Last updated
This policy describes data used for our digital Tesla wrap editor, accounts, AI generation and payments. Contact: [email protected].
Google API Services User Data Policy · Manage or revoke Google access
Google sign-in and account information
We use Google sign-in to identify your account. We request the basic openid, profile and email permissions and receive your Google account identifier, verified email address, name and profile picture. We use them to create and recognize your account, associate projects and credit balances, and handle account and payment support. We do not request access to Gmail, Drive, contacts or calendars.
Google account information is not sold, used for advertising profiles or sent as input to the AI image-generation model. Authentication uses an application session; our application does not persist Google access or refresh tokens in its account database.
How Google user data is used and shared
Google sign-in is optional for the public editor. When you sign in, the Google account identifier links your account to saved projects and credit records; your email supports account identification and purchase support; your name and profile picture identify your account in the interface. We do not use these permissions to read your emails, files, contacts or calendar.
Vercel processes sign-in requests and Supabase stores the account fields needed to operate the service. Authorized administrators can access account data for support and service administration. If you initiate checkout, Waffo receives the account identifier and email required to process and support that purchase. These disclosures are for the requested service; we do not sell Google user data or share it with advertisers or data brokers.
Google API data and AI model training
Our use and transfer of information received through Google APIs is limited to providing and improving the user-facing account features described in this policy, in accordance with the Google API Services User Data Policy and its Limited Use requirements. We do not use Google account identifiers, email addresses, names or profile pictures to develop, improve or train generalized AI or machine-learning models. Google sign-in data is not included in requests to our image-generation provider.
Image-generation requests contain the vehicle template, your prompt and any reference image you choose. This is separate from Google authentication data. The image provider’s handling of user-submitted artwork is governed by its own terms; this policy does not promise a provider-wide no-training or fixed-retention commitment for uploaded artwork.
AI prompt content checks
Before image generation, the text prompt is sent from our server to Waffo Pancake for a content-safety check. This check does not include your reference image, Google account details or payment information. Waffo states that this prompt-check endpoint is stateless and does not retain the original prompt. Generation proceeds only after an allow verdict; blocked, pending or unavailable checks do not charge generation credits. This text check does not examine uploaded images or generated output.
Artwork, local storage and AI requests
Editing and exporting take place in your browser. Drafts, favorites and the last homepage selection use local storage or session storage. Saving or submitting a project sends the relevant artwork and project information to our server. Submissions intended for publication include the title, vehicle and image; do not submit private information you do not want displayed.
When you choose AI generation, your prompt and any selected reference image are sent to SenseTime SenseNova (U1.5 image models), the configured AI service. Provider information is available at https://platform.sensenova.cn/docs. Provider availability and data-handling terms depend on the service enabled at that time. We do not claim that every third-party provider has the same retention or training policy. Do not include sensitive personal information in prompts or reference images.
Storage, hosting and payment providers
Supabase stores account records, project data, order records and the credit ledger. Private Supabase Storage holds uploaded images, generated files and saved thumbnails. Vercel hosts the website and server routes. Access to private account data is checked by our server.
Waffo processes hosted checkout. We provide the order details, amount, currency, account identifier and email needed for the purchase, and receive payment identifiers and status for fulfillment and support. Payment credentials are entered in the payment provider’s checkout; this application does not store full card numbers or card security codes.
Public artwork covers and web fonts may be loaded from third-party hosts. Those hosts receive ordinary network information such as IP address and browser request headers. Hosting and service providers may process data in countries other than yours; exact locations depend on the configured services.
Cookies and security
Authentication uses cookies required for sign-in and session security. We use server access controls and private storage for account content. You can sign out, clear site storage or disable cookies in your browser; doing so can remove local drafts or prevent sign-in. We do not promise that any internet service can eliminate every security risk.
Feedback and service administration
When you submit feedback, we store its content, category, account identifier and handling status. Authorized administrators can manage accounts, view saved projects, handle feedback and configure credit packages. Administrative changes are logged. Handling notes are visible to the user who submitted the feedback.
Protection and access to Google account data
The production website uses HTTPS for data in transit. Account records are accessed through authenticated server routes; database service credentials stay on the server. Saved image files use private storage and authorized reads. Administrative changes are logged. These controls reduce unauthorized access, but no internet service can guarantee absolute security.
Retention, requests and revoking Google access
Account and project information is retained while needed to provide the service. Payment, credit and support records may be retained for reconciliation, disputes or applicable legal obligations. For access, correction or deletion requests, see the Contact page. Use your account email where possible. We may verify your identity and explain records that cannot immediately be removed. This is a support-request process, not a claim of an automated account-deletion feature.
You can revoke this application’s Google authorization from your Google Account’s third-party connections settings. Revoking Google access or deleting a browser cookie does not automatically remove records already stored by this service; contact us for an account-data request.
Changes and contact
We update this page when our data practices change and show the revised date. See the Contact page for questions about this policy or available privacy rights.