Privacy Policy

Who we are

Dear Claus is run by an individual based in Texas, USA. Payments are processed by our payment provider, which acts as our Merchant of Record — it handles the payment, the taxes and your receipt.

Questions? Email support@dearclaus.com and we'll help.

What we collect

When you build a letter, we store the details you type: your child's first name, their age, and the little details you add so Santa can write to them. No photos — we never ask for them.

To take payment, our payment provider sends us your order email and order number, so we can find your order if you write to us.

We keep simple counts of how the shop is used: which pages are visited (with a rough country and whether the device was a phone or computer), which options were picked in the letter builder, and when letters were downloaded. These records hold no names — they reference orders by number only.

If you order through our Etsy listing, we also keep the note you type into Etsy's personalization box, so the letter is written the way you asked. It is erased 30 days after your order is marked delivered.

What we do with it

The details you type are used only to write the letter you ordered. We don't use them for advertising, and we don't sell or share them.

Unpaid drafts are deleted after 30 days. For paid orders, we remove the letter details from our records on February 1 each season. Your order email stays in our payment provider's records, as receipts must for taxes.

When your order is paid, we send one email to the address you paid with, containing the link to your letters. That is the only email we send you — no marketing, and you can email us any time to have it re-sent or deleted.

The usage counts described above are anonymous and are deleted after 13 months.

If something breaks on our side, the server keeps a short technical note (which page failed and a random error id) so we can fix the problem. These notes contain no customer details.

Cookies and IP addresses

We set one essential cookie, sp_owner. It holds a random token so your own browser can find the draft you were working on. There are no ad or tracking cookies and no third-party analytics.

Your IP address is looked at when you make a request, for rate limiting and a rough country check. It is not stored. The country check uses the free DB-IP IP to Country database — no IP addresses are sent anywhere for this; the lookup happens on our own server.

The one exception is this shop's own security log: when the owner signs into the admin area, the sign-in time, result and IP address are kept for 30 days to catch break-in attempts, and the log entry itself is deleted after 90 days. This log never contains customer data. The admin area also uses a separate cookie, __Host-sp_admin, only while the owner is signed in.

Children

This site is for adults. We don't offer accounts for children and we don't knowingly collect information from children under 13. A child's first name, age and details are typed in by a parent, only to write the letter.

Your rights

Email support@dearclaus.com any time to see or delete your data, and we will. US state privacy laws, including Texas's, may give you rights like access and deletion — we honor the request no matter which state you're in.