Privacy notice
How elfdraw handles personal data
elfdraw is a Secret Santa tool by techflare. This notice explains what happens when an organizer runs a draw. It is written for users in the EU/EEA under the GDPR. It is not legal advice.
Controller
The controller of personal data for a given draw is the organization (or person) that operates this elfdraw instance and whose organizer enters participant details — typically techflare when hosted by us.
Contact for privacy requests: [email protected] (or the contact published by your instance operator).
What we process
- Participant name and email address
- Group details the organizer chooses (group name, optional budget, optional message, optional exclusion pairs)
- Draw metadata (whether the draw is locked, when emails were sent, assignment mapping stored only for integrity of the locked draw)
We do not ask for accounts, payment data, or marketing preferences.
Why we process it
To run a Secret Santa draw and email each participant only their own assignee. Legal bases typically relied on:
- Legitimate interests (Art. 6(1)(f) GDPR) — organizing a limited workplace or community gift exchange; or
- Consent where your organization requires it for this use.
Organizers must only enter emails of people who expect to take part in the draw.
Who receives the data
- Hosting / database — the server and PostgreSQL database configured for this instance (under the operator’s control).
- Email delivery — depending on configuration, either your SMTP provider or Mailjet (API), to send the assignment emails. Mailjet acts as a processor; see Mailjet’s privacy information and ensure a data processing agreement is in place.
Assignment emails contain only the recipient’s match — not the full draw list. We do not sell personal data.
Cookies and tracking
elfdraw does not use advertising or analytics cookies. Fonts are self-hosted so the browser does not call Google Fonts. Only technical storage needed to operate the site may be used by your browser.
Retention
Group records (including names, emails, and locked assignments) remain in the database until the instance operator deletes them. Ask the operator if you need a retention period or deletion for your organization.
Your rights
Under the GDPR you may request:
- Access to your personal data
- Rectification or erasure
- Restriction of processing
- Objection to processing based on legitimate interests
- Data portability where applicable
Contact the controller using the address above. You may also lodge a complaint with your local supervisory authority (in Slovenia: the Information Commissioner — ip-rs.si).
Changes
This notice may be updated when the product or processors change. Last updated: 14 October 2026.