1. Introduction

This Privacy Policy explains how Beepaway ("we", "us", "our") processes personal data when you use beepaway.com and related services.

By using the Service, you acknowledge this Policy. For how we provide the Service, see our Terms of Service.

2. Data Controller

The data controller is:

• [Company Legal Name]
• [Registered Address]
• [Company Registration Number]
• Email: support@beepaway.com

3. Information We Collect

We collect only what we need to operate the Service. Categories include:

• Account data: email, name, bcrypt-hashed password, user ID, membership status, coin balance, account timestamps
• Vehicle data: make, model, year, trim (optional), VIN, system type, vehicle ID
• Configuration data: config file metadata, user config status (pending/ready/downloaded), download timestamps
• Download security data: download tokens, IP address at download, token expiry
• Coin ledger: transaction amounts, types (purchase, spend, refund, admin adjustment), descriptions, reference IDs, balance after each transaction
• Payment orders (coins): click ID, package, coin amount, price, order status, paid amount, PureCheckout postback snapshot (JSON metadata — not full card numbers)
• Shop orders (dongle): click ID, product SKU, price, status, paid amount, postback snapshot
• Shop restock signups: email and locale preference
• Model requests and waitlist entries when those features are used
• Authentication cookies: NextAuth session cookie (HTTP-only, ~7 days)
• Analytics: anonymized page views and usage via Vercel Analytics
• Server logs: IP address, user agent, request paths, timestamps (via our host Vercel)

4. Lawful Bases (GDPR)

We process personal data on the following bases under Article 6 GDPR:

• Contract (Art. 6(1)(b)): account, vehicle profiles, deliverables, coin balance, downloads
• Legal obligation (Art. 6(1)(c)): tax, accounting, or compliance where applicable
• Legitimate interests (Art. 6(1)(f)): fraud prevention, security, abuse detection, service improvement — balanced against your rights
• Consent (Art. 6(1)(a)): where we ask for explicit consent (e.g. deliverables acknowledgment before coin redemption); you may withdraw consent where applicable without affecting lawfulness of prior processing

5. How We Use Your Information

• Provide configuration files, PDF guides, and coin redemption
• Process payments and credit coins via PureCheckout fulfillment data
• Authenticate sessions and secure downloads
• Respond to support requests
• Improve the Service using aggregated analytics
• Comply with legal obligations and enforce our Terms

6. Storage & Security

Data is stored in PostgreSQL (Neon) with encrypted connections. Passwords are bcrypt-hashed. Access is restricted to systems that need it.

Payment card data is processed by PureCheckout; we do not store full card numbers on our servers.

7. Data Retention

• Account and vehicle data: while your account is active; deleted or anonymized after deletion request subject to legal holds
• Download records and IP addresses: up to 2 years for security and audit
• Coin transactions and payment orders: up to 7 years where required for accounting and dispute resolution
• Server logs: typically up to 90 days
• Analytics: retained per Vercel's policies in aggregated form

8. Sharing & Processors

We do not sell your personal data. We share data with processors who help us run the Service:

• Neon (PostgreSQL database hosting)
• Vercel (application hosting, server logs, Vercel Analytics)
• PureCheckout (payment processing and fulfillment verification)
• Authorities when required by law

9. Your Rights

If you are in the EU/EEA or UK, you may have the right to access, rectify, erase, restrict, or object to processing, and data portability where applicable.

To exercise rights, email support@beepaway.com with subject "Privacy Request". We respond within one month where required by law.

You may lodge a complaint with your local data protection supervisory authority.

You may delete your account via account settings where available, or by contacting support.

10. Cookies

Essential: NextAuth session cookie for login (required for authenticated features).

Analytics: Vercel Analytics may use cookies or similar technologies for aggregated statistics. You can limit cookies in your browser; blocking essential cookies prevents login.

11. Children

The Service is not directed at anyone under 18. We do not knowingly collect data from children.

12. International Transfers

Your data may be processed in the EU and other countries where our processors operate. Where transfers occur outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses where required.

13. Changes

We may update this Policy. The "Last updated" date will change for material updates.

14. Contact

Privacy questions: support@beepaway.com (subject: "Privacy Request").