Privacy notice

Who is responsible

Kranthews Ltd, trading as Tinselton, is the data controller. Tinselton is a trading name of Kranthews Ltd, registered in England and Wales, company number 14373131. Registered office: 1 Westbrook Avenue, Hampton, England, TW12 2RE. VAT number GB441363417. Email: hello@tinselton.co.uk.

This service is for adults

Tinselton is for parents and carers aged 18 or over. We never collect information from children directly. The details about a child are provided by an adult, and no child appears in any upload or video.

What we collect and why

Your email address and payment card (held by Stripe; we never see the card number), to deliver the videos and take payment. Legal basis: performance of the contract with you.

Your child's first name, age, and the notes you write about their year, to create the videos. Legal basis: performance of the contract.

A photo of your child's handwritten list, and a photo of a room in your home with nobody in it, to create the letter and room videos. Legal basis: performance of the contract. The room photo is checked automatically for people and rejected and deleted immediately if any are found (legal basis: our legitimate interest in keeping people out of generated video); you can ask us to review a rejection by email.

Technical records of the consents you gave at checkout (the wording, its version, the time, and your IP address), as evidence of the agreement. Legal basis: legal obligation and legitimate interests.

Anonymous visit statistics, with no cookies and no personal data, to understand how the site is used.

Where your data goes

Payments: Stripe (UK and EU). Website hosting: Vercel, served from London. Database: Neon, stored in London. Photos and finished videos: Cloudflare R2, stored in the EU. Email: Postmark.

To create the videos, the notes, the list items, the letter image and the room photo are processed by AI providers: fal.ai (video models), ElevenLabs (Santa's voice) and [LLM PROVIDER] (script drafting), some of which are in the United States. Transfers rely on the UK–US Data Bridge where the provider is certified for it, and otherwise on the ICO's International Data Transfer Agreement in the provider's agreement with us, available on request. We choose settings under which providers do not use your photos to train their models.

How long we keep things

Letter and room photos: deleted as soon as the video that uses them is made.

Finished videos and your private link: 90 days after delivery, then deleted. You can delete them earlier from your videos page.

Order records, consents and payment references: 6 years, for tax and to defend legal claims.

Notes, list items and your child's name: deleted with the videos.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interests, and complain. Email hello@tinselton.co.uk. We'll acknowledge a complaint within 30 days.

You can also complain to the Information Commissioner's Office at ico.org.uk.

Automated decisions

The only automated decision is the people check on the room photo. If a photo is rejected, you can ask a person to review it by emailing us.