Privacy Policy

Before you start using any service or feature of our website, please read and accept this Privacy Policy. Below we explain, plainly and simply, what we do with your personal data and why we collect it.

What does this privacy policy cover?

This Privacy Policy explains how we collect, use, and safeguard your personal data when you browse our website or use our services, in line with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Data Controller

The controller responsible for your personal data is DANIEL ROSSELLÓ

What personal data do we collect?

To provide our services, we need to collect the following personal data:

• Identifying data: name and email address.
• Registration data: the details you submit through our forms.
• Usage data: information about how you use our services.

What do we use your data for?

We use your personal data solely and exclusively for the purposes below, in line with the GDPR and the LSSI-CE:

• Core Purpose and Service: to carry out and email the results of the automated, fair Secret Santa draw among the participants added. (Data: names and email addresses).
• Essential Communications: to send reminders or resend a draw assignment to a participant who asks for it, so the service is properly delivered. (Data: email addresses).
• Security and Fraud Prevention: to keep our tool secure, intact, and working correctly, and to stop it being misused or used fraudulently.
• Service Improvement: for internal statistics and analysis of how the tool is used (kept anonymous or pseudonymised), so we can improve its functionality and the user experience.

Integration with AI assistants (ChatGPT)

If you use Secret Santa Raffle from within ChatGPT, OpenAI processes your conversation to work out what you want and pick the right tool to call. Once a tool is called, OpenAI sends our gateway server (mcp.secretsantaraffle.net) only the parameters needed to carry out your request — typically a draw date, an optional budget, and the names and email addresses of the participants you mention.

Our gateway does not keep a copy of any of this: it is a stateless go-between. It passes the request on to the same backend behind our website and mobile app, where your data is handled under the exact same terms this policy describes. Nothing received via ChatGPT is enriched, cross-referenced, or sold.

Your conversation with ChatGPT itself is covered by OpenAI's own privacy policy (openai.com/privacy), not this one. We only see the parameters explicitly passed to our tools — nothing more of the conversation.

1:1 chat in the mobile app

If you use the Juego Secret Santa Raffle mobile app, each participant can send 1:1 messages to the person they were matched with in the draw, anonymously — the other person's real name and email are never shown, only their role in the draw (who is giving to whom).

Message content is stored on our servers and, for real-time delivery, replicated to Firebase/Cloud Firestore (Google Ireland Limited). Every message is checked against a blocklist before storage and is automatically censored if it matches.

Any participant can block a conversation, or report a message or a whole conversation. We take a zero-tolerance approach: our moderation team may permanently ban a reported account from the chat, without touching any other feature of the app.

When you delete your account, the messages you sent are permanently deleted (from the database and from Firestore); messages the other person sent you remain untouched, since they are not your content.

Before using the chat for the first time, you must expressly accept the zero-tolerance notice shown in the app; that acceptance is logged with a timestamp.

How long do we keep your data?

Identifying data (names and email addresses) is kept for as long as needed to deliver the service and to keep the draws working.

We don't delete data automatically. If you'd like us to delete your personal data, you may exercise your right to erasure at any time by writing to the email address given in this policy. We will action your request within the timeframe the law sets.

How do we protect your data?

We apply the technical and organisational measures needed to keep your personal data secure and to stop it being lost, or processed or accessed without authorisation. These measures include:

• Encrypting sensitive data.
• Controlling access to data.
• Intrusion detection systems.
• Training staff and raising awareness on data protection.

How long do we keep your data?

We keep your personal data for as long as needed to fulfil the purposes it was collected for, unless the law requires us to keep it longer.

Who do we share your data with?

We may share your personal data with:

• Service providers who help us deliver our services.
• Government authorities, where the law requires it.
• Other entities, where you have expressly consented.

What are your rights?

As the data subject, you have the following rights:

• Right of access: ask what personal data we hold about you.
• Right to rectification: ask us to correct data that is inaccurate or incomplete.
• Right to erasure: ask us to delete your personal data once it is no longer needed for the purpose it was collected for.
• Right to data portability: ask that your data be handed over to another data controller.
• Right to object: object to certain processing of your data.
• Right to lodge a complaint: file a complaint with the competent supervisory authority.

How do you exercise these rights?

You may exercise these rights by emailing:

Cookies

Our website uses cookies to make browsing better for you. Cookies are small text files stored on your device when you visit our website. You can set your browser to accept or reject them.

For more detail on our cookie practices, see our dedicated Cookie Policy section.

Changes to this privacy policy

We may amend this privacy policy at any time. Any change takes effect as soon as it is published on our website.

Contact

If you have questions about our privacy policy or about how we handle your personal data, feel free to reach out to us: