Back to the village

The small print

Privacy notice

Draft of 3 November 2026

This notice explains what personal data Advent Village uses, why, who else handles it, and your rights. It covers three groups of people: buyers (who build a house), recipients (who open the doors) and visitors to the village.

No. 1Who is responsible

The controller of your data is the sole trader established in Portugal who runs Advent Village, trading as Advent Village. Their legal name, geographic address and tax number are available on request at hello@theadventvillage.com. Contact for anything about your data: hello@theadventvillage.com.

We are a very small business and the law doesn't require us to appoint a data protection officer, so we haven't. Write to the address above about anything to do with your data.

No. 2What we collect from buyers

When you build a house, we store:

  • The names you type: who the house is for and who it's from (up to 40 characters each), and the house name (up to 32 characters). The house name starts as your two names and is public on the map, so you can change it to anything you like.
  • Your choices: country, house style, plot, the time zone the doors open in, and the language of the site.
  • Your email address, if you give it on our form. If you don't, Stripe asks for one at checkout and we receive it from Stripe. We use it to send you your private edit link, which is also your order confirmation. We only email you again if you ask for your links on our "Email me my link" page, if you write to us, or if we have to tell you about a decision on your house (see our content policy). We don't send newsletters, marketing or reminders after Christmas.
  • Payment record: price, VAT, currency, the date you paid, the country used for VAT and Stripe's references for the payment. We never receive your full card number.
  • Your IP address, stored with your order only while you're paying, so one person can't hold lots of plots with unfinished payments. We delete it as soon as your payment is confirmed.
  • Which house's link brought you here, if you came from someone else's house through "Make one for someone". We use it only to count how many houses come from invitations, and it is deleted with your house.
  • What you put behind the doors: text and photos. Photos are kept in private storage and shown only through links that expire after a few hours. When you replace a photo, we delete the old one.

If you start paying but don't finish, we delete the unfinished order within about 35 minutes.

No. 3What we collect about recipients

Recipients don't give us anything directly. When they open a door, we record the day number, when it was first opened and how many times. We show the buyer which doors have been opened. We don't store the recipient's IP address with this record.

The doors may contain personal data about the recipient and other people (names, photos, memories). The buyer decides what goes in. We store it and show it only to people who have the house's links.

No. 4What we collect about visitors

Anyone visiting the village map sees the house name, style, country and plot of every house. That's public by design, and anyone can download it from the map.

Our hosting providers process your IP address and basic technical data (browser, time of request) to deliver the site and keep it secure. We don't use advertising trackers.

Visitor statistics

To see which pages people use and where they give up, we count visits and a few steps (for example "started building a house" or "opened a door") with PostHog, hosted in the EU (Frankfurt). It is set up not to use cookies and not to store anything in your browser, not to record your screen or clicks, and not to build a profile of you. Before anything is sent, private parts of web addresses (your edit link, the name of a house link, payment references) are removed. We only ever look at totals. PostHog receives your IP address with each request and our PostHog project is set to discard it rather than store it. [CHECK: confirm "Discard client IP data" is switched on in the PostHog project settings before launch.]

If you ask us to email your links

On our "Email me my link" page you type the email address you paid with. If it has houses, we send one email with their links to that address. We don't show on the page whether the address has houses. To stop abuse we keep, for 24 hours, a scrambled (keyed hash) version of the address and of your IP address, so we can limit how often links are requested. We can't turn them back into the address or the IP address.

If you report a house

When you use "Report this house" or email us a report, we keep the house it's about, the reason, what you wrote (up to 500 characters) and your email if you give one, so we can reply. To stop abuse of the form we keep a scrambled version of your IP address that changes every day and can't be used to identify you over time.

  • To provide your house (building it, taking payment, sending your edit link, sending your links again when you ask, showing doors on the right day, showing you which doors were opened): performance of our contract with you (GDPR art. 6(1)(b)).
  • To show the house name, style, country and plot on the public map: performance of the contract, since a house in a shared village is what you buy.
  • Recording door opens for the buyer: our legitimate interest, and the buyer's, in letting them know their gift arrived (art. 6(1)(f)). We record only the day, the time of the first opening and a count. Recipients can object by writing to us.
  • To stop abuse (limiting unfinished payments per IP address, rate-limiting reports and link requests): our legitimate interest in keeping the village working and safe.
  • Visitor statistics: our legitimate interest in understanding, in totals only, how the site is used.
  • Handling reports and moderation, and telling the people affected about our decisions: our legal obligations under the EU Digital Services Act (art. 6(1)(c)), and our legitimate interest in keeping the village safe.
  • Payment, invoice and tax records (including the country of your payment details, which VAT rules depend on): legal obligation under Portuguese and EU tax law.
  • Answering your messages: our legitimate interest in helping you, or the contract.

We don't make decisions about you by automated means alone, and we don't profile you.

No. 6Who else handles your data

We use these providers to run the village. They process data on our behalf under data processing agreements.

  • Supabase (database and photo storage). Data stored in the EU, in Ireland (region eu-west-1). Your browser also connects to Supabase directly to show the live map and load photos.
  • Vercel (website hosting; our server code runs in the EU, in Dublin).
  • PostHog (EU, Frankfurt) for the cookieless visitor statistics in section 4.
  • Resend (sends the email with your edit link, and your links again if you ask for them). Emails are sent from its EU region, in Ireland.
  • Stripe (payments). Stripe also uses payment data for its own purposes, such as fraud prevention and its legal duties, as an independent controller under its own privacy policy.
  • A certified Portuguese invoicing provider and the Portuguese tax authority (Autoridade Tributária e Aduaneira). Portuguese law requires an invoice for every sale, and every invoice is reported to the tax authority. An invoice shows what you bought, the price and the date; it only shows your name or tax number if you ask us to add them. If we email you the invoice, the provider also receives your email address. We keep invoices for 10 years, as the law requires.

Our email to the support address is handled by Google (Gmail).

Some of these companies are based in the United States or may access data from there, for example for support or security. Vercel, Stripe, Resend and Google are certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Decision (EU) 2023/1795). Supabase and PostHog, and the others as an additional safeguard, use the European Commission's standard contractual clauses (Decision (EU) 2021/914) in their data processing agreements.

We don't sell your data and we don't share it with advertisers. We may disclose data to authorities when the law requires it.

No. 7How long we keep it

  • Houses, doors, photos, names, email addresses and door-open records: until 30 June of the year after the Christmas the house was for (for this season, 30 June 2027), then deleted automatically. You can ask us to delete your house sooner. If a house is refunded or removed, it is deleted straight away.
  • Unfinished orders: about 35 minutes.
  • IP address stored with an order: until payment is confirmed, or about 35 minutes if it isn't.
  • Reports about houses: until the same 30 June as the house they're about, then deleted. Names and emails in our internal record of support actions are removed on that date too, or earlier when the house is deleted.
  • Scrambled email and IP address for "Email me my link": 24 hours.
  • Payment records (amount, VAT, currency, date, the country used for VAT, Stripe references): 10 years after the year of payment, because Portuguese and EU VAT law require it, then deleted automatically. These records don't include your name, your email address or anything from your house. Stripe keeps its own payment records under its own privacy policy.
  • Emails you send us: 2 years after the conversation ends, or longer while a complaint or legal claim about it is open.
  • Backups made by our database provider are overwritten on their own schedule, usually within 7 days.

No. 8Cookies and your browser's storage

We don't use cookies or browser storage for tracking, analytics or advertising, so we don't show a cookie banner. We only store things that are strictly necessary for something you asked for:

  • A cookie called "lang", which remembers which of the site's nine languages you chose. It lasts one year.
  • The order form draft, in your browser's session storage while you're building a house (cleared when you close the tab), so a cancelled payment doesn't lose what you wrote.
  • Unsaved door text, in your browser's local storage, so a reload or a bad connection doesn't lose your words. On a shared computer, this stays in the browser until it's saved.
  • Whether you've seen the opening film, whether sound is on, and whether you've closed the map hint, in local storage.

The village's own staff sign in to a support console with a secure session cookie; visitors never get it. Under the Portuguese electronic communications privacy law (Lei n.º 41/2004, art. 5), storage that is strictly necessary for a service you asked for doesn't need consent. You can clear all of it in your browser settings at any time.

No. 9Your rights

You have the right to ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to get the data you gave us in a portable format. Write to hello@theadventvillage.com. We'll reply within one month.

Because there are no accounts, we need to check a request comes from the right person. We'll usually ask you to write from the email address on the house, or to show you have the private edit link.

If you're a recipient, or someone shown in a door, and you want something removed, write to us too. We'll look at it and, where it's justified, remove it and tell the buyer.

You can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or to the authority in the country where you live or work.

No. 10Children

Buyers must be 18 or over. Recipients can be any age, but they don't give us any data themselves. If a door contains a photo of a child, the buyer is responsible for having permission to share it.

No. 11Changes

If we change this notice, we'll update the date at the top. If a change matters for houses already built, we'll tell buyers by email where we can.