A little care.
A lot of trust.

This notice explains what we keep when you make a film with The North Pole Workshop, why we keep it, who helps us, and when we delete it. Your children’s photos, video and names are used for one thing only: your family’s film and certificate.

Last updated 3 November 2026

Who we are

The North Pole Workshop is run by WHITE ACE AI LTD, a company registered in England and Wales (company number 16950816), with its registered office at 45 Albemarle Street, London, England, W1S 4JL. We are registered with the Information Commissioner’s Office, registration number ZC076457.

We decide how your information is used, so we are its controller under UK data protection law. For anything about your information, email info@whiteaceai.com. You don’t need to sign in first.

What we keep, and why

Your account

Your email address, when you joined and when you last signed in. We use them to sign you in and to email you about your films. A sign-in link works once and expires after 15 minutes. Signing in keeps you signed in on that device for 30 days, unless you sign out. We store only scrambled fingerprints (hashes) of sign-in links and sessions, never the links themselves.

Your family’s film

Each child’s first name and photo, one video, and for two or three children a photo of them all together. Also the recording of the goodnight line you approve, the box you tick to confirm you may share their photos and video, how you fitted each photo into its frames, and a record of exactly what you approved, so the film matches it. We use these to make and deliver your film and certificate, and to help you with them if you ask.

Your order

What you ordered, the price, the date, your order reference, and when you asked us to start making your film straight away. Stripe tells us when your payment has gone through, with the name you paid with. We keep only your first name from it, so our emails can greet you by name, and it is deleted with your order.

Your gift link

Your order’s free gift link is kept with your account, and we note when it is used so that it only works once. If you add who it’s from and a short message, we keep them with the link and show them to whoever opens it, on the present and in Santa’s letter. Who it’s from also appears on the little card a messaging app makes when the link is shared. When a family uses your link, we email you to say your present has been opened. We never show the family who uses it your email address or your order, and we never show you their details.

Messages and emails

We email you sign-in links and news about your order, your film and your gift link. If you send us a note from the help page, it comes straight to us by email, and the site keeps no copy. If you reply, or email us, your message comes to us and we keep it so we can answer.

Keeping the site safe

To stop misuse, we count some requests, such as sign-in emails, using scrambled versions of email addresses and internet (IP) addresses. Each count is deleted within about a day. Our own logs hold reference numbers and short codes, never names, photos or email addresses.

Why we may use it

• Your account, your order and the emails about them: we need them to give you what you asked for (our contract with you).
• Your children’s names, photos, video and goodnight recording: you ask us to use them, with their parent’s or guardian’s permission (consent). You can take that permission back at any time by deleting the draft or film in My films, or by emailing us.
• Payment records: to take payment and to keep our company accounts (our contract with you, and the law).
• Help messages, and keeping the site safe and working: our legitimate interest in helping you and running a safe service.

Your children’s photos and video

Please only add photos and videos you are happy for us to use. You must be an adult, and their parent or guardian or have their parent’s permission. It’s best to leave out anything you’d rather keep private, such as a school badge or a house number.

• Santa watches the first 8½ seconds of the video on his tablet. The sound is never used.
• Each child’s photo goes on Santa’s Nice List boards.
• With two or three children, the photo of them all together goes in the middle of Santa’s boards and into a little surprise with Rudolph. With one child, their own photo is used there.
• Their first names are written in Santa’s Nice List and on the moon, spoken in the goodnight line, and printed on the certificate.

When you add a photo, we read its size and which way up it goes from the file itself, so it shows the right way up and sharp in its frames. Photos from a phone can also hold other details, such as when and where they were taken. We don’t use those details, and they never appear in your film. They stay inside the photo you sent, which we keep privately and delete on the dates below.

On the site, only you can see your files and films, when you are signed in. There are no public links or galleries. We look at them ourselves only when we need to, to help you or to fix a problem with your film. Your photos and video go only to our own storage and render servers. They are never sold, never used for advertising and never used to train AI.

Who helps us

A few trusted companies help us run the workshop. Each one gets only what it needs.

• Cloudflare runs the website, keeps our database and your files, and sends our emails. The database and your files are stored in the EU.
• Hetzner runs our render servers in Finland, in the EU, where the elves make each film. Your files are copied to one of them only while your film is made, then deleted from it.
• Stripe takes payments. Your card details go straight to Stripe and never reach us. Stripe receives your email address and order reference, never your children’s names, photos or video.
• ElevenLabs makes the spoken goodnight line. It receives only that line, with your children’s first names in it: “Sleep tight, … May all your wishes come true.” ElevenLabs is a US company certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises for sending information to the US.

Stripe and Cloudflare work around the world, so they may handle some details, such as your email address and the emails we send you, outside the UK and the EU, including in the US. When they do, they protect it in the ways UK law requires.

We don’t sell your information. We share it only with these companies, to run the workshop, or when the law requires it.

How long we keep it

• Files you upload but never save in a draft: 24 hours.
• Drafts you don’t order: 7 days after you last save them.
• Goodnight recordings you made but didn’t use: 30 days.
• Your original photos and video: 7 days after your film is delivered.
• Your film and certificate: 30 days after delivery. Until then they’re in My films to watch and download, so please save a copy.
• A film still waiting for a new file from you: 60 days after you ordered, with its files.
• Your gift link, with who it’s from and your message: once it can no longer be used and the films it belongs to have been deleted.
• Accounts with no order: 90 days after the last sign-in.
• Payment records: kept by Stripe for our company accounts, for as long as the law requires.

Deleting is automatic, so it happens within about a day of these dates. You can also delete a draft or a finished film yourself in My films at any time.

Your rights

You can ask for a copy of your information, and ask us to correct it, delete it, limit how we use it or stop using it. You can also ask for it in a form you can take elsewhere. Where we rely on your permission, you can take it back at any time. Parents and guardians can usually do this for a child, and older children may have rights of their own.

Email info@whiteaceai.com. We’ll reply within a month. We may need to check it’s really you, and that you can act for the child.

Complaints

If you’re unhappy with how we’ve handled your information, please tell us first at info@whiteaceai.com. We’ll acknowledge your complaint within 30 days, look into it, and tell you what we’ve found and what happens next.

You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, using its make a complaint service.

Cookies and your browser

We set one cookie, and only when you sign in. It keeps you signed in on that device for 30 days, or until you sign out. The site can’t work without it, so we don’t ask first. We don’t use advertising or tracking cookies.

Your browser also remembers two small things, on your device only: whether you’ve paused the site’s animations, and on a gift page, that you’ve already opened the present, so it doesn’t play again.

Keeping it safe

Your files are stored privately and reach you only through your signed-in account, which is checked every time. The website and the render servers talk only over secure, encrypted connections. If something ever went wrong that put you at risk, we would tell you.

Changes to this notice

If we change this notice, we’ll update this page and the date at the top. Our terms explain the rest of how ordering works.