Privacy Policy

1. Controller and contact

Tomáš Orban - ORBITECH, a Slovak sole trader, Biskupická 46, 821 06 Bratislava - Podunajské Biskupice, Slovakia, is the controller. IČO: 40701042; DIČ: 1071437389. AskSantaNow is the service name. Contact support@asksantanow.com or our contact form. Official register entry.

2. Information and purposes

We process the order email, reference, plan, currency, payment status/reference, delivery records and checkout choices to prepare and perform your contract (GDPR Article 6(1)(b)). Child personalization includes first name, age, tone, hobbies, achievements and optional wish, supplied with the permission of a parent/guardian or an authorised adult for this keepsake. Only adults should place orders. Do not submit health information, children's addresses, schools, identity documents or unrelated personal data.

Generated documents and support correspondence help us deliver and resolve problems. Accounting and legally required records are processed to meet legal obligations (Article 6(1)(c)). Security logs, hashed IP/browser details and fraud prevention serve our legitimate interests in protecting the service (Article 6(1)(f)), balanced against individual rights and children's interests. Hosting access logs may separately contain IP addresses.

Optional AI disclosure and optional analytics rely on consent (Article 6(1)(a)). Essential order details are needed to supply the product; an optional wish and AI assistance are not required. We do not sell children's details, use them for advertising, or publish customer documents as examples.

After a successfully paid and delivered live order, the private delivery email may offer a voluntary product-review form. We use the order reference and private access credential only to verify that the reviewer purchased the stated Basic, Plus or Express digital product. A submitted rating, comment and chosen display name are processed on the basis of the customer’s explicit publication consent (Article 6(1)(a)). Reviews wait for a privacy and safety check before publication. Test orders are excluded. Do not put a child’s full name, photo, school, address, contact details or other identifying information in a review.

3. Optional AI assistance

Only when you actively select AI assistance at checkout, the OpenAI API may receive the child's first name, age, hobbies, achievements, optional wish, tone and draft to refine wording. Visual-direction requests use the plan, tone and a variation seed, not the child's personal details. We do not put the order email, card details or payment references into AI prompts.

If you do not select AI, the local generator supplies your purchased PDF formats and design options without sending personalization to OpenAI. If an AI request fails or does not pass validation, we also use the local generator. AI can make mistakes; we do not use it to make legal or similarly significant decisions about you or a child.

We request that API responses are not stored as retrievable application state. This is not a zero-retention promise: OpenAI states that API data is not used for training by default unless the API customer opts in, and abuse-monitoring logs may normally retain content for up to 30 days, with exceptions. See OpenAI API data controls. You can withdraw AI consent by contacting us; this does not undo earlier lawful processing.

4. Providers and international processing

Websupport supplies hosting/email services. Stripe and PayPal handle payments and may act as independent controllers for payment, regulatory and fraud-prevention purposes. We do not store full card numbers. OpenAI receives the limited information above only when AI is selected. Google Analytics may process usage information if configured and statistics consent is given. With that consent, a completed purchase may also be recorded from our server using the order reference as a unique transaction identifier, the purchased product edition, currency and value. We do not send the customer email, child's name or letter details with that purchase event. Necessary records may be disclosed to professional advisers or competent authorities where required.

Providers may process information outside the European Economic Area, including in the United States. Transfers must use an applicable GDPR safeguard, such as an adequacy decision or Standard Contractual Clauses; selecting AI is not a substitute for those safeguards. Contact us for information about the relevant provider arrangements and safeguards. Provider notices: Stripe, PayPal, OpenAI, Google.

5. Retention and private access

Order details and documents are kept for delivery, recovery/support and applicable complaint or claim periods where necessary. Accounting/tax records are retained for the legally required period. We consider record type, contractual purpose, statutory periods, open complaints and legal holds when deciding retention; not every personalization field is needed for accounting. You may request erasure of unnecessary personalization and documents. Required legal records and information needed for live claims may need to be retained.

Your browser stores unfinished/recent order details and a private access credential. Clearing site data removes that browser's stored copy and may remove access from that device; keep your private email link and PDFs. Do not publish private links or use them on a shared device without clearing site data. Server, email and backup copies are not automatically erased when browser data is cleared.

Pending and published reviews retain the rating, review text, selected display name or Anonymous choice, product plan, consent record, timestamps and a one-way order-reference hash used to prevent duplicate reviews. The private access credential is not stored with the review. Rejected reviews and moderation records are retained only as reasonably needed to prevent abuse, document the decision and handle a complaint. You may withdraw publication consent and request removal by emailing support@asksantanow.com.

6. Cookies

Necessary session/security storage enables forms and order access. Optional statistics and marketing categories depend on your cookie choice. Change it using Cookie settings in the footer. Rejecting optional categories does not prevent purchasing. The cookie choice is kept in a cookie for up to 180 days and browser storage until replaced or cleared. We do not intentionally send personalization or document contents to analytics.

7. Your rights

Subject to legal conditions, you may request access, correction, erasure, restriction, portability, or object to legitimate-interest processing. Consent can be withdrawn without affecting earlier lawful processing. A parent/guardian may contact us about a child's details; proportionate verification may be needed before disclosure or deletion. Email support@asksantanow.com. We normally respond within one month, with extensions only as permitted by law.

You may complain to the Office for Personal Data Protection of the Slovak Republic or the authority in your country of residence, work or the alleged infringement. Material changes to this policy will be explained where required.