Privacy Policy

1. About this Policy

This Policy applies to the site joinsecretsanta.com, future SecretSanta accounts, game pages, invitations, wishlists, support messages, and other features of the service ("Service").

SecretSanta is part of the Bazhannya ecosystem. If you go to Bazhannya or use a Bazhannya account, the relevant part of the data processing is also governed by the Bazhannya documents.

2. Who is responsible for personal data

The owner of personal data within SecretSanta is the SecretSanta by Bazhannya team, Ukraine (hereinafter referred to as "we", "SecretSanta"). We determine why and how data is processed in the Service.

3. What data we can receive

3.1. Data you provide yourself

• Contact details: email, name, contact support.
• Account details: name or nickname, avatar, language, settings, and login method ID.
• Game data: name, company type, date, budget, description, rules, cover, cast, and game status.
• User Content: wishes, gift tips, links, images, comments and messages you choose to add.
• Data for receiving a gift: only if the relevant feature is enabled and you voluntarily provide an address or other delivery information.
• Payment information: rate, amount, currency and payment status. Full credit card details must be processed by the payment provider, not SecretSanta.

3.2. Data that comes automatically

• IP address, date and time of request, page address and source of the link;
• browser type, device, operating system, language, time zone, screen size and viewport;
• technical logs, errors, security events and interface interactions;
• identifiers of cookies, PHP sessions and records in the browser's local storage.

3.3. Data from other services

If you log in through Bazhannya or Google, we may receive a verified ID, name, email and avatar according to the permissions you have chosen. We do not receive a password from such a service.

4. Why and on what basis we use the data

We apply the provisions of the Law of Ukraine "On Personal Data Protection". If the law of your country, in particular the GDPR for users from the EEA, provides additional rights, we take into account the mandatory requirements of such law.

5. Who sees what in Secret Santa

• Organizer sees the composition of the participants, readiness, settings and progress of the game. By design of the Service, the organizer does not receive a complete list of secret pairs.
• Member sees the game data available to the whole group, own data and the person for whom he is preparing a gift after starting the distribution.
• Gift recipient doesn't see who has become his Santa until the contestants reveal it themselves.
• Wish list and hints are displayed only to the extent necessary for the selected game scenario and visibility settings.
• Invitation link only need to send to the right people. Anyone receiving such a link could potentially try to open the invitation page.

6. Cookies, sessions and analytics

The service uses browser technologies necessary for the operation of forms, saving the state of the interface, security and evaluating the use of the site.

• PHP session cookie — supports secure session and form CSRF protection.
• secret_santa_early_access — remembers for about 180 days that an early access request has already been submitted.
• localStorage — saves application status, game UI draft and stage test state locally in your browser. These records can be deleted through your browser settings.
• Google Analytics 4 — helps measure visits, devices, conversion sources and page usage. Google can set its own identifiers and process data outside of Ukraine.

You can block or delete cookies in your browser. After blocking mandatory cookies, some forms and functions may not work properly.

7. To whom we may share data

We transfer only the amount of data that is necessary for a specific purpose:

• to the hosting provider and technical contractors who ensure the operation and protection of the infrastructure;
• Google LLC - for Google Analytics and, after connection, login through Google;
• Bazhannya — when you consciously choose a shared account, wishlist or other ecosystem integration;
• to a payment, postal or communication provider - only when the corresponding function is connected;
• to state bodies, a court or other authorized person - only upon a legal and properly formalized request;
• to the new owner of the product - in case of reorganization or transfer of the project with the obligation to maintain data protection.

Individual providers may process data in other countries. In such cases, we must apply statutory protection mechanisms, including contractual warranties and access restrictions.

8. How long we keep data

• Early Access Application: before the invitation is sent and no longer than 12 months after the public launch, unless you ask for it to be removed sooner.
• Account and profile: as long as the account is active; after deletion - up to 30 days in backup copies, unless a longer period is required by law or to resolve a dispute.
• Games and Custom Content: as long as users need them, but as a general rule no longer than 12 months after the end of the game without activity.
• Support request: up to 3 years to restore the context and resolve possible disputes.
• Technical security logs: up to 12 months.
• Google Analytics: according to GA4 settings, usually up to 14 months.
• Financial documents: within the period established by accounting and tax legislation.

Data may be deleted earlier, de-identified, or retained longer if required by law, the security of the Service, or a pending dispute.

9. Your rights

Depending on applicable law, you may:

• to know whether we are processing your data and to receive a copy of it;
• correct inaccurate or outdated information;
• ask to delete data or limit their processing;
• withdraw consent to mailing or other voluntary processing;
• object to processing based on legitimate interest;
• receive the data you provide in a structured format when required by law;
• file a complaint with the Human Rights Commissioner of the Verkhovna Rada of Ukraine or a competent authority in your country.

So that we do not transfer the data to a third party, we can ask to confirm control over the email or to verify the identity in another way. We will respond without undue delay and within the time limit established by applicable law.

10. Data of children

Independent creation of an account is allowed from the age of 13. Users under the age of 18 should use the Service with the consent of their parents or legal representative.

If the organizer creates a game for a class or other children's group, he must involve a responsible adult, not publish the contacts and addresses of children and obtain the necessary permissions. If you believe that a child's data has been provided illegally, write to us - we will investigate the request and delete the data when there are grounds for this.

11. Security and Automated Distribution

We apply organizational and technical measures: HTTPS, access restrictions, form protection, redundancy, security logs and contractor verification. At the same time, no system on the Internet can guarantee absolute security.

The Secret Santa algorithm automatically determines who gives whom according to the rules of the game. Such distribution does not create legal or other significant consequences for the person and is not used for personality assessment or advertising profiling.

12. Changes to the Policy

We may update the Policy when features, providers or legislation change. The current edition is always published on this page. We will notify registered users of material changes on the Service or by e-mail before they become effective, whenever possible.