This Privacy Policy explains how Petrol Pack collects, uses, and protects your personal data when you place an order or use petrol-pack.com (the "Site"). It is written to comply with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Portuguese Law 58/2019.
The data controller for your personal data is:
We are not required to appoint a Data Protection Officer under Article 37 GDPR, but if you have a data-related concern you can reach us at the addresses above and we will respond promptly.
We only collect what we need to fulfil your order and run our service. The table below is the exhaustive list.
| Category | What it is | Why we collect it | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Contact | Email address, name | Order confirmation, shipping updates, support | Contract performance — Art. 6(1)(b) |
| Shipping | Postal address, phone (if provided) | Delivering your card | Contract performance — Art. 6(1)(b) |
| Card content | Nickname, vehicle description, owner name, build type, specs, card number, race number | Producing the card artwork you configured | Contract performance — Art. 6(1)(b) |
| Photo | The car image you upload | Producing the AI-rendered card artwork | Contract performance — Art. 6(1)(b) |
| Payment | Payment token from Stripe (we do not receive your full card number) | Processing your order | Contract performance — Art. 6(1)(b) |
| Order metadata | Order ID, timestamps, order status, chosen render index, T&C acceptance timestamp, chosen renders | Fulfilment, audit trail, dispute resolution | Contract performance + legitimate interest — Art. 6(1)(b) & (f) |
| Server logs | IP address, user-agent, request path (short-lived, on Render.com) | Security, error diagnosis, abuse prevention | Legitimate interest — Art. 6(1)(f) |
| Gallery inclusion | Publication of the finished card + car photo (plate blurred) on the Site and social channels | Marketing the Petrol Pack service | Consent — Art. 6(1)(a) (opt-in checkbox at checkout; revocable at any time) |
We do not use analytics cookies, advertising trackers, or third-party marketing pixels on this Site. If that ever changes we will update this Policy and, where required, ask for your consent through a cookie banner.
We use only strictly necessary cookies to keep the site functional (for example, to remember your configurator selections while you place an order). These do not require consent under Article 5(3) of the ePrivacy Directive as implemented in Portugal.
To run the service, we rely on the following processors and infrastructure providers. Each has been chosen for security posture and — for those outside the EEA — appropriate GDPR-compliant safeguards (Standard Contractual Clauses or an adequacy decision).
| Provider | Role | Location | What they see |
|---|---|---|---|
| Stripe (Stripe Payments Europe, Ltd.) | Payment processing | Ireland / US (SCCs) | Payment details, email, shipping address |
| Replicate | AI image rendering | US (SCCs) | The photo you upload (used only to generate renders) |
| Render.com | Application hosting | US (SCCs) | All order data at rest; server logs |
| Resend | Transactional email (order + shipping notifications) | US (SCCs) | Your email address and message content |
| Cloudflare | DNS, CDN, email routing for our domain | Global CDN (SCCs) | Site traffic metadata; inbound email routing metadata |
| Google Fonts | Web fonts (Archivo, Geist Mono) served to your browser | US (SCCs) | Your IP address when your browser fetches the font file |
| Shipping carrier(s) | Delivering your card (CTT, DHL, etc. depending on destination) | Varies by carrier | Your name, shipping address, phone if provided |
We do not sell, rent, or license your data to any third party. We only share what is necessary for each processor to perform its service.
Some of the processors above are established in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) with each provider, or, where applicable, an adequacy decision. Copies of the SCCs are available on request at privacy@petrol-pack.com.
If you exercise your right to erasure (see section 8), we will delete personal data not subject to a legal retention obligation, and mark the remaining tax records as read-only.
We store data on Render.com infrastructure with encryption in transit (TLS) and at rest. Payment data is handled by Stripe and never stored on our servers. Access to the admin interface is protected by an admin token. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Portuguese data protection authority (CNPD) within 72 hours and, where required, notify you directly.
Under GDPR you have the following rights in respect of your personal data:
To exercise any of these rights, email privacy@petrol-pack.com with your order ID (if applicable). We will respond within one month.
We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR. The AI image rendering step is a creative production step, not a decision about you.
Petrol Pack is intended for customers aged 18 or older. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please email privacy@petrol-pack.com and we will delete it.
We may update this Policy from time to time. The version in effect when you interact with the Site or place an order is the one that applies to that interaction. Material changes will be flagged on the homepage for a reasonable period.
For any privacy question or to exercise your rights, contact us at privacy@petrol-pack.com.