Privacy Policy

The short version

• We use your car photo to create your previews and your order. Express previews are made with AI, mainly by OpenAI. For hand-drawn orders, your photo goes to one of our designers and to no AI service.
• We delete your original Express photo automatically, at the latest 30 days after you upload it. The photo for a hand-drawn order is kept until your order is complete.
• Tracking only with your OK: Meta's pixel and our own visitor ID run only if you allow them in our banner, and you can change your mind at any time. No Google Analytics, no session recordings. We don't sell your personal information for money.
• Sharing is up to you: if you use the share button, anyone with that link can see your artwork (never your original photo). The page isn't listed in search engines. Email us and we'll take a shared page down; copies others have already saved can't be removed.
• Payments run through Stripe. We never see your full card number.
• We are a business based in Germany, so the EU's General Data Protection Regulation (GDPR) protects your data wherever you live.
• Questions or requests: hello@weprintyourcar.com.

1. Who we are

WePrintYourCar is the US store of Patrick Horn, Albrecht-Dürer-Str. 17a, 86343 Königsbrunn, Germany ("we", "us", "our"). We also run the German store Wirdruckendeinauto.de. Under the GDPR, we are the controller responsible for your personal information.

Email: hello@weprintyourcar.com · Phone: +49 15678 300782 · Mail: the address above.

2. What this policy covers

This policy covers weprintyourcar.com, the emails we send you and the messages you send us, for example on Instagram (@weprintyourcar). Sites we link to, such as Trustpilot, Instagram or Stripe's checkout page, have their own privacy policies.

3. What we collect

We don't ask for Social Security numbers or government IDs. We don't use facial recognition and don't create biometric identifiers. Please avoid photos that show other people. You can cover your license plate before uploading; we don't need it.

You don't have to give us any information. Without a photo we can't create previews, and without your contact and shipping details we can't take or deliver an order.

4. Why we use it, and our legal bases under the GDPR

5. Your photo: what happens with Express and with hand-drawn orders

Express (made with AI). When you upload a photo for an Express preview:

• An AI checks whether the photo shows a car. The request runs through OpenRouter, Inc. (USA) to the model Claude by Anthropic, PBC (USA). Your photo is transmitted.
• An AI identifies make, model and color to improve the result: Gemini by Google LLC (USA), also through OpenRouter. Your photo is transmitted.
• The previews are created mainly by OpenAI (OpenAI Ireland Limited, Ireland; parts of the processing take place at OpenAI, L.L.C., USA). If OpenAI is down or overloaded, kie.ai (NEXUSAI SERVICES LLC and INNOLEAP AI LLC, USA) takes over as a backup. Your photo is transmitted to the service that is used.
• When you order, we enlarge the image you chose to print size through kie.ai. This sends the finished image, not your photo.

Hand-drawn. For a hand-drawn order, we send your photo and your notes to one of our designers, who draws your car. Your photo goes to no AI service. Our designers work in the United States, the Netherlands, Indonesia and Japan.

Before your photo is uploaded, we show you a short notice that explains that your photo is processed outside the EU and links to this policy for the providers and the risks. Your photo is only uploaded after you agree.

6. Who receives your information

We share personal information only where it's needed for the purposes above:

• AI services for Express previews: OpenAI, kie.ai, OpenRouter, Anthropic and Google (section 5).
• Designers for hand-drawn orders: independent designers who work for us in the United States, the Netherlands, Indonesia and Japan. They receive your photo and your notes.
• Print partner in the US: Printful, Inc. prints, packs and ships your order. It receives the image you ordered, your name and shipping address, and your email or phone number for delivery updates.
• Carriers chosen by our print partners, such as USPS, UPS or FedEx: name, address and package details.
• Payments: Stripe Payments Europe, Limited (Ireland); Stripe, Inc. (USA) takes part in the processing.
• Hosting, delivery and security: Cloudflare, Inc. (USA).
• Database and file storage: Supabase, Inc. (USA). Our database and files are stored on servers in the EU (Frankfurt, Germany).
• Email delivery: Resend, Inc. (USA).
• Meta, only if you allow it: Meta Platforms Ireland Limited (Ireland), with Meta Platforms, Inc. (USA), receives ad measurement data from the pixel in your browser and the same events from our server (section 9). For collecting and passing on this data, we and Meta are jointly responsible (Art. 26 GDPR); what Meta does with it afterwards, including for its own purposes, is governed by Meta's privacy policy.
• Instagram: if you contact us there, Meta processes your messages under its own policy.
• Advisers and authorities: our tax advisor or lawyer, courts and authorities where the law requires it.

Our service providers may use your information only to provide their service to us, except where they act under their own terms as described here (such as Stripe for fraud prevention and Meta for its own purposes).

We don't sell your personal information for money. Only if you allow advertising cookies in our banner do we disclose device identifiers and activity on our site to Meta for advertising measurement and targeted ads; some state laws may call this a sale or sharing of personal information. You can refuse or withdraw this at any time under Privacy choices, and a GPC or Do Not Track signal counts as refusing. Refusing doesn't affect your ability to order. We don't give your information to other companies for their own direct marketing.

7. International transfers

We are based in Germany and many of our providers are in the US. EU law treats the US as a "third country", so it requires us to explain how each transfer is protected, even if you live in the US yourself.

• US providers (OpenAI, Stripe, Cloudflare, Supabase, Resend, OpenRouter, Anthropic, Google, Meta): EU Standard Contractual Clauses (Art. 46 GDPR) and, where the provider is certified, the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• Print partners and carriers in the US: Standard Contractual Clauses or the Data Privacy Framework. Where no such safeguard applies, the transfer is necessary to deliver your order (Art. 49(1)(b) GDPR).
• kie.ai (USA; other countries can't be ruled out): your explicit consent (Art. 49(1)(a) GDPR). We don't rely on the Data Privacy Framework for kie.ai, and kie.ai does not say in which countries it processes data.
• Designers in the United States and Indonesia: your explicit consent (Art. 49(1)(a) GDPR). The Data Privacy Framework covers only certified companies, not individual designers, and there is no EU adequacy decision for Indonesia.
• Designers in Japan: EU adequacy decision for Japan (Art. 45 GDPR). Designers in the Netherlands are inside the EU.

Risks of transfers based on your consent: in these countries the level of data protection may be lower than in the EU, your rights may be harder to enforce, and authorities may be able to access data under local law. You can withdraw your consent at any time for the future: upload no further photos, or email us at hello@weprintyourcar.com about a hand-drawn order. A copy of the safeguards we use is available on request.

8. How long we keep it

You can ask us to delete your information earlier at any time. We will, unless the law requires us to keep it.

9. Cookies, statistics, ads and Do Not Track

Without your OK we only use what the shop needs to work, for example to keep your cart, a list of your recent previews and your privacy choice in your browser.

Statistics without cookies. To improve the shop, we count steps such as "preview created" or "order completed". Without your OK, visits are counted per page load, with no lasting visitor ID. We don't store IP addresses, browser identifiers (user agent), email addresses or names for this. We keep the country only as a two-letter code, the referrer only as a fixed category, the campaign only as the UTM values of the link and the screen only as phone, tablet or desktop.

Our own visitor ID, only with your OK. If you choose "Allow" in our banner, we also store a random ID in your browser. It lets our statistics recognize your return visits, so we count people instead of page views and see how many days pass between a photo upload and a purchase. The ID stays with us; we don't pass it to Meta or anyone else. When you withdraw your consent, we delete it from your browser.

Meta pixel, only with your OK. On your first visit, a banner asks whether we may use Meta's pixel and our visitor ID. Only if you choose "Allow":

• the Meta pixel loads in your browser and sets cookies;
• Meta learns which of our ads brought you to us and what you did on our site: photo uploaded, added to cart, checkout started, purchase with order value;
• our server sends the same events to Meta through the Conversions API, with a shared event ID so nothing is counted twice; it does so only for visitors who chose "Allow";
• the events carry no email address and no other identifiers in hashed form;
• Meta uses this to measure our ads and to build audiences, so our ads reach people who visited us, and also for its own purposes under its privacy policy.

If you choose "Decline", we use neither the pixel nor our visitor ID, and the shop works exactly the same. We don't use session recording (session replay), heatmaps or chat tools from other companies. You can change your choice at any time under "Privacy choices" at the bottom of every page. After you withdraw, the pixel no longer loads; Meta cookies already set can be deleted in your browser settings.

Do Not Track and Global Privacy Control. If your browser sends a Global Privacy Control (GPC) or a "Do Not Track" (DNT) signal, we treat it as "Decline": the Meta pixel doesn't load, we send no events about your visit to Meta, and we store no visitor ID. Apart from that, our site works the same either way.

Other parties. Only Meta, and only if you choose "Allow", can use our website to collect information about your online activities over time and across different websites. In addition, for security, Stripe collects device and browser information on its checkout page to prevent fraud and may use it for that purpose across other sites that use Stripe.

If we want to use other advertising or analytics tools, we will update this policy first and ask for your consent before they run.

10. Emails

• Service emails: order confirmation, your drawing for approval, shipping updates and, if your order is delayed, a notice that lets you choose to wait or cancel.
• Your preview link: only if you ask for it, with one reminder at most.
• Emails about our products: if you bought from us, we may occasionally email you, for example with holiday order deadlines or a request for a review.
• Every email that isn't a pure service email has an unsubscribe link. One click is enough, no login needed. We stop right away, and in any case within 10 business days.
• We don't send text messages (SMS), and we don't buy email lists.

11. Showing your work (optional)

After your order, you can allow us to show your finished image (never your original photo) on our Instagram account and our website. We show it as we made it, so a license plate may be visible. To record your permission, we store the email address you ordered with, the time and the wording you agreed to. If you add your Instagram username, we use it only to tag you; it is never printed. You can withdraw your permission at any time for the future by emailing hello@weprintyourcar.com; we then stop showing your image and take down posts with it. Your order does not depend on this permission.

12. Your rights and choices

Because the GDPR applies to everything we do, you can use these rights wherever you live:

• see the personal information we hold about you and get a copy (Art. 15),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict how we use it (Art. 18),
• receive it in a common format (Art. 20),
• object to uses based on our legitimate interest, and to marketing emails at any time (Art. 21),
• withdraw any consent for the future (Art. 7(3)); for the Meta pixel and our visitor ID, use "Privacy choices" at the bottom of every page.

How: email hello@weprintyourcar.com, ideally from the address you used with us. To protect your data, we may ask for your order number before we act. We answer within one month. Using your rights costs nothing, and we won't treat you differently for using them.

Complaints: you can complain to a data protection authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

Some US state privacy laws give residents similar rights. The rights above already cover them.

13. Children

Our store is for adults. To order, you must be at least 18; free previews are for people aged 16 and over. We don't knowingly collect personal information from children under 13. If you believe a child has sent us information, email us and we'll delete it.

14. Security

We use encrypted connections (HTTPS), limit access to personal information to people and providers who need it, and bind our providers by contract. Card details stay with Stripe. No system is perfectly secure; if a data breach affects you, we will inform you as the law requires.

15. Automated decisions

We make no decisions about you that are based only on automated processing and have legal or similarly significant effects (Art. 22 GDPR). AI creates the pictures; it doesn't decide anything about you. To keep the free preview free, automatic limits can stop previews for a while, for example after many requests in a short time. If that happens, email us and we'll help.

16. California and other US states

• This policy is meant to meet the California Online Privacy Protection Act (CalOPPA). How we respond to Do Not Track signals is explained in section 9.
• We don't sell personal information for money. We disclose information to Meta for advertising only if you choose "Allow" in our banner; some state laws may call this a sale or sharing. A GPC signal counts as "Decline". We don't disclose personal information to other companies for their own direct marketing.
• If US state privacy laws apply to us in the future, we will update this policy and offer any additional rights they require.

17. Changes to this policy

When we change this policy, we post the new version here with a new effective date. If a change is material, we'll show a notice on the site before it takes effect. Earlier versions are available on request.

18. Contact

Patrick Horn · Albrecht-Dürer-Str. 17a · 86343 Königsbrunn · Germany
Email: hello@weprintyourcar.com · Phone: +49 15678 300782