Last updated: 9 October 2026
Who we are
Secret Santa Ideas (secretsantaideas.com) is operated by Module 37. We are the data controller. For anything about your data, write to hello [at] secretsantaideas.com.
What we collect and why
We collect only what is needed to run a gift exchange.
- About the group: its name, the event date, the budget, and the organizer's optional message and email address.
- About participants: the names the organizer enters and, if the organizer adds them, email addresses, used only to send each person their private link and one reminder.
- Wishlists: the wishes and interests a participant chooses to add on their own page.
- Email records: that an email was sent, and whether it was delivered, bounced or reported as spam.
- Abuse prevention: when you create a group or open a private link, we use your IP address to limit abuse. We keep only a shortened, hashed form of it, for about one day.
- Gift idea statistics: how often an idea was shown or clicked, per country and day. These counts contain nothing about you.
Our legal basis is our legitimate interest in running the exchange the organizer asked for and in keeping the service safe (Article 6(1)(f) GDPR), and, for organizers, providing the service they requested (Article 6(1)(b) GDPR).
Who can see what
The organizer sees the participants' names and whether each has opened their link. The organizer never sees who drew whom. Each participant sees the name, wishlist and interests of the one person they buy for. Nobody else sees any of it, and we do not sell or share personal data for advertising.
Who processes data for us
- Hetzner Online GmbH, Germany: hosting. The database is stored in Germany.
- Cloudflare, Inc.: delivery of the site, protection against attacks, the bot check on the form and cookieless visit statistics.
- Resend, Inc.: sending emails.
Where a provider processes data outside the European Economic Area, this happens under the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
Everything about a group, including names, email addresses, wishlists and email records, is deleted automatically 30 days after the event date. The organizer can delete the group earlier at any time. Abuse-prevention records last about one day. If you ask us to stop emailing you, we keep a hashed form of your address so that we can honour the request; tell us if you want it removed. Statistics without personal data are kept.
Cookies
We do not use advertising or tracking cookies, so there is no cookie banner. If you choose a shopping country, we store that choice in one cookie named market. The bot check provided by Cloudflare may use storage that is strictly necessary to work. We count visits only in aggregate, without cookies and without identifying visitors.
Links to shops
Gift ideas link to shops such as Amazon, eMAG or Etsy, sometimes through affiliate networks. We send them no personal data. Once you are on their site, their own privacy policies apply.
Your rights
You can ask us for access to your data, to correct or delete it, to restrict or object to its use, and to receive it in a portable form. Write to hello [at] secretsantaideas.com. If an organizer added you and you would rather not take part, ask them or us to remove you. Every email we send has a link to stop further emails. You may also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or to the authority in your country.
Children
The service is intended for adults. Please do not enter the details of children under 16 without a parent's agreement.
Changes
If this policy changes, the new version is published here with a new date.