Privacy notice

1. In short

• We only process what we need for your order. There are no cookies, no advertising trackers and no analytics tools from other companies. Our own visitor statistics work without cookies and do not recognise you again (section 3).
• We store the details about the child separately from the order and delete them 30 days after the letter is posted.
• The AI never gets names or addresses. It writes with placeholders that we only replace when we print.
• We never see card details; payment is handled by Stripe.
• We do not sell or share your personal information, and we do not use it for advertising.

2. Who is responsible

Consensus Ventures GmbH, Maxstraße 11, 82335 Berg, Germany, represented by its managing director Thomas Huhn, email hello@littleelfpost.com. We are not required to appoint a data protection officer. For any question about your data, please write to the address above.

3. Visiting the website

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Our server functions run in Frankfurt am Main. The domain and the delivery of the pages run through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, both process technically necessary data such as IP address, time, page requested and browser type to deliver the page and protect it against attacks. The legal basis is our legitimate interest in a secure, working website (Article 6(1)(f) GDPR). Both process the data on our behalf (Article 28 GDPR). Data may be transferred to the United States. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses (Article 46(2)(c) GDPR).

Visitor statistics without cookies: to see which pages are read and where something goes wrong in the order process, we count page views and steps in the order process ourselves, without any outside provider. We store the page, the step (for example “preview requested”, “required field empty” with the name of the field, “to checkout”), the duration, technical errors, the campaign code from the address, the website you came from (only its name), the device type (phone, tablet or computer) and the country roughly derived from the IP address. We do not store what you type, names or addresses.

We set no cookie and store nothing in your browser. To count views of the same visit together, our server builds a checksum from IP address, browser type and a random value that is only valid for one day. We do not store the IP address itself. We delete the daily value the next day; after that the checksum can no longer be linked to anyone, and visits on different days cannot be connected. We do not count automated visits (search engines, test programs). The data is stored in our database at Neon (section 4) and deleted after 90 days. The legal basis is our legitimate interest in improving the website and the order process and finding errors (Article 6(1)(f) GDPR). You can object at any time (Article 21 GDPR): switch on “Do Not Track” or “Global Privacy Control” in your browser, and we will not count your visits at all.

If you come to us through an advertising or partner link, a short campaign code is in the address. We store this code with the order, without a cookie, so we can see which advertising or partner led to an order. The partner only learns the date, product, amount and channel, never your name, your address or anything about your child. The legal basis is Article 6(1)(f) GDPR.

4. Your order

For your order we process your name, email address, delivery address, the product, the amount and the payment status. The legal basis is the performance of the contract (Article 6(1)(b) GDPR). We keep records relevant for invoicing for up to ten years because of German commercial and tax law (Article 6(1)(c) GDPR together with § 257 of the German Commercial Code and § 147 of the German Fiscal Code).

The data is stored in a database from Neon (a provider based in the United States) in a data centre in Frankfurt am Main (AWS eu-central-1). The provider processes the data on our behalf (Article 28 GDPR). Data may be transferred to the United States. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses (Article 46(2)(c) GDPR).

5. Details about the child

To make the letter personal, you tell us about the child: first name, age, gender if you wish, home town, experiences, pet, friends, wishes, brothers or sisters. We store these details separately from the order. The legal basis is the performance of the contract (Article 6(1)(b) GDPR). Please only enter these details if you are responsible for the child, for example as a parent.

Deletion: 30 days after the letter is posted, we automatically delete the details about the child together with the name and street on the letter. If an order is not paid, we delete these details and your contact details after three days.

6. Writing the letter with AI (Claude, data centres in the EU)

The letter is written by a language model from Anthropic (Claude). The request goes through the intermediary OpenRouter, Inc. (USA) to data centres in the EU: Amazon Web Services in Ireland (Amazon Web Services EMEA SARL, Luxembourg) or Google Cloud in Europe (Google Cloud EMEA Limited, Dublin). We only allow providers that do not store the content and do not use it for training.

The AI only receives the age, the gender if you gave it, the experiences, wishes and things the child can be proud of, plus placeholders such as “[NAME]” instead of the names of the child, friends, brothers or sisters and pet. We only insert names and addresses when we print. So please do not write names or addresses in the free text fields.

The providers process the data on our behalf (Article 28 GDPR). The legal basis is Article 6(1)(b) GDPR. Data may be transferred to the United States. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses (Article 46(2)(c) GDPR).

7. Payment (Stripe)

Payment is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your payment details, email address and the amount and checks the payment for fraud. Stripe is responsible for this itself. We only receive the payment status from Stripe, never your card details. The legal basis is Article 6(1)(b) GDPR. More at stripe.com/privacy. Data may be transferred to the United States. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses (Article 46(2)(c) GDPR).

If you pay with PayPal, PayPal's privacy notice also applies.

8. Printing and posting

Letters to Ireland are printed by LetterXpress, A&O Fischer GmbH & Co. KG, Maybachstraße 9, 21423 Winsen (Luhe), Germany, and handed to Deutsche Post, which passes them to An Post for delivery. Letters to the United States are printed and handed to USPS by Lob.com, Inc., San Francisco, USA. For this the print partner receives the finished letter with the child's name and address; the post only sees what is shown in the envelope window. The print partners process the data on our behalf (Article 28 GDPR). The legal basis is Article 6(1)(b) GDPR. Data may be transferred to the United States. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses (Article 46(2)(c) GDPR).

9. Emails

We send order confirmations, elf notes and gift vouchers through Resend (Plus Five Five, Inc., USA) from servers in Ireland. Resend receives your email address and the content of the email. The provider processes the data on our behalf (Article 28 GDPR). The legal basis is Article 6(1)(b) GDPR. Data may be transferred to the United States. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses (Article 46(2)(c) GDPR).

If you write to us at hello@littleelfpost.com, Cloudflare forwards the email to our mailbox at Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland). We only use your message to answer it (Article 6(1)(b) or (f) GDPR) and delete it when we no longer need it and no retention duty applies.

10. Gift vouchers

When you buy a gift voucher, we process the name and email address of the person giving it and, if entered, the name to appear on the voucher. We store the voucher until it is redeemed or expires, and after that within the retention periods.

11. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interests (Article 21). Just write to hello@littleelfpost.com.

You can also complain to a data protection authority, for example the one where you live. In Ireland this is the Data Protection Commission. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

We do not make automated decisions within the meaning of Article 22 GDPR.

12. Customers in the United States and children's privacy

Our website is meant for parents and other adults. We do not knowingly collect personal information online from children under 13. The details about a child come from the parent or another adult who orders the letter, and we use them only to write and post that one letter. If you believe a child has sent us information directly, please write to us and we will delete it.

We do not sell personal information and do not share it for cross-context behavioural advertising. We honour “Global Privacy Control” and “Do Not Track” signals as described in section 3.

Wherever you live, you can ask us what we store about you, ask us to correct or delete it, and get a copy. Just write to hello@littleelfpost.com. We will not treat you differently for using these rights.