Privacy Policy
Last updated: 2 August 2026
1. Controller
The data controller is Wagon by Wagon, an individual trader established in Portugal (EU). Contact for privacy matters: support@wagonbywagon.com. The personal legal name and NIF of the operator are not published on this website; they appear on invoices and tax records as required by Portuguese law. No Data Protection Officer is required at our scale under GDPR Art. 37.
2. Data we process
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | Send draw link after checkout; respond to support requests; optional launch waitlist (“notify me when we launch”) — one public-launch notice only, not a marketing list | Art. 6(1)(b) — contract performance; Art. 6(1)(a) — consent (waitlist) |
| IP address | Security, abuse / rate-limit prevention, approximate geo for language preference | Art. 6(1)(f) — legitimate interest |
| Payment data | Process purchase via Stripe (card details never touch our servers) | Art. 6(1)(b) — contract performance |
| Wagon drawing (PNG), title, author handle, URL | Display in shared train; moderation; OG preview | Art. 6(1)(b) — contract performance |
| Report / moderation logs | Safety enforcement; DSA Art. 17 notice-and-action records | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interest |
| Cookies (functional only) | Language preference; admin session | Art. 6(1)(f) — legitimate interest (strictly necessary) |
We do not process special-category data under GDPR Art. 9. We do not use your data for automated decision-making with legal effects under Art. 22.
3. Cookies
We set only strictly necessary functional cookies — no advertising or analytics trackers. Functional cookies do not require consent under ePrivacy rules:
wbw_site_access— server-set httpOnly session when a soft-launch access password is enabled. Lets you stay signed into the private preview; not used for advertising.admin_session— server-set httpOnly session for the admin panel only. Not set for regular visitors.- Cookie-consent acknowledgement (localStorage) — records that you dismissed the necessary-cookies notice. Not used for advertising.
If analytics are added in future, set the NEXT_PUBLIC_ANALYTICS_ID environment variable — the site cookie banner will ask for consent before any tracking cookie is set, in line with ePrivacy Directive and GDPR Art. 6(1)(a). Until then, the banner only acknowledges necessary cookies.
4. Data processors
We share personal data with the following processors, each bound by a Data Processing Agreement (DPA) or equivalent contractual safeguard. Transfers outside the EEA rely on Standard Contractual Clauses (SCCs) under GDPR Art. 46(2)(c).
| Processor | Purpose | Location / safeguard |
|---|---|---|
| Vercel, Inc. | Application hosting and edge delivery | US/EU — SCCs |
| Neon, Inc. | PostgreSQL database (wagon data, moderation logs) | US — SCCs |
| Cloudflare, Inc. | Wagon image storage (R2); CDN | US/EU — SCCs |
| Stripe, Inc. | Payment processing (card data never touches our servers) | US — SCCs; Stripe PT account |
| Resend, Inc. | Transactional email (draw link after checkout; optional one-time launch notice to waitlist subscribers) | US — SCCs |
| Google LLC (Safe Browsing API) | Check wagon URLs for malware / phishing before publication | US — SCCs; URL hashes only, not full URLs |
5. Retention
- Published wagons (drawing, author, link): retained for the lifetime of the service or until removed by moderation. Soft-hidden wagons retain the drawing server-side for potential restoration.
- Email address and payment records: retained for 10 years from the date of the transaction, in line with Portuguese tax law (Código do IRC / IVA) and Stripe's record-keeping requirements.
- Launch waitlist emails: kept until we send the public-launch notice (or you ask us to delete via support@wagonbywagon.com), then removed within a reasonable period. Not used for ongoing marketing.
- Security and rate-limit logs (IP, timestamps): 12 months, then deleted.
- Moderation and report logs (DSA Art. 17): 6 months minimum, up to 18 months if the matter is under active review.
- Functional cookies: see section 3 above.
6. Your rights (GDPR)
You have the right to:
- Access — obtain a copy of personal data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — request deletion (note: erasure of a published wagon may not be possible while it forms part of the shared train; payment records are subject to tax retention).
- Restriction — ask us to pause processing while a complaint is resolved.
- Data portability — receive data in a structured, machine-readable format where applicable.
- Object — to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent (currently none, until analytics are added).
To exercise any right, email support@wagonbywagon.com. We will respond within 30 days.
As required by GDPR Art. 77: you have the right to lodge a complaint with the Portuguese data protection authority (CNPD, cnpd.pt) if you are unsatisfied with our response.
7. Security
All data is transmitted over HTTPS. Database data is encrypted at rest by Neon. Wagon images are stored in Cloudflare R2 with access restricted to our application. The admin panel is protected by a password-gated session cookie (httpOnly, Secure). We do not store raw payment card data.
In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the CNPD within 72 hours and affected individuals where required under GDPR Art. 33–34.
8. Children
The paid features of this service are for users aged 18 and over only. We do not knowingly process data of minors.
9. Changes
Material changes to this Policy will be posted on this page with an updated date. Continued use of the service after the effective date constitutes acknowledgement of the updated Policy.