Privacy

Privacy notice for elf.watch

Last updated 8th November 2026. This notice covers this website, elf.watch, including the free Elf Tracker at elf.watch/tracker (outside the season you can join its waiting list), its Elf HQ emails and alerts, invite links, calls from your Elf, the free call for inviting friends, Elf Watch Studio and the video packs you can buy at elf.watch/packs. The Elf Watch app has its own privacy notice, which you see in the app. Our terms of use cover both the app and this website.

Who we are

This website and the Elf Tracker are run by Dubois Group Ltd, trading as Elf Watch ("we", "us"), a company registered in England and Wales, company number 16649416, registered office C/O Stuart McBain Ltd, Unit 14, Tower Street, Brunswick Business Park, Liverpool, L3 4BJ, United Kingdom.

Under UK GDPR, and EU GDPR for families in the European Union, we are the data controller for the personal data described here. You can reach us at hq@elf.watch.

Dubois Group Ltd is registered with the Information Commissioner's Office as a data controller, registration number ZC284957.

The short version

Only grown-ups make accounts. For the Elf Tracker we keep the grown-up's email address, the Elf (its name and which Elf it is), the children's first names only and the family's town. Never a surname, a date of birth or a home address (an age band only if you choose to give one). We never ask for photos of children. The only exception is the optional reaction clip in Elf Watch Studio, which is off until a grown-up switches it on, is seen only by your family and is deleted on 31st January each year. If you buy a call from your Elf, we also use your child's age and a few things you tell us about them to make the call, and we delete those details once the call is made. We advertise Elf Watch to grown-ups on Instagram and Facebook. Only if you say yes to advert cookies, we use Meta's tools to see which adverts bring families to us; say no and nothing from Meta loads. Children's names and anything about your children are never shared with Meta or any advertiser, the Elf Tracker and Elf Watch Studio never carry advert cookies, our emails only tell us whether they were opened and which links were tapped, and we never sell your data.

What we collect, and why

We collect what you type into a form, plus a small amount the website needs to work and stay safe. Nothing else.

If you choose to, you can tell us an age band for each child (under 3, 3 to 5, 6 to 8, or 9 and over). We never ask for a date of birth. We use the age band only to suit what your Elf says to that child and the offers we show you, and, combined with other families, to understand who uses Elf Watch. It is optional, you can change or remove it at any time in your tracker, and it is deleted with the child's name when you delete your account or at the end of the season clear-out.

We hold the email addresses of last season's Elf Watch app customers (2025), including those who said no to app notifications, and send them Elf Watch news, with an unsubscribe link in every email. We delete the details of anyone who has not come back to Elf Watch by 31st January 2027.

We only keep a scrambled version (a hash) of sign-in codes and passwords, never the code or password itself. We never ask for photos of children. The only exception is the optional reaction clip in Elf Watch Studio (see above), which is off until a grown-up switches it on and is seen only by your family.

Children

This website is written for parents and carers. Only a grown-up can make an Elf Tracker account, and the grown-up decides what the children see. We do not knowingly collect personal data from children. If you believe a child has given us their details, email hq@elf.watch and we will delete it.

We designed the Elf Tracker with the ICO's Children's Code (the Age Appropriate Design Code) in mind:

• As little as possible: children's first names only, typed in by the grown-up, and an age band only if the grown-up chooses to give one. No surnames, dates of birth or locations, and we never ask for photos of children. The only exception is the optional reaction clip in Elf Watch Studio, which films a child watching their video only if a grown-up has switched it on, is seen only by the family, and is deleted on 31st January each year. A call from your Elf also uses the child's age and a few short things the grown-up types, only to make that one call.
• Nothing asked of children: the children's view only plays things. There is nothing to type, no chat and no sharing. The only thing it can record is the optional reaction clip in Elf Watch Studio, and only when a grown-up has switched it on, on the grown-ups' screen, before handing over the phone.
• No profiling and no advertising to children: we never build a profile of a child or show adverts in the tracker. Our adverts are for grown-ups, and the Elf Tracker and Elf Watch Studio never carry advert cookies.
• No location tracking: only the town a grown-up types in, never the phone's location.
• Private by default: news and offers, and alerts, stay off until a grown-up turns them on. Nothing about your family is public.
• Grown-ups' lock: leaving the children's view needs a grown-up question, so children cannot change settings.
• Children's names stay out of view: they never appear in email subject lines, email preview lines or phone alerts, which others might see on a lock screen. Invite messages never name the children or the Elf. If you choose to share a sighting with family and friends, the message shows the camera picture, but never the children's names.

Calls from your Elf. To make a call, a grown-up tells us a few things about one child. We ask for the child's first name only, their age (2 to 12) and a few short, everyday things such as something they are proud of. We ask grown-ups not to include surnames, addresses, school names, health information or anything private, and our checks automatically refuse anything that looks like a link, email address, phone number, postcode, street address, date or birthday, as well as brand names and unsuitable words. We never ask the child anything: the child only listens. The words are written by our team, with the child's details added; nothing about the child is used to profile them, to advertise, or to train any AI system. We keep the details until 1st January 2027, so we can fix a call if anything goes wrong (for example, make it again if it did not work), then we delete them from our database. The finished recording, which says those details out loud, and the words that go with it, stay on the family's tracker until 31st January, then we delete them.

The Elf Watch app is used by a parent, not a child. Videos are created by the parent and revealed by the parent, and any reaction recording is started by the parent and stays in the parent's own account. The app's own privacy notice covers this in full.

Cookies and browser storage

Advert cookies only if you say yes. When you first visit elf.watch we ask whether we can use advert cookies. Say no and nothing from Meta loads. You can change your mind at any time: Cookie choices. The Elf Tracker and Elf Watch Studio never carry advert cookies. The tracker's sign-in cookie is strictly necessary, so it does not need a yes.

• Advert cookies (only after yes): the Meta Pixel from Meta Platforms Ireland Limited sets "_fbp" (up to 90 days), and "_fbc" if you arrived from one of our adverts (up to 90 days). It tells Meta which elf.watch pages you visit, so we can see which Instagram and Facebook adverts bring families to Elf Watch and show them to more people like you. If you then join the waiting list, make a tracker account or buy something, our server also tells Meta that it happened (with the amount for a purchase), sending a scrambled (hashed) copy of your email address, your IP address and browser name and those cookie values, so Meta can match it to the advert. For a purchase we keep those details on the order only until the payment goes through, and at most 7 days. We never send Meta children's names, Elf names, call details, your town, or anything you tell us about your children. Your choice is remembered in your browser for 6 months ("ew_ads"). Meta and Elf Watch are joint controllers for collecting and sending this data; what Meta does with it after that is covered by Meta's privacy policy, and you can control Meta adverts in your Meta account settings.
• One cookie, "ew_s": set only when you sign in to the Elf Tracker. It keeps you signed in, is only sent to the tracker, and lasts up to 60 days or until you sign out.
• Browser storage: the Elf Tracker remembers a few things in your own browser's storage (local storage and session storage), which never leave your device on their own: your sign-in email to show on screen, an unfinished set-up so you can carry on where you left off (the elves' and children's first names, the Elf you picked and your town, kept up to 7 days, and deleted from the browser once you save the tracker), an invite code you arrived with (kept up to 30 days), your chosen language, and the grown-ups' lock on the children's view. Elf Watch Studio remembers in the same way whether its children's view is open, whether you switched reaction clips on, and which videos the children have played. Signing out removes your sign-in note, and you can clear all of them yourself in your browser settings at any time. The one exception is the random code that keeps the free Elf call fair: a scrambled copy of it is sent to us when you sign up.
• Bot check: to stop automated sign-ups and spam we use Cloudflare Turnstile when you ask for a sign-in code, join a waiting list or send us a message. It does not set advertising cookies.
• Waiting-list forms (the doll and camera waiting list, the Elf Tracker waiting list and the "Tell me when they're live" lists for Elf calls and Elf Watch Studio) send your email address to our own server at Cloudflare, not to Mailchimp, and the tracker's globe loads mapping code from Cloudflare's library server. Those services see your IP address as part of delivering the request.

Links to Instagram (instagram.com/elfwatchapp), Facebook (facebook.com/elfwatchapp), TikTok (tiktok.com/@elf.watch) and WhatsApp are ordinary links. We do not embed them, so they are not told you visited us. Once you click through, their own privacy policies apply.

The Elf Watch app and keeping one login

The Elf Tracker and the Elf Watch app are two parts of the same Elf Watch experience. The app is built and run for us by Radical Company (Europe) Limited ("Radical"), who also run the Elf Watch customer system (CRM) that sends app news. So that you have one login and do not need to type your details twice:

• When you tap an app button in the tracker or an Elf HQ email, we pass your tracker profile to the app: your email address, language, town, your elves (name, type, boy or girl), the children's first names, and your news and offers choice. Each app link works once. Links on the tracker expire after 30 minutes, links in emails after 72 hours.
• Our customer system: Radical builds the Elf Watch app and runs our customer system (CRM) for us, as our processor. Once that link is switched on, your tracker account details and updates are kept there too: when you sign up, your Elf, your Elf's sightings and take-off, and when you delete your account (so the copy there is deleted as well). This is what lets one login work on the website and in the app.
• Video packs: if you open the Elf Watch app before Elf Watch Studio, the app's server, run by Radical, asks us whether videos are waiting for the email address you signed in to the app with. We tell it how many videos, that they came from a pack bought on elf.watch, and when, so the app can add them. Radical does not receive the price or your payment details from us.
• From the app we get a few things back: that you linked your app account, that you made your first video, and that you shared videos. We use them to keep the tracker and the app in step.

Who else handles your data

These companies act as our processors: they only use your data to provide their service to us.

• Cloudflare (Cloudflare, Inc.) hosts the website, stores the Elf Tracker's accounts, runs the tracker's sign-in and email schedule, runs the Turnstile bot check, and keeps standard server logs to serve the site and protect it from abuse.
• Amazon Web Services (Amazon Simple Email Service, London region) sends the sign-in codes, the Elf HQ emails, the waiting-list emails, and contact form messages, partnership enquiries and influencer applications to our inbox. If an email bounces or someone marks it as spam, Amazon tells us so we stop emailing that address. Amazon also tells us whether an email was opened and which links in it were tapped, using a tiny image in the email and links that pass through Amazon first. Some buttons in our emails also pass through elf.watch first, so we can count which button was pressed. We use this only to see which emails reach families and work, never for advertising.
• Mailchimp (Intuit Inc.) stores our older mailing lists (the app launch list) and sends those emails. For those lists Mailchimp emailed you to confirm you meant to subscribe before we ever sent you anything. Since 1st November 2026 the doll and camera waiting list is kept by us, on our own system with Cloudflare, and its emails are sent through Amazon: we moved the people already on it from Mailchimp to our own system, and they keep the same choice to unsubscribe at any time. Their privacy policy is at intuit.com/privacy/statement.
• Radical Company (Europe) Limited builds and runs the Elf Watch app and its customer system, as described above.
• Alibaba Cloud (Alibaba Cloud (Singapore) Private Limited, its Model Studio service) makes the videos in Elf Watch Studio. For each video it receives your Elf photos, the room photo and the scene's description, and sends back the picture and the video, which we then keep in our own storage with Cloudflare. Its copies of the results expire after 24 hours. It never receives reaction clips of your children.
• Meta (Meta Platforms Ireland Limited) receives the advert measurement described under "Cookies and browser storage", only if you say yes to advert cookies. For this, Meta is a joint controller with us, not our processor.
• Your browser's alert service (Apple, Google, Mozilla or Microsoft, depending on your phone or browser) delivers alerts if you turn them on. They see the alert text, which names the Elf, never the children.

For calls from your Elf and video packs:

• Stripe (Stripe Payments UK Limited and Stripe, Inc., United States) takes card and other payments. Stripe receives your email address, your payment details and the order lines, which name the call and the Elf (for a video pack, only the pack and how many videos, with no names). Your card details go straight to Stripe and never reach Elf Watch. Stripe acts as our processor to take the payment, and as a separate controller for what it must do by law, such as preventing fraud and keeping financial records. See stripe.com/privacy.
• RunPod (Runpod, Inc., United States) runs the computers that make the Elf's voice, in data centres in the European Union only. It receives the words of the call, which include the child's first name and the details you gave, and nothing else about you. It sends back the sound and keeps nothing; our program never writes the words of a call to its logs.
• Microsoft (Microsoft Ireland Operations Limited), through Azure AI Speech in its Sweden Central region in the EU, makes the Elf's voice instead if our own voice service is not available. It receives the same words and nothing else about you.
• Amazon Web Services (Amazon Simple Email Service, London region) sends your order confirmation, "your call is ready" and refund emails, and your video pack receipt.
• Cloudflare hosts the website, keeps the order and call records in its database in the European Union, and stores the recordings in its file storage.

We do not sell or rent your personal data. The only advertiser we share anything with is Meta, as described above, and only after you say yes to advert cookies. We may share it if the law requires us to, for example with HMRC for prize payment records.

If you report a problem on our website, what you wrote and technical details about the fault (page, device and error messages) may be processed by Anthropic, our AI provider, to help us find and fix it. Your email address is not shared with them for this purpose.

Transfers outside the UK and EU

Cloudflare, Amazon and Intuit (Mailchimp) are based in the United States, and Alibaba Cloud makes the Elf Watch Studio videos in Singapore, so your details may be handled outside the UK and the EU. We protect those transfers like this:

• Cloudflare and Intuit (Mailchimp): both are certified under the EU-US Data Privacy Framework and its UK Extension. Transfers to them rely on that certification. Their data processing terms, which form part of our contracts with them, also include the EU Standard Contractual Clauses with the UK Addendum in case the certification ever stops applying.
• Alibaba Cloud: its UK and EU data processing addendums, which form part of our contract with it, include the EU Standard Contractual Clauses and the UK International Data Transfer Addendum for transfers to Alibaba Cloud (Singapore) Private Limited.
• Meta: Meta Platforms Ireland Limited may share the advert measurement with Meta Platforms, Inc. in the United States, which is certified under the EU-US Data Privacy Framework and its UK Extension; Meta's terms also include the EU Standard Contractual Clauses.
• Amazon Web Services: sends our emails from its London region. Its data processing terms, which apply to our account automatically, include the EU Standard Contractual Clauses and a UK addendum if data ever has to leave that region.

For calls from your Elf and video packs:

• RunPod is a US company. We use only its EU data centres, so the words of a call are processed in the EU, but because RunPod is based in the United States we treat this as a possible transfer and protect it with the EU Standard Contractual Clauses with the UK Addendum in our data processing agreement with RunPod.
• Microsoft makes the backup voice in the EU (Sweden). Microsoft is certified under the EU-US Data Privacy Framework and its UK Extension, and its Data Protection Addendum includes the EU Standard Contractual Clauses and the UK Addendum for any access from outside the UK and the EU.
• Stripe: payment data may be processed by Stripe, Inc. in the United States. Stripe is certified under the EU-US Data Privacy Framework and its UK Extension, and its data processing terms include the EU Standard Contractual Clauses and the UK Addendum.

The Elf Tracker's database is kept by Cloudflare in the European Union.

How long we keep it

• Mailing lists (including the doll and camera waiting list and the Elf Tracker waiting list): until you unsubscribe, or until 12 months after the season you signed up for, whichever comes first. Unsubscribing takes you off that list, on our own system or in our Mailchimp audience for the lists still kept there.
• "Tell me when they're live" lists (Elf calls and Elf Watch Studio): we keep your email address, your language, your country and the words you agreed to, only to send you one email when that feature opens. Your email address is deleted 30 days after that email (and in any case 30 days after the feature opens), or straight away if you unsubscribe.
• Your Elf Tracker account (email, password, elves, children's first names, town, consent record, invite code, alerts and the record of emails sent): until you delete it. If nobody signs in for 12 months, we delete it automatically with everything in it.
• Elf Watch Studio: your Elf photos and your videos are kept until you delete them or your account. Room photos are deleted 30 days after the video is made. The record that a video was made (the date, the scene and the video it used) stays with your account. Reaction clips (only if you switched them on) are deleted on 31st January each year, or sooner whenever you delete them, so save the ones you want to keep; deleting a video or its Elf deletes its reaction clips too.
• Sign-in codes work for 10 minutes. Sign-ins last up to 60 days. Email sign-in links last 24 hours and app links 30 minutes to 72 hours. All of these are deleted the day after they expire. Counters that stop code guessing are deleted after 1 day.
• Stopped emails: if you unsubscribe, or an email to you bounces or is reported as spam, we keep that and the date while your account exists, so we never email you again by mistake.
• Records of emails sent and anonymous counts: deleted after 13 months (or with your account, for the email record).
• Messages to Radical's customer system: our copy is deleted 30 days after it is delivered, or after 90 days if it never is.
• Order and tax records: we keep the record of everything you buy from us on the website (order reference, date, what you bought, the amount, the tax, and the countries of your card address and internet connection) for 10 years, because tax law requires it, even if you delete your account.
• Calls from your Elf: the details you type about a child (age, answers, topics, the Elf's personality, the things your Elf did, the present and the Christmas dinner) are kept until 1st January 2027, so we can fix a call if anything goes wrong, then deleted from our database. This is the same whether the call was made, could not be made or was refunded. If you start an order but do not pay, the order and its details are deleted after 2 days. The finished recording, the words that go with it, the child's first name and the Elf's name on the call are kept until 31st January after that Christmas, then deleted, or straight away if you delete your Elf Tracker account. The phone link works for 48 hours and contains no names. Your order and payment record, and the record that you agreed to us making the call straight away, are kept as order and tax records (see above). Stripe keeps its own payment records for as long as the law requires it to.
• Video packs: your order (your email address, the pack, the price, the date, the record of your tick and the tax facts) is kept as an order and tax record (see above), even if you delete your Elf Tracker account. Deleting your account unlinks the order from it. Videos you have not used yet stay waiting for that email address, so you can still use them in Elf Watch Studio or the Elf Watch app. The details kept for Meta (only if you said yes to advert cookies) are cleared once the payment goes through, and at most after 7 days.
• Contact form and email messages: deleted when no longer needed, and at the latest 2 years after the conversation ends.
• Partnership enquiries and influencer applications: 24 months from your enquiry, then deleted.
• Advert cookies: your yes or no is kept in your browser for 6 months, then we ask again. Meta's cookies last up to 90 days, and saying no later deletes them from elf.watch. What our server sends to Meta is not kept by us afterwards; Meta keeps it under its own policy.
• Server logs: Cloudflare does not keep full request logs for our account. Its traffic and security reports, which can include IP addresses, cover the last 31 days. The logs of our own tracker functions are kept for up to 7 days.

A clear-out runs every night to make sure the Elf Tracker limits above are kept. You can ask us to delete your data sooner and we will, unless we are legally required to keep it.

Your rights

Under UK GDPR, and EU GDPR if you live in the European Union, you can ask us to: give you a copy of your data; correct it; delete it; restrict how we use it; or send it to you in a portable format. You can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time, which does not affect anything we did before you withdrew it. We do not make decisions about you by automated means alone.

• Delete your Elf Tracker account yourself: at the bottom of your tracker page, choose "Delete my account". This removes your account, elves, children's names, town, consent record, invite code, sign-ins, app links, alerts, email record and your Elf Watch Studio elves, photos and videos at once, and tells Radical's customer system to delete its copy.
• Stop emails: every Elf HQ email and every mailing list email has a one-click unsubscribe link. In the Elf HQ emails you can stop just the camera emails, or all of them.
• Turn off alerts: in the tracker, or in your phone's settings.
• The Elf Watch app: you can permanently delete your app account and everything in it at any time. See delete your account for how, in the app or by email.

If you ask us to delete a call, we delete the recording, its words and the call record straight away. We keep only the order and payment record the law requires. If you ask for a copy of your data, it includes the details you gave for your calls while we still hold them (until 1st January 2027), and you can download any finished call from your tracker yourself.

To exercise any of your rights, email hq@elf.watch. We will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or call 0303 123 1113. If you live in the European Union, you can also complain to the data protection authority in your country. We would rather you told us first, so we can put it right.

Changes

If we change this notice we will update the date at the top. If the change is significant and we hold your email, we will tell you.