Privacy notice

Who is responsible

Kranthews Ltd, trading as Tinselton, is the data controller. Tinselton is a trading name of Kranthews Ltd, registered in England and Wales, company number 14373131. Registered office: 1 Westbrook Avenue, Hampton, England, TW12 2RE. VAT number GB441363417. ICO registration ZB616290. Email: hello@tinselton.co.uk.

This service is for adults

Tinselton is for parents and carers aged 18 or over. We never collect information from children directly. The details about a child are provided by an adult, and no child appears in any upload or video.

What we collect and why

Your email address and payment card (held by Stripe; we never see the card number), to deliver the videos and take payment. Legal basis: performance of the contract with you.

Your child's first name, age, and the notes you write about their year, to create the videos. Legal basis: our legitimate interest, and yours, in making the gift you ordered for your child. We only ask for what the videos need: no surname, no date of birth, no school and no photo of your child.

A photo of your child's handwritten list, and, if you choose Santa's selfies, photos of rooms in your home with nobody in them, to create the letter video and Santa's selfies. Legal basis: our legitimate interest, and yours, in making the gift you ordered and the optional extra you chose. Each room photo is checked automatically for people and rejected and deleted immediately if any are found (legal basis: our legitimate interest in keeping people out of generated images and video); you can ask us to review a rejection by email. We also check again on our own servers for any face your phone didn't blur, and blur it before the photo is stored.

Technical records of the consents you gave at checkout (the wording, which names each child the order is for, its version, the time, a scrambled form of your IP address, and your browser and device details as your browser reports them), as evidence of the agreement. Legal basis: legal obligation and legitimate interests.

Security records: a scrambled (hashed) form of your IP address, used to stop misuse such as too many attempts in a short time. Legal basis: our legitimate interest in keeping the service secure.

Anonymous visit statistics, with no cookies and no personal data, to understand how the site is used.

Where your data goes

Payments: Stripe, which processes payment details in the United States and other countries. Website hosting: Vercel, served from London. Database: Neon, stored in London. Photos and finished videos: Cloudflare R2, stored in the EU. Background processing: Trigger.dev, a UK company, run in the United States (the transfer is covered by Trigger.dev's agreement with its US hosting provider). Email: Postmark. Preparing your letter photo, checking room photos for people and putting the letter video together: Modal, a US company.

To create the videos and selfies, your child's name, the notes, the list items and the room photos are processed by AI providers based in the United States, which may also process them in other countries: fal.ai (video and image models), ElevenLabs (Santa's voice) and Anthropic (script drafting). Before anything is sent to Anthropic, we replace your child's name with a placeholder, so Anthropic doesn't normally receive it. The photo of your child's letter is not sent to any AI provider. Transfers to the United States rely on the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge) for Stripe, Vercel, Neon, Cloudflare, Postmark and ElevenLabs, which are certified under it; on the ICO's International Data Transfer Agreement for fal.ai; and on the ICO's UK Addendum to the EU standard contractual clauses for Modal and Anthropic. These terms are in each provider's agreement with us, available on request. Anthropic's terms don't let it train its models on what we send. We've switched off ElevenLabs' option to use our account's data to improve its models. fal.ai's terms allow it, at its discretion, to use what we send in de-identified form to improve its services, which may include training its models.

How long we keep things

Your letter photo is deleted when your video is delivered, and never more than 30 days after. If a letter video isn't made, its photo is deleted within 100 days. Your room photos are deleted once your selfies are made, and never more than 7 days after you add them.

Finished videos and your private link: 90 days after delivery, then deleted. To have them deleted sooner, email hello@tinselton.co.uk.

Santa's selfies: 30 days after delivery, then deleted, because they show the inside of your home. To have them deleted sooner, email hello@tinselton.co.uk.

Order records, consents (including the children's first names in the wording you agreed to) and payment references: 6 years, for tax and to defend legal claims.

Notes, list items and your child's name: deleted with the videos and selfies, except your child's first name in the consent wording, which we keep with the consents.

After we delete something, our providers' backups and logs may hold copies for a time set by their own terms (for example, our email provider keeps copies of the emails we send for up to 45 days).

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interests, and complain. Email hello@tinselton.co.uk. We'll acknowledge a complaint within 30 days.

You can also complain to the Information Commissioner's Office at ico.org.uk.

Automated decisions

The only automated decision is the people check on the room photos. If a photo is rejected, you can ask a person to review it by emailing us.