Privacy Policy — Elfello

Last updated: October 16, 2026

This policy describes how data is processed in the “Elfello” mobile application for iOS and Android (identifier com.opharana.elfello) and on the page of this website that lets you join a group from your browser (hereinafter, together, “Elfello”). The data controller is OPHARANA LLC, with its registered address at 99 Wall Street, Suite 1432, 10005, New York (United States), and contact email hello@opharana.com.

1. Summary

• No passwords. We do not ask for your phone number or a password. When you open the app, or a group's link in your browser, an anonymous account is created, which is nothing more than a random identifier.
• We store only what Secret Santa needs: the name and email address you enter when you create a group or join one, the group details (name, date and budget), who cannot draw whom and the result of the draw.
• Nobody in the group sees your email address, not even the organizer. We use it to let you know what is happening in your group: that you have joined, that names have been drawn and that the exchange date is coming up.
• The draw is secret. Each person sees only who they are giving a gift to. Nobody else in the group sees it, not even the organizer.
• We do not sell your data or share it with third parties for purposes other than those described here. We only send you news by email if you tick the box to receive it, and you can unsubscribe whenever you want.
• The app is free and shows ads from Google AdMob, which processes your device's advertising identifier. In the European Economic Area (EEA), the United Kingdom and Switzerland, we ask for your consent before loading any ad. It also shows in-house ads from TuIAgencia, the owner's agency, which do not use personal data.
• Payments for Elfello Plus are processed by Apple or Google; we never see your payment details.
• You can delete your data whenever you want from the app, under Settings → “Delete my data”, or by writing to us from the email address you used (section 8).

2. Data we process

2.1. Anonymous account

When you open the app, or open a group's link in your browser, an anonymous account is created with our database provider, Supabase. It consists of a random identifier and the session data that allows us to recognize you when you come back. The account itself does not contain your name, your email address or your phone number: your name and email address are stored in each group you take part in (section 2.2).

That account is tied to your installation of the app or to the browser in which you opened the link: if you delete the app or your browser data, or switch phones, you lose access to it, and we cannot recover it because it has no password or any other way to sign back in. To protect the service, Supabase logs the IP address and technical connection data (date, time and type of device or browser).

2.2. Groups and the draw

• If you organize a group: its name, the exchange date, the budget and currency, the group code and who cannot draw whom (the exclusions you set).
• If you take part in a group (the organizer takes part too): the name and email address you enter when you create it or join it, the language of the app or the page, and whether you joined from the app or from the website.
• The result of the draw: who each person is giving a gift to.

You decide what name you write. You do not need to use your full name: the name or nickname your group knows you by is enough. Please do not include sensitive data or other people's data. The email address must be yours: do not enter someone else's without their permission.

Who sees what:

• Anyone who has a group's link or code can see its name, the organizer's name, the date, the budget, how many people have joined and whether the draw has already taken place. That is why it is best to share the link only with the people in the group.
• Members of the group can also see each other's names.
• Nobody in the group can see your email address, not even the organizer. Only we use it, for the purposes explained in section 2.3.
• Only you can see who you are giving a gift to. The organizer can see the exclusions they have set, but not the result of the draw.

2.3. Your email address: group notifications and news

We ask for your email address when you create a group or join one, from the app or from the website. We use it for:

• Group notifications, which are part of the service: confirming that you have joined, letting you know when names have been drawn, with the link to find out who you are giving a gift to, and reminding you of the exchange date. These notifications may include a link to download the app.
• News from Elfello and other OPHARANA LLC apps, only if you tick the box to receive it when you create the group or join one. The box is never ticked in advance. You can unsubscribe whenever you want using the link included in each of those emails or by writing to us at hello@opharana.com. Unsubscribing does not affect your group notifications.

If you tick the box, we store your email address on our news mailing list, together with your language, whether you joined from the app or from the website and the date you signed up. That list is separate from your groups.

To send the emails, we use an email delivery provider that acts as a data processor: it only receives what it needs to deliver each message (your address and its content) and cannot use it for anything else.

2.4. Invitations and free months of Plus

To apply the free Elfello Plus months promotion (details in the Terms), we store which account invited you (that of the organizer of the first group you join), whether the reward for your invitation has already been granted, how many months you have earned and until what date you have free Plus. We do not use any contact details for this promotion, whether yours or those of the people you invite.

2.5. Advertising (Google AdMob)

The app shows ads through Google AdMob: a banner and, at specific moments (for example, after creating a group or drawing names), a full-screen ad. Google may process, among other data: the device's advertising identifier (IDFA on iOS, AAID on Android), device data, approximate location derived from the IP address, ad interactions and diagnostic data from its SDK. This processing is governed by Google's Privacy Policy and its information on how data is used on partner sites and apps. We never send your name, your email address or your groups to advertising services.

In addition, the app shows in-house ads from TuIAgencia, the owner's services agency. These ads are served inside the app, do not use the advertising identifier or any personal data, and do not profile you. If you tap one, the tuiagencia.com website opens in your browser. The web page for joining a group does not show any advertising.

2.6. In-app purchases (Elfello Plus)

The app offers Elfello Plus, which removes the ads and lets you organize unlimited groups, in two forms: a monthly subscription, which renews automatically and which you can cancel whenever you want, or a one-time lifetime purchase. All purchases are processed entirely by Apple (App Store) or Google (Google Play), depending on your platform, under their own privacy policies.

We do not receive or store your card, bank account or billing details, or your postal address: the store only confirms to us that a purchase has been completed. To validate the purchase and make it possible to restore it, we use RevenueCat, which receives an anonymous identifier and the store receipt, without your name or your email address.

Refunds and payment disputes are handled through Apple or Google, not through us.

2.7. The page for joining from your browser

If you open a group's link in your browser (elfello.com/u/ followed by the group code), the page creates your anonymous account and stores the session data in your browser (local storage, under the key elfello.sesion) so that it can recognize you when you open the link again. This is essential for the service you request, it is not used to track you and it is not used for anything else. What you write on that page (your name, your email address and whether you want to receive news) goes directly from your browser to Supabase over an encrypted connection.

2.8. When you write to us

If you write to us at hello@opharana.com, we process your email address and whatever you tell us for the sole purpose of handling your question, your issue or the exercise of your rights.

3. Purposes and legal bases (GDPR)

4. Advertising and your consent

• EEA, United Kingdom and Switzerland: before loading any Google ad, the app shows Google's consent form (User Messaging Platform, UMP). You can accept personalized advertising or decline it; in that case, non-personalized ads are shown.
• iOS: in addition, the system shows Apple's tracking prompt (App Tracking Transparency). If you do not allow it, the IDFA is not used and ads are not personalized.
• Changing your mind: inside the app, in Settings, through the ad privacy options; on iOS, Settings → Privacy & Security → Tracking; on Android, Settings → Google → Ads, where you can reset or delete your advertising ID.
• Removing ads: while you have Elfello Plus, including the months earned by inviting others, the app does not load any advertising.

5. Data recipients

We do not sell your data or share it with any third parties other than those listed above.

6. International transfers

The Elfello database, with the groups, names and email addresses, is hosted in the European Union (Ireland). Even so, the data controller is established in the United States, and the providers listed above, including the email delivery provider, may also process data outside the European Economic Area (EEA), mainly in the United States. These transfers rely on the Standard Contractual Clauses approved by the European Commission and/or on adequacy decisions (such as the EU-U.S. Data Privacy Framework).

7. Retention

Your anonymous account and your data are kept for as long as you use Elfello. Each group is kept until its organizer deletes it or deletes their data. Your name and email address in a group are kept until you leave it, the organizer removes you before the draw, the group is deleted or you delete your data. If you agree to receive news, your email address stays on the news mailing list until you unsubscribe, even if the group is deleted; deleting your data from the app also unsubscribes you. The emails you send us are kept for as long as it takes to handle your inquiry and, afterwards, for the time needed to demonstrate that we dealt with it. Data processed by Google for advertising purposes and by RevenueCat for purchases is retained for the periods published by each provider.

8. How to delete your data

From the app: go to Settings and tap “Delete my data”; we will ask you to confirm. The following is deleted immediately and permanently:

• the groups you organize, with everything in them (the names of the people who joined, and the draw);
• your participation in other people's groups, with your name and email address;
• your news subscription, if you had one;
• your data from the invitation promotion.

If you delete your data after a draw, your part of that draw disappears too: let the organizer know so they can redo it.

If you joined from your browser and do not have the app, write to us at hello@opharana.com from the email address you used to join and we will delete your participation and, if you had one, your news subscription. If you write to us from a different address, tell us which one you used and we will ask you for the group code and the name you joined with to verify that it is you. Clearing your browser data removes the session stored in it, but not what you wrote in the group.

If you only want to stop receiving news, use the unsubscribe link included in each of those emails.

Deleting your data does not cancel an Elfello Plus subscription: that is managed from your Apple or Google account (details in the Terms).

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing, data portability and withdrawal of consent by writing to hello@opharana.com. We will reply within one month. To locate your data, we use the email address you created the group or joined with; if you write to us from a different address, we will also ask you for the group code and the name you used in it to verify that it is you. Withdrawing your consent to receive news does not affect emails sent before then.

You also have the right to lodge a complaint with a supervisory authority; in Spain, the Spanish Data Protection Agency (AEPD), at aepd.es.

10. Minors

Elfello is not directed at children under 14 and we do not knowingly collect data from minors. We do not verify age. If you are a parent or guardian and you believe a minor is using the app, you can prevent its use with the device's parental controls (Screen Time on iOS, Family Link or the Google Play controls on Android) or write to us at hello@opharana.com.

11. Security

Communications between the app or the website and the services listed above are encrypted (TLS). The database cannot be read directly: the app and the website can only use functions that check your session on every call and return only what you are allowed to see; none of them returns other people's email addresses. The session is stored in the app's private space on your device or, on the web, in your browser's local storage.

12. Changes to this policy

If we change this policy, we will publish the new version at this same URL (https://elfello.com/en/privacidad) and update the date at the top. Material changes will be flagged in the app or on the store listings.

13. Language

This policy is published in several languages to make it easier to read. In the event of any discrepancy between versions, the Spanish version prevails.

14. Contact

OPHARANA LLC
99 Wall Street, Suite 1432, 10005, New York, United States
hello@opharana.com