Privacy Policy for PapaNoel.chat

Last updated: October 31, 2026

This Privacy Policy explains what data we collect, how we use it and what options you have. We want to be completely transparent and clear, especially because PapaNoel.chat is designed for minors under adult supervision.

By using the application, you accept this Policy.

1. Data we collect

1.1 Account data (adult)

When you create an account we collect:

  • Your email
  • Your user ID
  • Account settings (PIN, preferences)
  • Available minutes and related operations

1.2 Child profiles (created by adult)

The adult can enter:

  • Child's name
  • Age
  • Likes, hobbies, achievements, behavior and Christmas wishes
  • Additional information that the adult decides to include

We do not request or recommend including sensitive data (health, religion, etc.).

1.3 Usage data

We collect:

  • Call history (date, duration, minutes used)
  • Basic interactions within the App
  • IP address, device model, operating system, error logs
  • Aggregate performance and usage metrics

1.4 Video call data

We do not record or store the audio or video content of calls.

We only keep technical metadata, such as start, end, duration and call status.

If you record or share a video call from your device, that recording is yours and you are responsible for its storage and dissemination.

1.5 Chat with Santa without an account

On our free Santa page you can try a short chat with Santa without creating an account. It is for children accompanied by an adult, who confirms this before starting.

To provide it we process only what is strictly necessary:

  • Child’s name (optional) and chat messages: used to generate Santa’s replies. We do not store the conversation on our servers: it travels signed in your browser and expires at midnight (UTC).
  • Name for sign-up: if you then create an account, only the child’s name is kept in your browser, for up to 7 days, to fill in their profile. Never the conversation.
  • Abuse prevention: to limit the chat to one session per device per day and a few per connection, we use a technical cookie that expires at midnight (UTC) and a pseudonymised fingerprint (keyed hash) of your IP address. We never store the IP in plain text, and the counters are deleted automatically within three days at most.

These providers take part in the chat without an account, acting as data processors:

  • Cloudflare (Turnstile): checks that whoever opens the chat is a person and not an automated program. To do so it receives your IP address and technical browser signals. It only loads on the chat screen.
  • Anthropic: generates Santa’s replies from the messages and the name, if you gave one.
  • OpenAI: reviews every message and reply before showing them (content moderation) and turns Santa’s reply into his voice.
  • PostHog (hosted in the EU): receives the conversations with the child’s name and contact details (emails, phone numbers, long numbers) redacted, so we can review the quality and safety of the replies. Chat usage events from your browser are only sent if you accept analytics cookies.

Under their business terms, Anthropic and OpenAI do not use this data to train their models. Technical monitoring tools only receive performance metrics (timings and errors), without the chat content.

Legal basis: providing the chat the adult requests when starting it, and our legitimate interest in preventing abuse and making sure replies are safe for a child.

We recommend not writing personal details in the chat, such as addresses, phone numbers or the name of the school.

2. How we use your data

We use your data to:

  • Manage the account and usage minutes
  • Enable video calls with the Santa avatar
  • Personalize the child's interaction according to their profile
  • Send transactional notifications (for example, about minutes or account changes)
  • Improve App performance and stability
  • Prevent abuse and maintain security
  • Comply with legal obligations

We never sell personal data.

We never use minor data for advertising.

3. Use of external artificial intelligence services

To generate the personalized video call experience, we use external artificial intelligence technology providers.

We share with these providers only the information strictly necessary to offer the functionality (for example, the child's profile configured by the adult and the context essential for the conversation).

These providers act as data processors in accordance with GDPR and are contractually obligated to:

  • use the data only to provide the requested service,
  • process it following our instructions,
  • apply appropriate security measures,
  • and not use it for their own commercial purposes.

4. Recording and sharing video calls

You can record or share a video call from your own device if you wish. The App may help you generate a local file on your device; that file is not uploaded or stored on our servers.

By doing so you accept that:

  • The App does not access, process or store the recording.
  • You are solely responsible for the use, editing and dissemination of that content.
  • The avatar is generated by AI and does not represent a real person.
  • We recommend not sharing sensitive information about the minor.

5. Minors and supervision

  • Only an adult can create the account and child profiles.
  • Use by minors must always be done under direct adult supervision.
  • The adult can exercise all privacy rights on behalf of the minor.
  • We do not offer interactions with other users or social functionalities.

6. Legal bases for processing

According to GDPR, we process personal data under these legal bases:

  • Contract execution: provide the service (account, minutes, video calls).
  • Explicit consent of the adult: processing of minor's data.
  • Chat with Santa without an account: does not rely on the consent in the previous point, but on providing the chat the adult requests and on our legitimate interest (see section 1.5).
  • Legitimate interest: security, fraud prevention, aggregate App improvements.
  • Legal obligation: tax, accounting or regulatory requirements.

7. Data retention

  • Account data: while the account remains active.
  • Child profiles: until the adult deletes them or closes their account.
  • Call history and usage: for the time necessary for service functionality and internal audit.
  • Tax and billing data: according to applicable legal deadlines.
  • Chat with Santa without an account: the conversation is not stored; the technical cookie expires at midnight (UTC) and the counters with the pseudonymised IP are deleted within three days at most (see section 1.5).

When you delete your account, we delete your data within a maximum of 30 days, except for legal obligation.

8. Who we share your data with

We share data only with essential providers who act as data processors, such as:

  • Authentication and account management
  • Database and storage
  • Technology services for video calls and AI
  • Payment processors (if applicable)
  • Monitoring and analytics tools
  • Chat without an account: Cloudflare, Anthropic, OpenAI and PostHog (see section 1.5)

All of them are subject to data protection agreements and comply with GDPR or equivalent guarantees.

9. International transfers

Some providers may be located outside the European Economic Area.

We only transfer data when appropriate safeguards are applied in accordance with GDPR, such as standard contractual clauses or additional security measures.

10. Security

We apply technical and organizational measures such as:

  • Encryption in transit and at rest
  • Internal access control
  • Anomalous activity detection
  • Secure backups
  • Strict minimization of minor's data

We work continuously to improve security, although no digital service is 100% infallible.

11. Your rights

You can exercise at any time the rights of:

  • Access
  • Rectification
  • Deletion
  • Portability
  • Limitation or opposition
  • Withdrawal of consent for minor's data

To do so, contact us at: help@papanoel.chat

If you are not satisfied, you can contact the Spanish Data Protection Agency (AEPD).

12. Changes to this policy

We will update this Policy when we incorporate improvements or new functionalities.

We will notify you of relevant changes through the App or by email.

13. Contact

If you have questions about privacy or data processing, you can contact us at:

Operator: Alfredo Artiles (Independent Developer)

Email: help@papanoel.chat

Location: Spain

14. Cookies and tracking technologies

On the web, we use cookies and similar technologies to improve your experience and analyze application usage. In the iOS app, we do not show cookie prompts, use tracking cookies, or load third-party advertising technologies.

14.1 What are cookies?

Cookies are small text files that are stored on your device when you visit a website. They help us remember your preferences and understand how you use the application.

14.2 Cookies we use

On the web, we use analytics cookies to improve the application. In the iOS app, we use product analytics without tracking cookies:

  • Analytics (PostHog): We use PostHog, an analytics tool hosted in the European Union, to collect information about how users interact with the application. This helps us identify technical problems, understand which functionalities are most used and improve the overall experience.

Data collected by PostHog: Usage events (such as clicks, navigation, errors), technical device information (browser type, operating system, screen resolution), and performance metrics. In the iOS app, we do not use this data for advertising, remarketing, or cross-app/cross-site tracking.

14.3 Consent and control

On the web, in accordance with the General Data Protection Regulation (GDPR), we only load analytics cookies after obtaining your explicit consent. In the iOS app, we do not show this prompt because we do not use tracking cookies. On the web, you can:

  • Accept all cookies: You allow the use of analytics cookies to improve the application.
  • Reject all cookies: We do not load analytics cookies. The application will work normally, but we will not collect usage data.

You can change your preference at any time by deleting cookies from your browser or contacting us at help@papanoel.chat.

14.4 Essential cookies

We do not use essential cookies that require consent. Session cookies necessary for authentication and basic application operation are managed automatically and do not require consent according to GDPR.

14.5 Analytics provider

We use PostHog as our analytics provider. PostHog is hosted in the European Union and complies with GDPR. You can learn more about their privacy policy at posthog.com/privacy.

Data collected by PostHog is used exclusively to improve PapaNoel.chat and is not shared with third parties for advertising purposes. In the iOS app, we do not load Google Ads, GTM, Meta/Facebook Pixel, TikTok Pixel, or equivalent advertising tracking technologies.

← Back to home