Legal
Privacy Policy
Effective: 2026-04-20
This Privacy Policy explains how Cartman Calls ("we") collects, uses, and protects personal data when you use cartmancalls.com (the "Service"). We process data in line with applicable law, including the EU GDPR.
1. Data we collect
- Account data: email, hashed password, account preferences.
- Telegram link: Telegram chat ID, username, language code (when you link the bot).
- Order data: bundle purchased, ticket count, payment provider reference (handled by our PSP — we do not store full card numbers).
- Usage data: log entries (IP, user agent, timestamps), session cookies, basic analytics events.
- Support data: messages you send to us.
2. Why we use it (legal bases)
- Performance of contract: creating accounts, delivering tickets, sending calls, processing refunds.
- Legitimate interest: securing the Service, preventing fraud, improving features.
- Consent: optional analytics/marketing emails — withdrawable at any time.
- Legal obligation: tax records, response to lawful requests.
3. Cookies
We use strictly-necessary cookies for authentication and session security. Any non-essential analytics cookies require your consent and can be revoked from your browser settings.
4. Sharing
We share data only with processors needed to run the Service:
- Hosting and database (Supabase, Vercel)
- Payment provider (LemonSqueezy)
- Email delivery (Resend)
- Bot delivery (Telegram)
- Error monitoring (Sentry)
Some processors are based in the United States. Transfers rely on Standard Contractual Clauses or equivalent safeguards.
5. Retention
- Account data: while your account is active and up to 12 months after closure.
- Order/tax records: up to 7 years where required by law.
- Logs: typically 90 days.
- Telegram chat ID: until you unlink, plus a short audit window.
6. Your rights (EU/UK users)
- Access, rectify, or delete your data.
- Restrict or object to processing.
- Data portability.
- Withdraw consent at any time.
- Lodge a complaint with your local supervisory authority.
To exercise rights, email privacy@cartmancalls.com.
7. Security
We use TLS in transit, encrypted-at-rest databases, hashed passwords, and least-privilege access. No system is perfectly secure; report concerns to security@cartmancalls.com.
8. Children
The Service is not intended for anyone under 18. We do not knowingly collect data from children.
9. Changes
We may update this Policy. Material changes will be communicated via email or in-app notice.