Privacy

Effective 10 November 2026. Narwhal Labs is the data controller for Santa Baby. For privacy questions or requests, email privacy@narwhallabs.io.

What my elves collect

A parent or guardian supplies the child's first name and wishes, a parent phone number and email, and their consent to the call. Optional details include a child's last name, age, behaviour, notes and the parent's name. We also store the chosen call time, call status, duration and verification records. Please do not include sensitive health, school-address or other unnecessary details.

Why I need these details

We use them to verify the parent’s number, personalise and deliver the Santa call, and handle privacy requests. DeepBlue's AI creates Santa's voice; Santa is not a real person. Narwhal Labs operates DeepBlue. Our hosting provider securely stores the booking details on our behalf. Phone and SMS providers receive the number and information needed to deliver the service.

We rely on the parent's consent for the child's personalisation details, and our legitimate interests in service security and preventing abuse for hashed phone, device and network identifiers. SMS verification codes are stored only as keyed hashes, expire after ten minutes and allow five guesses. We do not ask children to create accounts, and parents should supervise use.

No ads or selling data

There are no ads, ad SDKs or third-party analytics in Santa Baby. We never sell your data or use your family's details for advertising. We store only a device identifier and your sound preference on your device for security and your chosen settings.

When I clear my book

Bookings and anonymous inbound Santa codes expire 30 days after creation. A daily cleanup removes records older than 30 days, within the following 24 hours. Verification records are removed after expiry. Hashed phone-abuse records last for the 30-day call limit plus the daily cleanup interval; device/IP daily counters last up to two days. These security records are not used to identify children and deleting bookings does not reset call limits. Routine hosting backups may retain copies temporarily under the provider's backup retention; they are not used for active calls.

Calls in the current on-the-house mode are not recorded by this app. If recording becomes available later, it will require a separate opt-in and a published retention explanation.

Your rights and deletion

You can request access, correction, erasure, restriction, objection or withdrawal of consent by emailing privacy@narwhallabs.io. You can also verify your phone and immediately delete all bookings linked to it, including scheduled bookings. Anonymous inbound codes are not linked to a phone; email us with the code to remove one sooner. Deletion cannot undo a call already delivered or in progress.

We use access controls and encryption in transit, and limit access to people and providers who need it. Where processing takes place outside the UK, appropriate legal safeguards are required. You may complain to the UK Information Commissioner's Office at ico.org.uk. We will update this page before materially changing how your family's data is used.