Privacy Policy

This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what you can ask us to do about it. We apply the same standard to everyone who buys a square, wherever you live.

1. Who is responsible for your data

This website and the project are operated by KBI Invest & Management AG, which decides how and why your personal data is used (the “controller”). This is the company you contract with when you buy a square.

For any privacy question, or to exercise any of the rights in section 9, email support@supercardrawing.com. A person reads that inbox — there is no automated privacy portal.

2. What we collect

Account and contact details:

• Your email address
• Your name, if you give one (optional)
• Your public display name and social handle, if you give them (optional)
• Your password, stored only as a secure one-way hash — we never store or see the password itself
• Whether you opted in to the public leaderboard, and whether you opted in to marketing email

Purchase and artwork details:

• Your orders: which squares, which panel, the price, the currency, the payment status, and Stripe's payment references
• The colours you choose for your squares
• Refund records, including the reason and any internal note attached to a refund
• Any discount or coupon code you redeem

Records of what you agreed to:

• Consent logs: which version of the Terms, Privacy Policy and Project Rules you accepted, whether you opted in to marketing, and when
• A truncated one-way hash of your IP address and your browser's user-agent string at the moment you accepted, stored with your order and your consent record. We treat the IP hash as personal data, even though it is hashed, because for some addresses it could in principle be reversed

Security and account-protection data:

• Login session records
• One-time login codes and password-reset tokens, stored as hashes
• Failed login counts and any temporary account lock, used to stop people trying to break into your account

Support and administration data:

• Notes our admins write about a customer or an order — for example a note explaining a support decision or a refund
• An internal audit log of administrative actions taken in our admin area
• Internal notification messages sent to the project owner when a sale happens, which contain your name, email, squares and colours

Email delivery data:

• A suppression list of email addresses that have unsubscribed, bounced or complained, so we do not email them again
• For marketing campaigns, a hashed record of which addresses a campaign was sent to, and delivery outcomes such as bounces and unsubscribes

We never receive or store your card details. Card data goes directly to Stripe and we only ever see the payment reference and whether it succeeded.

We do not collect special category data (such as health, religion, ethnicity or biometrics), and we ask you not to put anything of that kind into free-text fields such as your display name.

3. Why we use it, and our legal basis

Where data protection law requires a legal basis, these are ours:

• To sell you a square and paint it — taking your order, reserving squares, taking payment, recording your colours, running your account dashboard, and emailing you about your order. Basis: performance of our contract with you. Providing this data is necessary; without it we cannot sell you a square.
• To stop the same square being sold twice and to keep the artwork record accurate. Basis: performance of our contract and our legitimate interest in a correct, fair artwork.
• To keep accounting, tax and business records and to respond to lawful requests. Basis: legal obligation.
• To prove what you agreed to — the consent logs, including the hashed IP and browser string. Basis: legal obligation and our legitimate interest in being able to show what was agreed and when.
• To protect accounts and prevent fraud and abuse — session records, login codes, failed-login counts, temporary locks, and the hashed IP and browser string on orders. Basis: our legitimate interest in keeping the service and your account secure.
• To handle support, refunds and moderation — including admin notes and the admin audit log. Basis: our legitimate interest in running the project properly and being accountable for admin decisions, and performance of our contract.
• To show you on the public leaderboard — only your chosen display name or handle. Basis: your consent, which is off unless you switch it on and which you can withdraw at any time.
• To send you project and marketing updates. Basis: your consent, which you can withdraw at any time using the unsubscribe link or by emailing us. Order-related emails are not marketing and are sent under the contract basis above.
• To publish the artwork — photos and videos of the car showing squares and colours. Basis: our legitimate interest in making and publishing the artwork. These show squares and colours, not your identity.

4. What is public and what is not

Your squares and their colours are part of a public artwork and appear on the website and in photos, videos and press coverage. Your name and email address are never shown publicly. Your display name or handle appears on the public leaderboard only if you opted in — it is off by default and you can turn it off again at any time by contacting us.

5. Who we share it with

We do not sell your personal data, and we do not share it with anyone for advertising or ad targeting. We share it only with the companies that make the service work, and only for that purpose:

• Stripe — payment processing. Stripe receives your email and payment details directly and acts as its own controller for payment and anti-fraud purposes.
• Resend — sends our order and account emails (confirmations, login codes, painting updates). Receives your email address and the message content.
• Brevo — sends optional marketing campaigns, if you opted in. Receives your email address and campaign engagement data.
• Vercel — hosts the website and runs the application and its server logs, and provides the cookieless aggregate analytics described in section 12.
• Prisma Postgres — our managed database provider, which stores the data described in this policy.
• The project owner and admin staff — who receive internal sale notifications containing your name, email, squares and colours, and who can see your account and orders in the admin area.
• Professional advisers (such as accountants and lawyers), where genuinely needed.
• Authorities, where we are legally required to disclose, or to establish or defend legal claims.

6. Where your data goes

We are based in Switzerland and our buyers are all over the world. As a plain statement of fact, your personal data is processed in Switzerland, the European Union and the United States, and may be accessible from other countries where our providers or their support teams operate:

• KBI Invest & Management AG — Switzerland
• Stripe — United States
• Resend — United States
• Brevo — European Union and United States
• Vercel — United States
• Prisma Postgres — hosted in the region configured for our database

This means your data crosses borders, including out of the country you live in.

7. How long we keep it

These are the periods we work to. Where a longer legal retention period applies to a record, the legal period wins.

• Orders, payments, refunds and invoices — 10 years from the end of the business year they belong to, because they are accounting records we are legally required to keep.
• Which squares you own and the colours you chose — kept as a permanent record of the artwork, because the square is physically painted on a real car. If you ask us to erase your data, we keep the square and colour but detach your identity from it.
• Your account (name, email, display name, password hash, preferences) — while your account exists, and then up to 3 years after your last order or login, unless you ask us to delete it sooner.
• Consent records — the fact of what you accepted and when: 10 years, alongside the order it relates to. The hashed IP and browser string attached to that record: 12 months, then deleted.
• Hashed IP and browser string on orders — 12 months.
• Login sessions — until they expire, then purged within 30 days.
• Login codes and password-reset tokens — until used or expired, then purged within 7 days.
• Failed-login counts and account locks — reset on a successful login, and in any case kept no longer than 12 months.
• Admin notes about a customer — 3 years from when they were written.
• Admin audit log — 3 years, so we can account for administrative decisions.
• Internal sale notifications containing your name and email — 12 months.
• Marketing campaign records (hashed recipients, delivery outcomes) — 24 months.
• Email suppression list (unsubscribes, bounces, complaints) — kept indefinitely, on purpose. This is the record that stops us emailing you again, so deleting it would undo your unsubscribe.
• Server and security logs — around 30 days, as retained by our hosting provider.

Being honest about deletion: we cannot always delete everything. Order and payment records have to be kept for accounting and tax purposes even if you ask us to erase your data. In that case we delete or anonymise everything we can and keep only the record we are required to keep — see section 9.

8. Data you did not give us directly

Most of what we hold comes from you. Two things do not:

• From Stripe — payment outcome, payment references, the currency and amount, and refund and dispute status.
• From our email providers — delivery outcomes such as bounces, spam complaints and unsubscribes, which feed our suppression list.

9. Your rights

We apply these rights to everyone, wherever you live, rather than only to buyers in particular countries:

• Access — ask what we hold about you and get a copy
• Correction — have inaccurate data fixed
• Erasure — ask us to delete your data, subject to the accounting records we must keep
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format, and ask us to send it to another provider where that is technically possible
• Restriction — ask us to pause using your data while a dispute is sorted out
• Objection — object to processing we do on the basis of legitimate interests
• Withdraw consent — for marketing email or leaderboard visibility, at any time, without affecting anything done before you withdrew it
• Complain — to us, or to a data protection authority (section 11)

To use any of these, email support@supercardrawing.com. We will respond within one month, and will tell you if we need longer or if we have to keep something. We will not charge you or treat you worse for asking. We may need to check you are who you say you are before acting on a request.

10. No automated decision-making

We do not make decisions about you by purely automated means that produce legal effects or similarly significantly affect you, and we do not profile you. The automated checks in the service — such as whether a square is still available, or whether an account should be temporarily locked after repeated failed logins — are operational rules, not decisions about you as a person, and you can always reach a human at the address above.

11. Complaints

Please come to us first at support@supercardrawing.com — we would rather fix it. You can also complain to a data protection authority:

• Switzerland — the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch, which supervises us as a Swiss company
• United Kingdom— the Information Commissioner's Office (ICO), ico.org.uk
• European Union — the data protection authority of the country you live in; the list is published at edpb.europa.eu
• Anywhere else — you may have rights and a supervisory authority under your own local law. Contact us and we will help you exercise them.

12. Cookies and analytics

We use three cookies. All of them are strictly necessary to make the site work, so there is no cookie banner to click:

• huracan_buyer_session — keeps you logged in to your account
• huracan_admin_session — keeps project admins logged in to the admin area
• huracan_currency — remembers which currency you chose to see prices in

Those are the only cookies we set. We have no advertising cookies, no tracking pixels, no social media trackers and no ad networks, and we never use your data for advertising or ad targeting.

Aggregate, cookieless analytics

We do measure how the site is used, so we know which pages people actually reach and whether the site works on their device. We use Vercel Web Analytics, run by Vercel, who already host this site. It works without cookies:

• It sets no cookie and stores nothing on your device — no identifier in your browser storage, nothing that persists after you close the tab.
• It does not follow you between visits or across sites. Visitors are counted using a temporary value derived from ordinary request information, which changes regularly and cannot be linked back to you or matched with any other site.
• What is collected: the page address visited, the page you came from, and coarse technical facts — country, browser, operating system and device type. Your full IP address is not stored.
• One event about orders.When an order completes we record that a purchase happened, with the currency and a size band for the number of squares (for example “6-25”). That is all. No name, no email, no account, no order number, no square positions and no amount — nothing that says which order or which person it was.
• Where it is not used: the admin area and our internal development tools are excluded entirely.

Because this data is aggregate and sets nothing on your device, it does not identify you, and no consent banner is required for it. It is processed by Vercel Inc. (United States) as our processor, under the same arrangement as our hosting, and we use it only to understand traffic and improve the site.

Your selected squares are stored in your own browser's local storage before checkout; that stays on your device and is not sent to us until you order.

13. Security

Passwords are stored only as hashes, login codes and reset tokens are stored as hashes, sessions are held in cookies that JavaScript cannot read, and card data never reaches our servers. No system is perfectly secure, but we take this seriously and will tell you and the relevant authority if a breach affects you and we are required to.

14. Children

This service is not for children. You must be 18, or have permission from a parent or guardian, to buy a square. We do not knowingly collect data from children; if you believe we have, tell us and we will delete it.

15. Changes to this policy

We may update this policy. The version you accepted at checkout is recorded with your order, and the current version number is shown at the top of this page. If we make a significant change, we will tell buyers by email.

16. Contact

Privacy questions, or to exercise any right above: support@supercardrawing.com. Full company details are on the Legal Notice page.