Privacy Policy

Flippingeasy LLC, trading as Realtap operates Secret Santa Generator at https://secretsanta.realtap.app and is the responsible party (data controller) for the personal information described here. Contact: [email protected].

This policy is written to meet the Protection of Personal Information Act (POPIA) in South Africa and the General Data Protection Regulation (GDPR) for people in the European Economic Area and the United Kingdom.

• Group details: group name, year, optional gift budget, and a hashed admin password. We never store the password itself.
• Participant details: the name and optional email address the organiser enters, a generated login code, wishlist items (titles and links), and the Secret Santa assignment.
• Organiser email (optional): if the organiser gives an email address when creating a group, we use it once to send the invite code and dashboard link. It is not stored.
• Purchase details: if a group is upgraded, Stripe sends us the checkout reference, the amount paid and the email used at checkout. Card numbers are handled only by Stripe.
• Technical data: IP address and request logs used for security and rate limiting, kept for a short period.

Organisers enter participants’ names and emails. By doing so they confirm they are allowed to share those details with us for the purpose of running the gift exchange.

• To run your group, deliver login emails and show assignments and wishlists (performance of a contract / legitimate interest of the organiser).
• To process and record the Unlimited upgrade (performance of a contract, and legal obligations for tax and accounting).
• To keep the Service secure and prevent abuse (legitimate interest).

We do not sell personal information, show advertising, or use the data for profiling.

We set one strictly necessary, encrypted session cookie (secret-santa-session) so you stay signed in. It expires after 24 hours. We use no analytics or advertising cookies, so no cookie banner is shown. Your browser’s local storage may hold the group you are joining while you move between pages.

• Stripe (payments) when a group is upgraded. See Stripe’s privacy policy at stripe.com/privacy.
• Cloudflare Web Analytics to count page views and measure performance. It sets no cookies, does not fingerprint devices and does not track visitors across sites. Cloudflare also provides our hosting network.
• Email delivery provider to send login links to participants who have an email address.
• Cloudflare, which routes traffic to the Service and protects it from attacks.
• Other participants in your group: your name and wishlist are visible to the person assigned to you; the organiser can see all names, codes, wishlists and assignments.

Some of these providers process data outside South Africa, the EEA or the UK under their standard contractual safeguards.

Group data is kept while the group exists so you can reuse it next year. We delete a group and everything in it on request from the organiser. Purchase records are kept for as long as tax and accounting law requires. Security logs are kept for up to 90 days.

Data is sent over HTTPS, admin passwords are hashed with bcrypt, sessions are encrypted, and login attempts are rate limited. No system is perfectly secure; please keep invite codes, login codes and admin passwords private.

You may ask us to access, correct or delete your personal information, to object to or restrict processing, or to receive a copy of your data. Participants can also ask the organiser to remove them from a group. To exercise a right, email [email protected]. We respond within 30 days.

If you are unhappy with our response you may complain to the Information Regulator of South Africa (inforegulator.org.za) or, in the EEA or UK, to your local data protection authority.

Organisers must be 16 or older. Children may take part in a group only when a parent, guardian or organiser enters their details with appropriate consent. We do not knowingly collect children’s data directly.

We may update this policy. The date at the top shows the latest version.