Privacy Policy
Last updated:
Summary
We do not store the names or the draw result. We use no cookies, local storage or advertising. On the public pages we measure audience with Cloudflare's anonymous, cookieless statistics.
1. Who is the controller
The controller is the operator of this site (Secret Santa). See the contact details at the bottom of this page.
2. Data we process
- Names typed in the form (or sent through MCP/API): used only during the request to run the draw and generate the links.
- The giver and receiver names inside each link: encrypted with AES-256-GCM and decrypted only when the link is opened.
- Technical connection data (IP address, browser, date and time): processed by Cloudflare's infrastructure to deliver the site and protect it from abuse.
3. Purpose and legal basis
To provide the service you requested (GDPR Art. 6(1)(b)) and to keep the site secure and stable (GDPR Art. 6(1)(f)).
To understand and improve the service through anonymous audience statistics (GDPR Art. 6(1)(f)).
4. Storage and retention
There is no database. We do not write the names anywhere. The draw information exists only inside the links, which stay with the people who receive them. Cloudflare's technical logs follow Cloudflare's own policy.
5. Sharing
We do not sell or share data for advertising. Cloudflare, Inc. acts as the infrastructure processor. If you click “WhatsApp”, the link is sent to WhatsApp at your own initiative, subject to that company's policy.
6. Cookies and tracking
We use no cookies or browser storage (Portuguese Law No. 41/2004).
On the public pages (home, gift ideas, guides and legal documents) we use Cloudflare Web Analytics, an audience measurement that uses no cookies, no device storage and no cross-site tracking. It collects aggregate data such as the page visited, country, device and browser type, and performance metrics. It is not loaded on the pages that show a draw result (private links).
We load no third-party fonts, advertising or images.
7. International transfers
Cloudflare runs a global network; your data may be processed outside your country, under the safeguards Cloudflare adopts (for example, standard contractual clauses).
8. Your rights
Under the GDPR (Arts. 15–22) and Portuguese Law No. 58/2019 you may request confirmation of processing, access, rectification, erasure, portability and objection. Since we hold no identifiable data, many of these requests do not apply, but we will answer any request.
You may also lodge a complaint with the Portuguese data protection authority (CNPD) or your own EU supervisory authority.
9. Children
The service is not aimed at children under 13. Minors should use it under a guardian's supervision.
10. Security
We use HTTPS, authenticated encryption in the links and security headers. No system is 100% secure: share each link only with the matching participant.
11. Changes
This policy may change. The last-updated date is at the top of the page.
Contact
Questions or requests about this document: contacto@amigo-secreto.pt