Privacy policy

Who operates Elf Mailroom

Business name

Webz Australia

Business address

Level 17, 31 Queen Street, Melbourne VIC 3000, Australia

Country of establishment

Australia

Support and privacy contact

support@elfmailroom.com

ABN

28 921 782 435

Contact us with your order reference where relevant. Do not send card details or extra sensitive information about a child.

Information you provide

We receive the adult purchaser’s email, the child’s first name, wishes, achievements and any optional pet, toy or message details you submit. We also keep the chosen design and language, generated letters, rewrite instructions and exclusions, revision history, accepted version and PDFs. Provide only details needed for the letter. Do not submit addresses, dates of birth, school names, health information or other sensitive details about a child.

Orders, payments and technical data

We store purchase references, payment status, checkout references, price and relevant timestamps. Stripe processes the payment; our application does not store full card numbers or card security codes. Our hosting and security infrastructure may process IP addresses, request information and operational logs. If you use an account, we store your email and a protected password hash.

Why we use the information

We use these details to create the letter, take payment, provide private access and PDF downloads, process rewrites, send delivery emails when enabled, answer support requests, prevent misuse and meet legal obligations. We do not use the child’s letter details for advertising.

Australian privacy requests and complaints

You may ask Webz Australia for access to or correction of your personal information, or make a privacy complaint, using the contact above. Explain your concern so we can investigate and respond. Where the Australian Privacy Act applies, you can escalate an unresolved complaint to the Office of the Australian Information Commissioner (OAIC), subject to its complaint requirements. The operator must confirm whether the Act and other relevant privacy laws apply, and identify overseas recipient countries and safeguards in the provider information below.

Legal bases where the GDPR applies

We use the adult purchaser’s necessary order and contact details to perform the purchase contract, records required by law to comply with legal obligations, and proportionate security and support processing for legitimate interests. Processing a child’s details for an adult-requested personalised letter requires an appropriate legal basis and safeguards for the child. The operator must complete and document that assessment before launch; accepting purchase terms is not blanket consent to unrelated processing.

Who receives the data

OpenAI receives the supplied letter details and, for rewrites, previous text and editing preferences so it can generate the letter. Requests use the API with response storage disabled; this does not mean the provider has no security or other retention. Stripe receives payment and billing information. When email is enabled, the configured email provider handles the recipient address, private review link and accepted PDF. Hosting providers and authorised administrators can process data needed to operate and support the service. We may disclose information where legally required.

Browser storage and external fonts

The draft and purchase-access token use session storage. The language preference uses local storage. Essential guest and login cookies provide access; guest cookies last up to 30 days, user sessions up to seven days and admin sessions up to eight hours. You can clear browser storage, but may lose a draft or access saved only in that browser. The site loads fonts from Google Fonts, which involves requests to Google and disclosure of technical data such as an IP address. Optional Google Analytics loads on public landing pages only after you accept analytics cookies. It measures visits and receives technical information such as your IP address and browser information. We do not load it on letter forms, private purchase pages or admin pages, and omit URL queries, fragments and referrers from configured page views. Advertising features are disabled. Analytics cookies (_ga and _ga_*) and your consent choice (elf-cookie-consent-v1 in local storage) last up to 180 days. Rejecting analytics does not affect purchases. Use Cookie settings on the landing page or letter app to change your choice; rejecting removes accessible analytics cookies and stops future collection. Withdrawal does not erase information already collected. Google processes analytics data; its storage locations and property retention settings must be included in the provider and retention details below.

Six-month access and deletion

Your child’s details, letter versions, rewrite instructions and PDFs are available for six calendar months after payment. Download and save your PDF before then. At expiry, the private link stops working and this content is automatically deleted from our active database within one minute, or when the service next starts after downtime. Unpaid orders expire six months after creation. Separate purchase and accounting records may be retained for legal obligations. This does not delete copies you downloaded, received by email, or that providers retain under their own policies. Backup and log retention is described separately below.

Your rights and requests

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Contact us using the details above; we may need proportionate information to verify your request or authority to act for a child. Where the GDPR applies, you may complain to the relevant data-protection authority, including the authority where you live or work.

Updates

We will update this notice when our processing changes. The version is shown above. New purposes, providers or retention rules must be reflected in the notice and, where required, communicated before they take effect.

Checkout analytics

With analytics consent, our server sends Google Analytics checkout starts, confirmed purchases, failed payment attempts and expired checkouts. This includes pseudonymous browser and session identifiers, a transaction reference, product design, value and currency. We never send names, email addresses, letter text or private links. Sandbox purchases use a separate test event. Google scripts remain excluded from letter forms, private purchases and admin pages. Local event delivery records are kept for up to 72 hours; the order analytics consent record expires within 180 days. Rejecting analytics stops future tracking for that browser and removes queued events when the server receives the withdrawal. Events already sent remain subject to Google Analytics retention settings.

Retention schedule

Child details, letter versions, rewrite instructions and PDFs are kept for six calendar months after payment, then removed automatically from the active database; private links expire at that time. Unpaid orders expire six months after creation. Downloaded and emailed copies are outside our control. Separate purchase, accounting and terms-acceptance records are retained where required for accounting, disputes or legal obligations. Support correspondence is retained while needed to resolve enquiries and related obligations. Operational logs are used for troubleshooting and security. Google Analytics data is subject to the property retention settings and Google processing policies. Automated off-server backups are not currently configured; a restricted migration copy remains on the previous server pending retirement and is not used to serve letters.

Hosting, email providers and international transfers

Fasthosts hosts the application and active letter database in the United Kingdom. OpenAI processes the details supplied for letter generation and rewrites. Stripe processes payment and billing data. Google hosts our support email and provides Google Analytics, which loads on public pages only after consent. Brevo is the planned transactional email provider; automated email delivery is currently disabled. These providers may process data outside Australia and the United Kingdom under their service terms and applicable data-protection arrangements. Contact support@elfmailroom.com for provider and privacy questions.