Privacy policy
Last updated: October 20, 2026
Santa Said It (“we”, “us”) is a product of Zoey OS, LLC. We make personalized videos from details you type in. This policy explains what we collect, why, who helps us, and when we delete it. The short version: we collect only what the video needs, we never ask for photos of children, and we delete the personal details 30 days after delivery.
What we collect
- About the recipient (typed by you): a first name, an optional pronunciation, an age (Nice List only), three short details, a “from” name and, for roasts, a roast level.
- About you: your email address, and whether you ticked the optional updates box.
- Payment: handled by our payment provider, Polar. We never see or store your card number. We receive an order id, the amount, and your email.
- Usage: anonymous funnel events (for example “script generated” or “video ready”) without names, details or emails, and basic server logs (IP address and request path) kept for security and rate limiting.
We do not ask for or accept photos, last names, schools, addresses or anything else about a child.
Children’s information
Santa Said It is used by adults. A parent or other adult types a child’s first name, age and details; children do not use the service themselves and we do not knowingly collect information directly from children. If you believe a child has given us information, write to privacy@santasaidit.com and we’ll delete it.
How we use it
- To write the script and make the video, card and certificate you ordered.
- To email you your receipt and your video link.
- To keep the service safe (rate limits, fraud and abuse checks, content filtering).
- If you opted in: an occasional email about new characters or holiday deals. You can unsubscribe at any time.
We don’t sell personal information and we don’t use it for advertising profiles.
Who helps us (processors)
- OpenAI writes the draft script from the details you give us (API, not used to train their models under their API terms).
- Our video provider (fal.ai) turns the approved script into the video. It receives the script, not your email.
- Polar processes payments as merchant of record.
- Resend sends our emails.
- PostHog receives anonymous funnel events (no names, details or emails).
- Cloudflare serves the website and stores the finished videos privately.
- DigitalOcean hosts our server and the order database.
When we delete it
- 30 days after delivery: we delete the recipient’s name and details, the script, and your email address. Our daily cleanup job does this automatically.
- Unfinished drafts (never paid for) are deleted after 7 days.
- The video, share link and QR code stay live for one year after delivery so the gift keeps working, then the video file is deleted. The video itself contains the spoken name; download the MP4 if you want to keep it longer.
- Payment records are kept by Polar as required for tax and accounting.
Want it gone sooner? Email privacy@santasaidit.com from the address you ordered with and we’ll delete your order and video.
Who can see a video
Each video lives at a long, unguessable link. Anyone you share the link or QR code with can watch it. We don’t list videos publicly or index them in search engines.
Your rights
Depending on where you live (for example California or the EU/UK), you can ask to access, correct or delete your information, or object to processing. Email privacy@santasaidit.com; we answer within 30 days.
Contact
Zoey OS, LLC · 7901 4th St N, STE 300, St. Petersburg, FL 33702 · privacy@santasaidit.com