EN · DE

Privacy Policy

Santa AI app · Swiftmill UG (haftungsbeschränkt) · Last updated: October 22, 2026

1. Who we are

The controller responsible for processing your personal data in the Santa AI app (the “app”) under the EU General Data Protection Regulation (GDPR) is:

Swiftmill UG (haftungsbeschränkt)
Holzhofallee 21
64295 Darmstadt, Germany
Managing Director: Johannes Seidel
Email: johannes@swiftmill.io

For any privacy question or request, write to the email address above.

2. Who the app is for

Santa AI is made for parents and other adults who create personalized Christmas messages for children. The app is meant to be used by adults. When you enter details about a child, such as their first name, age or wishes, you do so as the parent or with the permission of the person with parental responsibility.

3. What data we process

You are not legally or contractually required to provide personal data. Without the content you enter, however, we can't create personalized messages.

4. Using the app

When you open the app for the first time, it creates a random, anonymous user ID and stores it in your device's keychain. We use it to keep your credits and creations together, without an account, email address or password.

• Data: anonymous user ID, app and device data, IP address
• Purpose: providing the app, keeping your credits and creations, security and troubleshooting
• Legal basis: Art. 6(1)(b) GDPR (providing the service you use); Art. 6(1)(f) GDPR for security and error analysis (our legitimate interest in a stable, secure app)
• Storage: while you use the app; see section 14

Our backend runs on servers from Render (USA). Data is stored in a database from Supabase hosted in the EU. Background jobs are run by Inngest (USA). These providers process data only on our behalf and according to our instructions.

5. Creating content with AI

Santa AI creates personalized videos, calls, songs, bedtime stories, letters and pictures. To do so, we send what you enter to specialized AI service providers. Before the first time, the app asks for your explicit permission and shows which data goes to which provider. You can withdraw this permission anytime in the app under Settings → “Share with AI services”. Without it, the AI features can't be used.

• Data: the content you enter (for example your child's first name, age range, wishes, message text), your chosen Santa character and voice, and photos only if you add one
• Purpose: creating the content you requested
• Legal basis: Art. 6(1)(b) GDPR (providing the service you requested) and your consent under Art. 6(1)(a) GDPR
• Storage: see section 14

What we don't do:

• We don't use your inputs, photos or creations to train AI models, and our providers may not use them for training under our agreements.
• We don't use photos to identify or recognize people, and we don't create biometric templates. Photos are processed only to create the picture or video you asked for.
• There is no automated decision-making with legal or similarly significant effects on you (Art. 22 GDPR).

Content created with AI may be marked as AI-generated, for example with a visible label or with information embedded in the file.

6. Purchases and credits

Purchases are processed by Apple through the App Store. We never receive your payment card details. Apple tells us which product was bought so we can add the credits to your anonymous ID.

We use Superwall (Superwall, Inc., USA, privacy) to show the purchase screens and measure how they perform, for example how often a screen is viewed and whether a purchase follows. Answers you give in the onboarding questions (such as the number and age range of children) can be used to personalize these screens. Children's names stay on your device and are only used to display them on the screen.

• Data: anonymous user ID, products, transaction IDs, credit balance, purchase screen interactions
• Purpose: processing purchases, managing credits, showing and improving purchase screens
• Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for tax and accounting duties; Art. 6(1)(f) GDPR for improving purchase screens
• Storage: purchase records for up to 10 years as required by German tax law (§ 147 AO, § 257 HGB)

7. Notifications and reminders

If you allow notifications, we send you reminders and updates, for example when your video is ready or as a Santa reminder you set. We use OneSignal (OneSignal, Inc., USA, privacy) to deliver push notifications. Some reminders are scheduled locally on your device only.

• Data: push token, anonymous user ID, notification settings, delivery and open status
• Legal basis: your consent through the iOS notification permission, Art. 6(1)(a) GDPR
• Withdrawal: turn off notifications anytime in iOS Settings → Notifications → Santa AI

8. Analytics

We use Mixpanel (Mixpanel, Inc., USA, privacy) to understand how the app is used, for example which screens are opened and which features families enjoy. We send data to Mixpanel's EU data center and don't send names, wishes, message texts or photos.

• Data: anonymous user ID, events (for example “screen viewed”, “video created”), app and device data
• EU, EEA, UK, Switzerland: only with your consent in the privacy banner, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can change your choice anytime in the app under Settings → Privacy settings.
• Other countries: based on our legitimate interest in improving the app, Art. 6(1)(f) GDPR
• Storage: up to 24 months, then deleted or anonymized

9. Advertising measurement

We advertise Santa AI on Facebook and Instagram. To measure which ads lead to installs and purchases, the app uses Facebook App Events from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (privacy). Meta may transfer data to Meta Platforms, Inc. in the USA.

• Data: app starts, purchases (product and price), device and app data, IP address, and the advertising identifier (IDFA) only if you allow tracking
• EU, EEA, UK, Switzerland: nothing is sent to Meta unless you accept “Facebook App Events” in the privacy banner, Art. 6(1)(a) GDPR and § 25(1) TDDDG. The iOS tracking prompt is only shown afterwards.
• Other countries: app events are sent based on our legitimate interest in measuring our advertising, Art. 6(1)(f) GDPR. The advertising identifier is only used if you allow tracking in the iOS prompt.
• Withdrawal: Settings → Privacy settings in the app (EU, EEA, UK, Switzerland), and iOS Settings → Privacy & Security → Tracking

For ad measurement, Meta and we are joint controllers (Art. 26 GDPR) for the collection and transmission of the data. Meta is responsible for its further processing. You can exercise your rights directly with Meta as well.

10. Support and referral codes

Support: if you email us, we use your email address and message to answer you (Art. 6(1)(b) or (f) GDPR). We delete the conversation when your request is resolved, unless we must keep it for legal reasons.

Referral codes: if you share or redeem a referral code, we store the code, the anonymous IDs involved and whether the referral qualified, to award free credits (Art. 6(1)(b) GDPR).

11. App permissions

The app asks for iOS permissions only when a feature needs them. You can change them anytime in iOS Settings → Santa AI.

• Photos: to select a photo for a picture or video feature, and to save your creations to your photo library.
• Camera: to show your camera image during a Santa call or to take a photo for a feature. Camera images stay on your device unless you choose to use a photo for a creation.
• Notifications: see section 7.
• Tracking: see section 9.

12. Recipients

We share personal data only as described in this policy. Our service providers process data on our behalf under data processing agreements (Art. 28 GDPR) and may not use it for their own purposes. Apple and Meta act as independent or joint controllers as described above. We may also disclose data where we are legally required to, for example to authorities.

13. Transfers outside the EU

Several providers are based in the USA. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise we use the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and additional safeguards where needed. You can request a copy of these safeguards by email. Please note that US authorities may, under certain circumstances, access data stored in the USA.

14. How long we keep data

• Content you enter and your creations: as long as you use the app, so you can watch, download and share them again. You can ask us anytime to delete them.
• Data at AI providers: only as long as needed to create the content, and in any case no longer than the provider's contractual retention period.
• Anonymous user ID and credits: as long as you use the app. Deleting the app removes the data on your device; to delete the data on our servers, email us.
• Analytics data: up to 24 months.
• Server logs: up to 30 days.
• Purchase records: up to 10 years where required by tax law.
• Support emails: until your request is resolved.

When you ask us to delete your data, we delete it within 30 days, unless we must keep it to comply with legal obligations.

15. Children

The app is intended for adults. Children should not use the app on their own, and we don't knowingly collect data directly from children. Parents can enter details about their child to personalize a message. We use these details only to create the requested content, never for advertising or profiling. If you believe a child has provided personal data without parental consent, please contact us and we will delete it.

16. Your rights

Under the GDPR you have the right to:

• Access your personal data and receive a copy (Art. 15)
• Rectification of incorrect or incomplete data (Art. 16)
• Erasure of your data (Art. 17)
• Restriction of processing (Art. 18)
• Data portability in a structured, machine-readable format (Art. 20)
• Withdraw consent at any time with effect for the future (Art. 7(3)); the processing up to then remains lawful
• Lodge a complaint with a supervisory authority (Art. 77), for example where you live or with our authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany

Right to object (Art. 21 GDPR): where we process data based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop the processing unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims. You can object to processing for direct marketing at any time without giving reasons.

Because the app works without an account, we identify your data by your anonymous user ID. To make a request, email johannes@swiftmill.io and include the ID shown in the app under Settings, if possible.

17. Information for US users

We do not sell personal information. Using Facebook App Events to measure our advertising may be considered “sharing” for cross-context behavioral advertising under some US state laws, such as the California Consumer Privacy Act (CCPA/CPRA). You can opt out by choosing “Ask App Not to Track” in the iOS prompt or in iOS Settings → Privacy & Security → Tracking, or by emailing us. Depending on your state, you also have rights to know, access, correct and delete your personal information, and we won't discriminate against you for using them. We process the categories of data listed in section 3 for the purposes described in this policy.

We do not knowingly collect personal information directly from children under 13. Information about a child is provided by a parent to create a requested message and is used only for that purpose.

18. Security

All data is transmitted encrypted (TLS). Access to our systems is limited to the people who need it, and we use technical and organizational measures to protect your data against loss, misuse and unauthorized access.

19. Changes to this policy

We update this policy when our app or the law changes. The current version is always available in the app and at this address. If changes require your consent, we will ask for it in the app.