Privacy policy
Last updated November 15, 2026 · Version 1.6
1. Scope and who is responsible
This policy explains what personal information we process when you browse WrapYourTesla, use the editor, create an account, contact us, use AI generation or purchase credit packs. WrapYourTesla operates WrapYourTesla at https://www.wrapyourtesla.com and is responsible for the service and its handling of personal information. For privacy questions or requests, contact support@wrapyourtesla.com.
2. Information we collect
- Account information: email, account identifier, display name, avatar, preferences and authentication information. Supabase handles password authentication. If you choose Google sign-in, we receive your basic profile and verified email, not your Google password or access to Gmail, Drive or contacts.
- Design content: uploaded artwork and the latest design snapshot when you save online. Editing history and local asset copies remain in this browser and do not synchronize to other devices. When you use AI generation, we also process prompts, reference images and generated results needed to fulfill your request. Avoid including sensitive personal information in prompts or artwork.
- Purchase information: order references, amounts, currencies, payment and refund status, credit balances and usage records. Full card numbers and card security codes are processed by Waffo Pancake and its payment providers, not stored on our servers.
- Support information: your email address, messages, reports and any attachments you choose to send. Do not send passwords, verification codes or full payment card details.
3. Technical information, cookies and browser storage
Our hosting, authentication and email providers may process IP addresses, browser/device information, request times, delivery status, security and error logs. We use browser storage for sign-in sessions, preferences, guest artwork, editing history, local asset copies and pending edits. Guest designs remain in your browser until you sign in and save them online; clearing site data can permanently remove local drafts, editing history and local asset copies, and sign you out. Saving online keeps the latest state, not a cloud copy of your full editing history. We do not use advertising cookies or run Google Analytics or advertising trackers on this website.
4. Website analytics
We use Cloudflare Web Analytics to understand website visits and page performance. It measures information such as page views, referring websites, browser and device type, country and loading times. It does not use cookies or browser storage for analytics, and we do not send your account details, designs or uploaded images to this service.
Separately, when you are signed in, we keep account-linked records of successful checkout openings and triggered design or gallery downloads to understand use of the service. These records contain an account identifier, operation and source identifiers, export size where applicable, and time. Download reports may wait in this browser until the same account reconnects. These records are restricted to the administrator, are not sent to Cloudflare Web Analytics, and are removed from active storage when the account is deleted. Guest downloads are not linked to a later sign-in.
5. How and why we use information
We use information to authenticate users, store and restore designs, process authorized purchases and refunds, deliver account emails, provide support and protect against abuse. Where applicable, the legal bases are performance of our contract with you, legal obligations, legitimate interests in security and support, and consent for optional communications or processing that requires it. Optional product emails can be disabled in My account; this does not stop essential authentication or security notices. We do not sell personal information or share it for cross-context behavioral advertising, and do not use Google account data for advertising or AI training.
6. Service providers and AI processing
Cloudflare hosts and delivers the website; Supabase provides authentication, the database and private file storage in the United States; Resend delivers account emails; Google verifies optional Google sign-in. Waffo Pancake handles checkout, fraud checks, tax and payments as Merchant of Record and receives the account email and order details needed for that transaction. When you use AI generation, OpenAI receives your submitted prompts and relevant reference images to produce designs using gpt-image-2 and gpt-6.1-terra. We do not send Google credentials or full payment card details to AI models. We do not train our own AI models on your content; OpenAI’s retention and data practices are governed by its applicable API terms. AI generation and the credit-purchase entry are available on the public website; payment processing is subject to Waffo Pancake checkout availability. Provider information: Cloudflare, Supabase, Resend, Google, Waffo Pancake, OpenAI.
7. Disclosure and international processing
We disclose information to service providers only as needed for their roles, to comply with a lawful request, protect users or investigate abuse, or with your permission. Private designs are not automatically published in our gallery. Your data may be processed in the United States and other countries where providers operate, whose laws may differ from yours. Where legally required, international transfers must use an applicable lawful transfer mechanism. Contact us for information about the safeguards relevant to your request. We do not claim all processing stays in your country.
8. Storage and retention
- Account and cloud designs: we keep account data, the latest saved design state and referenced assets while your account is active, unless you delete them using an available deletion option. Moving a design to Trash keeps it recoverable until permanent deletion or account deletion. Unreferenced cloud assets can be removed using storage cleanup in My account.
- Local drafts and history: guest drafts, editing history and local asset copies stay in the browser until you remove them or clear site data. Deleting an online design does not erase every local copy. Clearing site data may permanently remove work that has not been saved online.
- Account deletion: after active generations are resolved, completing account deletion removes the account and private design files from active storage. Payment and credit records are retained separately for refunds, reconciliation, tax, fraud prevention and legal obligations and are not automatically erased with account deletion.
- Other records: support correspondence is kept as needed to resolve requests and related disputes. Provider backups, email delivery records and security logs follow the relevant provider’s retention schedules. Contact us about the records relevant to your request.
9. Data security
We use HTTPS, authentication and access controls to protect private designs. Keep sign-in details secure and upload only information you are entitled to use. No storage or transmission method can guarantee absolute security. Report suspected unauthorized access or a security issue to our support email. If a personal-data breach occurs, we will take steps to contain its effects and notify affected users and authorities when and as required by law.
10. Your rights and choices
Depending on applicable law, you may request access, a copy, correction, deletion, restriction or portability of your information, object to certain processing, or withdraw consent for consent-based processing. You may also complain to your local data protection authority. Update your profile and email preferences, export designs or delete your account in My account, or contact support@wrapyourtesla.com. We may verify your identity, and respond within applicable legal time limits. Some transaction or security records may need to be retained where the law permits or requires it; we will explain any refusal or restriction. Withdrawing consent does not affect prior lawful processing.
11. Children and younger users
The service is for a general audience. If local law requires parental or guardian permission for your use, agreement or personal-data processing, that permission is required. We do not knowingly process children’s information without consent where that consent is legally required. Parents or guardians who believe a child supplied information without the required permission may contact support@wrapyourtesla.com so we can investigate and take appropriate action, including deletion where required.
12. Updates and contact
We update this policy when our practices change and communicate material changes through the website or account email as appropriate and as required by law. The date at the top identifies this version. Privacy contact: support@wrapyourtesla.com.