Privacy policy

Who we are

Magical Christmas Post. Email: hello@magicalchristmaspost.com

We are the “controller” of the information described here. In plain words: we decide what is collected and we are responsible for looking after it.

Who this is for

This service is for parents, grandparents and other adults. You must be 18 or over to order. Children never sign in, never give us anything, and never use an account. A page is made for a child by an adult who chooses what goes on it.

What we collect

From you, the person who orders:

• Your name and email address.
• Your password. We never see it. It is turned into a one-way scrambled code (a hash) the moment you choose it, and only that code is stored. It cannot be turned back into your password, not even by us.
• What you paid and when. Your card details are entered on Stripe’s secure page. We never see or store your card number.

About the child, which you choose to give us:

• A first name, an age, and whether the page uses girl or boy colours.
• Fun facts, notes for Santa’s report, the Christmas wish list and a surprise note.
• Photos you upload and the captions you write. This includes the photos of gifts.

Please do not add surnames, addresses, school names or anything you would not want on a card in the post. We do not ask for them and the page does not need them.

If you make a family login: the name you give it (for example “Grandma”), a username we make, and a scrambled password. We also note when it last signed in, so we can tell you.

Automatically: a small cookie so the site knows you are signed in, and your approximate country (worked out from your internet address when you visit) so we show prices in the right currency. See our cookie page.

Why we use it

• To give you what you paid for: building the private page, writing the letter and Santa’s report, emailing you the printable letter, and the reminders on 24 and 26 December. The legal basis is that we need it to carry out our contract with you.
• To keep the service safe: sign-in checks, limiting wrong passwords, and emailing you when a family login is used. The legal basis is our legitimate interest in keeping children’s pages private.
• To meet the law: keeping payment and tax records. The legal basis is a legal obligation.

We do not sell information. We do not use it for advertising, and we do not use the pictures or details to train any AI.

Who else sees it

We use a few trusted companies to run the service. They only get what they need to do their job.

• Stripe takes your payment.
• Anthropic (the makers of the Claude AI) helps write the letter, report and surprise. We send the child’s first name, age, and the facts, notes, gifts and surprise you typed. We do not send photos, your email address or your name. Anthropic’s terms for business customers say they do not use this to train their models.
• Our email service delivers the emails we send you.
• Our web host stores the site and its files.
• Our own authorised staff, only to give you support.

Some of these companies are outside Ireland and the EU. Where that happens we rely on the safeguards the law requires, such as the EU’s standard contract clauses.

We may share information if the law or a court requires it.

Who can see the child’s page

Only people you give a login to. The page is behind a password, is hidden from search engines, and photos are only shown to someone who is signed in. Nobody at Magical Christmas Post can sign in to your page as you, and nobody can read your password or a family password. A family login can only look. It cannot change anything or download the letter. You can switch any family login off at any time, and it stops working straight away.

A small number of authorised staff can open an order in our admin area. They do this only to give you support, for example if you write to us with a problem. They cannot see your password.

Photos have their location and camera details removed before we store them.

How long we keep it

Everything about the child (name, age, facts, notes, photos, captions, the letter, the report and the surprise) is deleted from our servers on 30 January 2027. Family logins are deleted at the same time. The record that you paid (your name, email, the amount and the date) is kept so we can run our accounts and meet tax law. It never contains the child’s details.

We keep encrypted safety copies (backups) of the site so we can recover from a fault. We make one every night and keep only the last 4, so anything deleted, whether on the date above or because you deleted it yourself, is also gone from the backups within 4 days.

Your rights

You can delete everything yourself, at any time. Sign in to your page and use “Delete everything now” at the bottom of the form. It removes the child’s details, the writing, every photo and every family login straight away, and we email you to confirm. You can also ask us to show you what we hold, correct it, or give you a copy. You can also object to how we use it. For anything else, email hello@magicalchristmaspost.com from the address you ordered with. We will answer within one month.

If you are not happy, you can complain to the Data Protection Commission in Ireland (dataprotection.ie) or to the data protection authority in your own country.

Security

Pages and photos are kept behind passwords. Passwords are stored only as one-way hashes, so they cannot be read by anyone, including us. Sign-in is limited so someone cannot keep guessing. Please choose a good password, and share a family login only with people you trust.

Changes

If we change this page in a way that matters, we will update the date at the top. Orders already placed are covered by the version that applied when you ordered.

Contact

Magical Christmas Post. Email: hello@magicalchristmaspost.com