Privacy Policy
Last updated: 21 July 2026
1. Controller
Lolip Ltd. (trading as Car Artistry), Kalina Malina 24, 1111 Sofia, Bulgaria.
Email: carartistryinfo@gmail.com
2. What we process and why
- Orders: name, delivery/billing address, email, phone (optional) and the products you buy — to fulfil the contract (Art. 6(1)(b) GDPR). Order data is retained as long as commercial and tax law requires.
- Payments:processed by Stripe Payments Europe Ltd. Your card or payment details go directly to Stripe and never touch our servers. Stripe's privacy policy: stripe.com/privacy.
- Custom-product photos: photos you upload for custom designs are stored securely in the EU (Supabase, Frankfurt) for up to two years so we can produce your item and handle any reprints, then deleted.
- Analytics: we use PostHog (EU hosting, Frankfurt) to understand how the store is used (pages viewed, products added to cart, checkout steps). IP-based location is coarse; we do not sell data or use third-party advertising cookies.
- Newsletter: only if you opt in (checkout checkbox or footer form). You can unsubscribe at any time via the link in each email or by contacting us.
3. Cookies
- cart_id — a functional cookie that keeps your shopping cart across visits (90 days). Strictly necessary for the store to work.
- PostHog analytics cookies — used to measure store usage as described above.
- Stripe sets cookies required for secure payment processing and fraud prevention during checkout.
4. Recipients and hosting
We use carefully selected processors to run the store: Vercel (storefront hosting), Railway (shop backend, EU-West), Supabase (database and file storage, EU Frankfurt), Stripe (payments), PostHog (analytics, EU) and our logistics partners (who receive the delivery address needed to ship your order). Processing agreements are in place with these providers.
5. Your rights
You have the right to access, rectify and erase your personal data, the right to restriction and portability, the right to object to processing based on legitimate interest, and the right to withdraw consent at any time. Contact carartistryinfo@gmail.com for any request. You also have the right to lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP), cpdp.bg.
6. Changes
We update this policy when our tooling or legal requirements change; the current version is always available on this page.
