Privacy Policy

1. Controller

Lolip Ltd. (trading as Car Artistry), Kalina Malina 24, 1111 Sofia, Bulgaria.
Email: support@car-artistry.com

2. What we process and why

• Orders: name, delivery/billing address, email, phone (optional) and the products you buy — to fulfil the contract (Art. 6(1)(b) GDPR). Order data is retained as long as commercial and tax law requires.
• Payments:processed by Stripe Payments Europe Ltd. Your card or payment details go directly to Stripe and never touch our servers. Stripe's privacy policy: stripe.com/privacy.
• Custom-product photos: photos you upload for custom designs are stored securely in the EU (Supabase, Frankfurt) for up to two years so we can produce your item and handle any reprints, then deleted.
• Analytics: we use PostHog (EU hosting, Frankfurt) to understand how the store is used (pages viewed, products added to cart, checkout steps). IP-based location is coarse; we do not sell data or use third-party advertising cookies.
• Support chat: when you use the help chat, what you type is sent to Anthropic (our AI provider, USA) so it can write the reply. We do this to answer your question (Art. 6(1)(b) and (f) GDPR). If you ask us to check an order, the order number and email you give are used for that lookup only. We also keep the question itself, so we can see what customers need help with: email addresses, phone numbers and order numbers are removed in your browser before it is saved, and this is only saved if you accepted analytics cookies. Please do not type card details or passwords into the chat — we will never ask for them there.
• Newsletter: only if you opt in (checkout checkbox or footer form). You can unsubscribe at any time via the link in each email or by contacting us.

3. Cookies

• cart_id — a functional cookie that keeps your shopping cart across visits (90 days). Strictly necessary for the store to work.
• PostHog analytics cookies — used to measure store usage as described above.
• Stripe sets cookies required for secure payment processing and fraud prevention during checkout.

4. Recipients and hosting

We use carefully selected processors to run the store: Vercel (storefront hosting), Railway (shop backend, EU-West), Supabase (database and file storage, EU Frankfurt), Stripe (payments), PostHog (analytics, EU), Anthropic (the AI that writes the support chat replies, USA) and our logistics partners (who receive the delivery address needed to ship your order). Processing agreements are in place with these providers.

5. Your rights

You have the right to access, rectify and erase your personal data, the right to restriction and portability, the right to object to processing based on legitimate interest, and the right to withdraw consent at any time. Contact support@car-artistry.com for any request. You also have the right to lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP), cpdp.bg.

6. Changes

We update this policy when our tooling or legal requirements change; the current version is always available on this page.