Privacy Policy

Introduction

This Privacy Policy explains what personal data SantaPhoto (https://santaphoto.app) collects when you use our AI Christmas photo, card and profile picture generator, why we collect it, who processes it for us, and how you can have it deleted. SantaPhoto is run by an individual operator. We do not sell your personal data.

Information We Collect

1. Account information — you sign in with Google, which gives us your name, email address and profile picture. We never see or store a password.
2. Photos and text you submit — the photos you upload, the extra details or card greetings you type, and the images we generate for you.
3. Purchase records — the credit pack you bought, its price, the date and the payment status. Card details go directly to our payment processor; we never see or store them.
4. Support messages — what you send us through the support form or by email.
5. Usage and device data — pages visited, referring site, browser and device type, collected as aggregate statistics (see Analytics below).
6. Cookies — see Cookies below.

How We Use Your Information

• To create the photos, cards and profile pictures you ask for, and show them to you in My Creations.
• To run your account, credits and purchases, including automatic credit refunds when a generation fails.
• To screen typed text for content that payment networks do not allow in AI-generated images.
• To answer support requests.
• To understand which pages and campaigns bring visitors, and to detect and prevent fraud and abuse.

We do not use your photos, text or generated images to train AI models, and we do not publish them.

Photos You Upload

• Who may appear: yourself, adults who agreed to it, children you are the parent or legal guardian of, and your pets. Do not upload photos of other people's children or of public figures.
• How they are used: only to generate the images you ask for. Each photo is processed by the image model that renders your request, OpenAI GPT Image or Google Nano Banana (Gemini image model), and is checked by OpenAI's moderation model before generation.
• Storage: uploaded photos and generated images are kept in our cloud storage so you can see and download them in My Creations.
• Deletion: deleting a creation removes it from your account. To have your uploaded photos and generated images permanently erased from our storage, email us and we will delete them.

Children

The service is not directed at children, and accounts are for adults. Photos of a child may only be uploaded by the child's parent or legal guardian. If you believe a child's photo was uploaded without that permission, contact us and we will remove it.

Service Providers

We share data only with the providers that run parts of the service for us, and only what each one needs:

• AI image models: OpenAI GPT Image and Google Nano Banana (Gemini image model) generate your images, accessed through our model API providers. They receive your photos and the style and text for that image. OpenAI's moderation model also checks your photos, your typed text and every finished image.
• Waffo processes payments, and screens the extra details and greetings you type before they reach an image model.
• Cloudflare hosts the service, its database and image storage (R2), and stores the service's data on our behalf.
• Plausible Analytics counts visits. It receives page views, the referring site and device type, without cookies.
• Google handles sign-in and shares your name, email address and profile picture with us.

We may also disclose data when the law requires it, or to protect our rights, our users or the public. These providers may process data outside your country, including in the United States.

Analytics

We use Plausible Analytics, which counts visits without cookies and without collecting personal data or tracking you across sites. We may enable other analytics only after you agree to it in the cookie banner.

Cookies

• Necessary: your sign-in session, your language, your cookie choice, and display settings such as theme.
• Campaign attribution: when you arrive from a link with campaign tags (such as utm_source) or from another website, we store the campaign and referring site in a cookie for 30 days and save them to your account if you sign up. This tells us which links bring users; it is not used for advertising.

Data Retention

We keep your account, purchases and creations while your account exists. Uploaded photos and generated images stay in storage until you ask us to erase them. Purchase records may be kept longer where tax or accounting law requires it.

Your Rights

You can ask us to access, correct, export or delete your personal data, including your whole account, by emailing hello@santaphoto.app. We reply within 30 days. Depending on where you live, you may also have the right to object to processing or to complain to your data protection authority.

Data Security

Connections to the service are encrypted, sign-in goes through Google so we hold no passwords, and access to data is limited to what running the service needs. No system is perfectly secure, but we work to protect your information.

Changes to This Policy

We may update this Privacy Policy. The date at the top shows the latest version; for material changes we will also tell signed-in users in the service.

Contact Us

Questions or requests about your data: hello@santaphoto.app.