Privacy policy

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

For all data protection questions, write to support@car-artistry.com. We have not appointed a data protection officer because we are not required to. [TODO: confirm no DPO is required]

2. Overview of processing

The table gives a summary. The sections below explain each point in more detail. Legal bases refer to Art. 6(1) GDPR: (a) consent, (b) performance of a contract, (c) legal obligation, (f) legitimate interests.

3. Ordering and delivery

When you order a video, we process:

• your email address, so we can send the confirmation and the video;
• for a Quick Dance (€9): the dance you chose, the recipient’s name (up to 20 characters) and your optional message (up to 60 characters);
• for a Custom Dance (€49): your reference video, the prop, optional sign text (up to 40 characters) and an optional note (up to 300 characters);
• order number, date, price, tax and order status;
• the finished video.

Quick Dance videos are rendered automatically on our render server (see section 11). Custom Dance videos are made by hand by our team. We need this data to perform the contract (Art. 6(1)(b) GDPR). We keep order and invoice records for 10 years because Bulgarian accounting and tax law requires it (Accountancy Act, Закон за счетоводството; Art. 6(1)(c) GDPR).

Names and messages may contain personal data about the recipient. Please only enter what is needed for the video. We check texts against a list of blocked words. If a text is flagged, a person on our team reviews the order before it is made (Art. 6(1)(f) GDPR; our legitimate interest is preventing abuse and protecting third parties).

Download links for finished videos work for 30 days. We delete finished videos 90 days after delivery. [TODO: confirm retention period for finished videos]

4. Reference video uploads

For a Custom Dance, you upload a reference video (MP4 or MOV, up to 60 seconds, up to 200 MB). Magnus recreates the movement. The person in your video never appears in the result. We use the video only to learn the dance for your order. We do not use it to identify anyone, we do not create biometric templates, and we do not use it to train AI models. [TODO: confirm reference videos are not used for AI training]

Before uploading, you must confirm: “I own this video or have permission to use it.” If other people can be seen in the video, you are responsible for making sure they agree to it being sent to us for this purpose.

If you appear in a reference video that someone else sent us, we process your image and movement based on our legitimate interest and the customer’s interest in the order (Art. 6(1)(f) GDPR). You can object at any time. Write to support@car-artistry.com and we will delete the video.

Deletion:

• Reference videos are deleted 30 days after delivery.
• Uploads that are never attached to a paid order are deleted after 24 hours.
• If we decline an order, the reference video is deleted after the refund.

Uploads are stored in Supabase Storage in the [TODO: Supabase region, e.g. EU (Frankfurt)] region.

5. Payments (Stripe)

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. When you pay, you enter your payment details directly with Stripe. We never see your full card number. Stripe also calculates VAT (Stripe Tax), which needs your country and, where required, your address.

Stripe processes payment data as its own controller, including for fraud prevention and to meet its legal obligations. Stripe’s privacy policy is at stripe.com/privacy. We receive the payment status, the amount, the tax data and a payment reference. Legal basis: Art. 6(1)(b) and (c) GDPR.

6. Transactional emails (Resend)

We send order confirmations, status updates, delivery emails, sign-in codes and consent confirmation emails through Resend (Plus Five Five, Inc., USA). Resend processes your email address and the content of the email on our behalf. These emails are part of the service, so you cannot unsubscribe from them (Art. 6(1)(b) GDPR). [TODO: verify Resend legal entity and data processing agreement]

7. Accounts and the meme generator

Anyone can make a meme at /memes. The meme is created in your browser. To download it, you need a free account. We use Supabase Auth (Supabase, Inc.) in the [TODO: Supabase region] region for this.

How you sign in

• Email code or magic link: we send a one-time code or link to your email address.
• Google or Apple: only if you choose it. Google Ireland Limited or Apple Distribution International Ltd. confirms your identity. We receive only your email address (with Apple, possibly a private relay address). The provider’s own privacy policy applies to the sign-in itself.

What we store

• your email address and whether it is verified;
• a counter of your free downloads. Each account gets 3 free downloads after email verification;
• that you accepted the terms, and your marketing choice (see section 8).

Abuse prevention

• Meme text is checked against a list of blocked words before download. [TODO: confirm whether meme text is stored after the check]
• To limit signups (5 per hour per location), we store a salted hash of your IP address, never the address itself. The hash is deleted after 30 days.
• Signups from temporary (disposable) email domains are refused.

Legal basis: Art. 6(1)(b) GDPR for the account and download credits; Art. 6(1)(f) GDPR for abuse prevention (our legitimate interest in keeping a free service fair and free of spam). We keep your account until you ask us to delete it.

8. Marketing emails and double opt-in

When you sign up or order, you can tick an optional box: “Send me Magnus news and offers.” It is never ticked in advance, and free memes never depend on it.

• Double opt-in: we send a confirmation email. You only receive marketing emails after you click the link in it.
• What you receive: a welcome email, one follow-up email on day 2 introducing Quick Dance, and after that occasional news and offers about Magnus Brick.
• Proof of consent: we store the time of your consent, the time of your confirmation and where you gave it.
• Resend Audience: once you confirm, your email address is added to a contact list (“Audience”) at Resend, which we use to send these emails.
• Withdrawal: every marketing email has an unsubscribe link. You can also write to support@car-artistry.com. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). After you withdraw, we remove you from the Audience and keep the consent record for 3 years to be able to prove it (Art. 6(1)(c) and (f) GDPR). [TODO: confirm retention of consent records]

9. Automation (n8n)

We may use the workflow tool n8n to connect our systems, for example to notify our team about new orders or orders that need review. Order events are sent to n8n via a webhook and may include the order number, product, status and email address. n8n runs [TODO: n8n host: self-hosted (where) or n8n Cloud (n8n GmbH, Berlin); delete this section if not used]. Legal basis: Art. 6(1)(b) and (f) GDPR.

10. Hosting and server logs (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes your IP address, browser type, requested pages and timestamps so the site can be delivered and protected against attacks. Logs are kept for [TODO: Vercel log retention]. Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation of the website).

11. Render server (Railway)

Quick Dance videos are rendered on a server hosted by Railway Corporation, USA. The server receives the chosen dance, the recipient’s name, your message and an order reference, and returns the finished video. It does not store this data after rendering. [TODO: confirm Railway region and that no data is kept] Legal basis: Art. 6(1)(b) GDPR.

12. Analytics

[TODO: Plausible enabled: yes / no. Delete this section if not used.] If enabled, we use Plausible Analytics (Plausible Insights OÜ, Tallinn, Estonia) to count page views. Plausible sets no cookies, does not store IP addresses and does not build profiles. We only see aggregated numbers. Legal basis: Art. 6(1)(f) GDPR (understanding how the website is used).

13. Cookies

We use no tracking or advertising cookies. We only set cookies that are strictly necessary:

• a login session cookie when you sign in to your meme account;
• an admin session cookie for our own team.

These cookies are needed to provide the service you asked for, so no consent is required (§ 165(3) TKG 2021). That is why there is no cookie banner. Payment pages are provided by Stripe, which may set its own necessary cookies for fraud prevention.

14. Service providers and recipients

We use the following providers. Where they act on our behalf, we have data processing agreements with them (Art. 28 GDPR).

We also pass data to tax authorities, courts or our tax advisor where the law requires it. We do not sell your data.

15. Transfers outside the EU

Some providers are based in the USA or may access data from there. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise, we use the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards by writing to us. [TODO: check each provider’s DPF certification and SCCs]

16. How long we keep data

• Orders and invoices: 10 years (Bulgarian Accountancy Act).
• Reference videos: 30 days after delivery.
• Uploads never attached to a paid order: 24 hours.
• Finished videos: download link valid 30 days; the file is deleted 90 days after delivery. [TODO: confirm 90 days]
• Accounts: until you ask us to delete them.
• Signup IP hashes: 30 days.
• Marketing consent records: while the consent is active, plus 3 years. [TODO: confirm 3 years]
• Server logs: [TODO: Vercel log retention].

If we need data longer to establish or defend legal claims, we keep it only for that purpose.

17. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR);
• withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR).

To use these rights, write to support@car-artistry.com. We may ask you to confirm your identity.

You also have the right to complain to a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg. You can also complain to the authority in the EU country where you live or work.

18. No automated decision-making

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The blocked-word check only routes an order to a person on our team. A human decides whether an order is declined.

19. Children

Our service is not intended for people under 16. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, please contact us and we will delete it.

20. Changes to this policy

We update this policy when our service or the law changes. The current version is always on this page, with the date of the last update at the top. See also our terms and Impressum.