller for your data is the operator of SantaPixy, reachable at [email protected]. We have not appointed a data protection officer, as this is not required for us; please send any privacy request to the email address above.

2. What we process and why

Visiting the website

Technical data your browser sends (IP address, date/time, page, browser type). Needed to deliver the site and keep it secure, e.g. against abuse and attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our server keeps these logs only briefly on a rolling basis (normally a few days).

Visitor statistics

When you open the site we register one anonymous visit per day (country, device type, referring website, page) to see how the shop is found. To improve the shop we also count anonymous steps such as “template viewed”, “checkout started” or “video downloaded”, each stored only with the page, the template, your country and device type (mobile/desktop). These statistics contain no IP address, no cookie or device ID, no account and no names or messages, so they can’t be linked to you; they are deleted after 13 months. Legal basis: legitimate interest (Art. 6(1)(f)).

Your account

Your email address, sign-in codes (stored only as an irreversible hash, valid 10 minutes) and login sessions. Legal basis: contract (Art. 6(1)(b)).

Creating videos

The name or message you enter, the chosen template and the finished video. Legal basis: contract (Art. 6(1)(b)).

Safety check of custom messages

Custom messages are automatically checked for harmful content (word list and AI classifier) before a credit is used. Rejected messages are kept for up to 180 days so we can improve the filter and prevent abuse. Legal basis: legitimate interest (Art. 6(1)(f)).

Payments

Amount, currency, tax, payment status and your billing country. Card data is entered directly with our payment provider Stripe — we never see or store it. Legal basis: contract (Art. 6(1)(b)) and legal retention duties (Art. 6(1)(c)).

Emails

Sign-in codes, purchase confirmations and “your video is ready” messages. We send no newsletters or advertising. Legal basis: contract (Art. 6(1)(b)).

Fraud & abuse prevention

Rate limits and, for payment disputes, an internal note on your account. Legal basis: legitimate interest (Art. 6(1)(f)).

3. Names and messages about other people

Videos usually contain the first name of the person you send them to. Please only enter first names or nicknames, no further personal details, and only share a video with people you know. Do not enter sensitive information (health, religion, etc.) in custom messages.

4. Recipients and service providers

We use carefully selected providers who process data on our behalf under data processing agreements (Art. 28 GDPR):

• Hetzner Online GmbH, Germany — server hosting (all our data is stored in Germany).
• Cloudflare, Inc., USA — content delivery and protection against attacks; processes connection data such as IP addresses.
• Stripe Payments Europe, Ltd., Ireland (with Stripe, Inc., USA) — payment processing and tax calculation. Stripe is also an independent controller for its own legal duties; see stripe.com/privacy.
• Mailtrap (Railsware) — delivery of our emails (your email address and the email content).
• X.AI Corp. (xAI), USA — generation of the videos and the safety check of custom messages. xAI receives the template picture and the name or message to be spoken, but not your email address.

Where data is transferred to the USA, this happens on the basis of the EU–US Data Privacy Framework (where the recipient is certified) or the EU Standard Contractual Clauses (Art. 46 GDPR). We do not sell your data and do not use it for advertising.

5. How long we keep data

• Finished videos: 90 days after creation, then the video file is deleted automatically. Download it if you want to keep it.
• Sign-in codes: deleted after 24 hours. Login sessions: expire after 30 days of inactivity.
• Account data and credit balance: as long as your account exists. Unused credits expire after 3 years.
• Payment and accounting records: 7 years, as required by Austrian tax law (§ 132 BAO).
• Rejected custom messages: 180 days.

6. Cookies and local storage

We use only what is strictly necessary to run the shop (§ 165(3) TKG 2021), so we show a short notice instead of asking for consent: one sign-in cookie that keeps you logged in, and browser storage for things like your unsent draft or that you closed the cookie notice. We use no analytics, advertising or social-media cookies. Fonts are hosted on our own server — no data goes to Google.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 15–21 GDPR). You can delete your account and all your videos at any time in My videos → “Delete my account”, or by writing to us. Payment records we are legally required to keep are retained until the retention period ends.

If you believe we process your data unlawfully, you can lodge a complaint with the Österreichische Datenschutzbehörde, dsb.gv.at.

8. Security

All connections are encrypted (HTTPS). Sign-in codes and session tokens are stored only as hashes, staff access is protected with two-factor authentication and every staff action is logged. Videos are accessible only to you, unless you create a share link yourself.

9. Children

Accounts and purchases are for adults (18+). Parents create videos for their children; we do not knowingly collect data directly from children.

10. Changes

We may update this policy when our service changes. The current version is always available on this page.